Edit tour

Windows Analysis Report
SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe
Analysis ID:	1467092
MD5:	7691d7d1f5928448074900950ff80ec7
SHA1:	65025ed3950eca0eb5c253bfcad472f969dc2177
SHA256:	bab017ca2aa472dc3b0370dba0bd356939a62947f4ff83ef4810a70a68fab1df
Tags:	exe
Infos:

Detection

RHADAMANTHYS

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected RHADAMANTHYS Stealer

AI detected suspicious sample

Allocates memory in foreign processes

Found many strings related to Crypto-Wallets (likely being stolen)

Sigma detected: Potentially Suspicious Malware Callback Communication

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found inlined nop instructions (likely shell or obfuscated code)

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Dllhost Internet Connection

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe (PID: 5508 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe" MD5: 7691D7D1F5928448074900950FF80EC7)

OpenWith.exe (PID: 6468 cmdline: "C:\Windows\system32\openwith.exe" MD5: E4A834784FA08C17D47A1E72429C5109)

wmplayer.exe (PID: 6844 cmdline: "C:\Program Files\Windows Media Player\wmplayer.exe" MD5: 89DCD2D4C0EC638AADC00D3530E07E1D)

dllhost.exe (PID: 5840 cmdline: "C:\Windows\system32\dllhost.exe" MD5: 08EB78E5BE019DF044C26B14703BD1FA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88 https://github.com/echocti/ECHO-Reports/blob/main/Malware%20Analysis%20Report/Rhdamanthys/Rhadamanthys-EN.pdf https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2072119815.0000028A00000000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2178047810.000001696CF53000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2162730362.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2146132400.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2152607598.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2172221902.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2144743517.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2173999560.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2160604237.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2151701654.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2168919912.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2145943011.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2143914701.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2156804131.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2166530938.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2149150890.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2162510756.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2153389081.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2178284141.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2144420099.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2158433515.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2155578371.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2160318605.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2158989228.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2168693807.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2161695796.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2147712177.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2170089401.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2155772326.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2149741241.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2158123556.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2163534539.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2177149426.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2156620245.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2173760062.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2168258050.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2170716518.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2151370818.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2161419525.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2149327727.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2159254038.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2160077344.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2161993900.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2157000461.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2145568055.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2148023665.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2156429560.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2147540781.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2157257186.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2155023843.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2167528754.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2147111279.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2160876076.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2171203616.000001696CF4E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2153076808.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2154545113.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2153930987.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2157484419.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2154778492.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2161146099.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2150322070.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2169206679.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2159533104.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2075804118.000001696CF90000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000003.2177711934.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2159774834.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2147354231.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2155990457.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2179330379.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2074402005.000001696ACE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2146350943.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2163727757.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2169561570.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2168435601.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2156237400.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2158714760.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000000.00000003.2073704673.0000028A00B30000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000003.2146569417.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2172654033.000001696CF4E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2146928114.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2172791367.000001696CF4E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000003.2153718645.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2075999920.000001696D270000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000003.2173044127.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2145186850.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000000.00000003.2073514166.0000028A00850000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000003.2167868673.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2157801248.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2154177761.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2143147524.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2173382185.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2155295704.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2148943136.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2143652418.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000002.00000003.2143467189.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe PID: 5508	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: OpenWith.exe PID: 6468	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: OpenWith.exe PID: 6468	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 94 entries

Unpacked PEs

Source	Rule	Description	Author
0.3.SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe.28a00b30000.5.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe.28a00b30000.5.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.3.OpenWith.exe.1696d270000.5.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.3.OpenWith.exe.1696cf90000.4.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe.28a00850000.4.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe.28a00850000.4.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
2.3.OpenWith.exe.1696cf90000.4.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 91.92.250.172, DestinationIsIpv6: false, DestinationPort: 4433, EventID: 3, Image: C:\Windows\System32\OpenWith.exe, Initiated: true, ProcessId: 6468, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Dllhost Internet Connection

Source: Network Connection

Author: bartblaze: Data: DestinationIp: 91.92.250.172, DestinationIsIpv6: false, DestinationPort: 6015, EventID: 3, Image: C:\Windows\System32\dllhost.exe, Initiated: true, ProcessId: 5840, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49715

Snort Signatures

ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert - Source IP: 91.92.250.172 - Destination IP: 192.168.2.5

Timestamp:	07/03/24-18:07:51.707707
SID:	2854802
Source Port:	4433
Destination Port:	49714
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert - Source IP: 91.92.250.172 - Destination IP: 192.168.2.5

Timestamp:	07/03/24-18:07:34.174738
SID:	2854802
Source Port:	4433
Destination Port:	49705
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert - Source IP: 91.92.250.172 - Destination IP: 192.168.2.5

Timestamp:	07/03/24-18:07:42.652664
SID:	2854802
Source Port:	4433
Destination Port:	49706
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert - Source IP: 91.92.250.172 - Destination IP: 192.168.2.5

Timestamp:	07/03/24-18:07:57.987769
SID:	2854802
Source Port:	6015
Destination Port:	49715
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.4% probability

Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: kernel32.pdbUGP source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073301415.0000028A00850000.00000004.00000001.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073360622.0000028A00910000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075692995.000001696D050000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075629839.000001696CF90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdbUGP source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073514166.0000028A00850000.00000004.00000001.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073704673.0000028A00B30000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075804118.000001696CF90000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075999920.000001696D270000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073091575.0000028A00A40000.00000004.00000001.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2072945441.0000028A00850000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075446574.000001696D180000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075164420.000001696CF90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: OpenWith.exe, 00000002.00000003.2166148051.000001696D2DD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073091575.0000028A00A40000.00000004.00000001.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2072945441.0000028A00850000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075446574.000001696D180000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075164420.000001696CF90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073301415.0000028A00850000.00000004.00000001.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073360622.0000028A00910000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075692995.000001696D050000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075629839.000001696CF90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: lfons\AppData\Local\Temp\Symbols\winload_prod.pdb source: OpenWith.exe, 00000002.00000003.2166148051.000001696D2D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: wmplayer.exe, 00000004.00000003.2291244045.000001E29B530000.00000004.00000001.00020000.00000000.sdmp, wmplayer.exe, 00000004.00000003.2291272850.000001E29B750000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: win32u.pdbGCTL source: wmplayer.exe, 00000004.00000003.2291244045.000001E29B530000.00000004.00000001.00020000.00000000.sdmp, wmplayer.exe, 00000004.00000003.2291272850.000001E29B750000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073514166.0000028A00850000.00000004.00000001.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073704673.0000028A00B30000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075804118.000001696CF90000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075999920.000001696D270000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Windows\System32\OpenWith.exe

Directory queried: number of queries: 1001

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4x nop then ret		4_2_000001E29B43108E
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4x nop then dec esp		4_2_000001E29B435641

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2854802 ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert 91.92.250.172:4433 -> 192.168.2.5:49705
Source: Traffic	Snort IDS: 2854802 ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert 91.92.250.172:4433 -> 192.168.2.5:49706
Source: Traffic	Snort IDS: 2854802 ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert 91.92.250.172:4433 -> 192.168.2.5:49714
Source: Traffic	Snort IDS: 2854802 ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert 91.92.250.172:6015 -> 192.168.2.5:49715

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 91.92.250.172:4433

Source: Joe Sandbox View

ASN Name: THEZONEBG THEZONEBG

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: servicehost.org

Source: OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168693807.000001696D9ED000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168693807.000001696D9ED000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168693807.000001696D9ED000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168693807.000001696D9ED000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: OpenWith.exe, 00000002.00000003.2169206679.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: OpenWith.exe, 00000002.00000003.2169206679.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: wmplayer.exe, 00000004.00000002.3277729550.000001E29B826000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://servicehost.org:4433/2a714e8b4eb18f2b2/Exploit
Source: OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168693807.000001696D9ED000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168693807.000001696D9ED000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073514166.0000028A00850000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_cac679b0-9

Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073514166.0000028A00850000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_5d09a1bb-d

Source: Yara match	File source: 0.3.SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe.28a00b30000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe.28a00b30000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.OpenWith.exe.1696d270000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.OpenWith.exe.1696cf90000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe.28a00850000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe.28a00850000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.OpenWith.exe.1696cf90000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000003.2075804118.000001696CF90000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2073704673.0000028A00B30000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2075999920.000001696D270000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2073514166.0000028A00850000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe PID: 5508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: OpenWith.exe PID: 6468, type: MEMORYSTR

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A000151B4 NtQueryInformationProcess,	0_3_0000028A000151B4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A000156A8 NtQuerySystemInformation,NtQuerySystemInformation,GetTokenInformation,FindCloseChangeNotification,FindCloseChangeNotification,	0_3_0000028A000156A8
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000001696C6E30C7 RtlAllocateHeap,RtlAllocateHeap,_calloc_dbg,NtAllocateVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,RtlDeleteBoundaryDescriptor,RtlDeleteBoundaryDescriptor,	2_3_000001696C6E30C7
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0D1CE8 _calloc_dbg,CreateProcessW,NtResumeThread,FindCloseChangeNotification,??3@YAXPEAX@Z,	4_3_00007DF41D0D1CE8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0D1958 _calloc_dbg,NtAllocateVirtualMemory,NtWriteVirtualMemory,NtQueryInformationProcess,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtReadVirtualMemory,NtProtectVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	4_3_00007DF41D0D1958
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B4428E8 NtAcceptConnectPort,	4_2_000001E29B4428E8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B4428B8 NtAcceptConnectPort,	4_2_000001E29B4428B8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B442990 NtAcceptConnectPort,	4_2_000001E29B442990
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B4427B8 NtAcceptConnectPort,	4_2_000001E29B4427B8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B44288C NtAcceptConnectPort,	4_2_000001E29B44288C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B44252C NtAcceptConnectPort,	4_2_000001E29B44252C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B442418 NtAcceptConnectPort,	4_2_000001E29B442418
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B442C64 NtAcceptConnectPort,	4_2_000001E29B442C64
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B4429D4 NtAcceptConnectPort,	4_2_000001E29B4429D4
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_00007DF41D0D199C NtQueryInformationProcess,NtReadVirtualMemory,NtProtectVirtualMemory,NtWriteVirtualMemory,	4_2_00007DF41D0D199C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_00007DF41D0D1E64 CreateProcessW,NtResumeThread,FindCloseChangeNotification,	4_2_00007DF41D0D1E64
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_00007DF41D0E2704 NtQuerySystemInformation,_malloc_dbg,NtQuerySystemInformation,	4_2_00007DF41D0E2704
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB03385C NtQuerySystemInformation,	5_2_0000021DDB03385C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_00007FF6CC9B18D7	0_3_00007FF6CC9B18D7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A00014A54	0_3_0000028A00014A54
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A00015BC0	0_3_0000028A00015BC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A00019FFC	0_3_0000028A00019FFC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A00018A58	0_3_0000028A00018A58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A00013CEC	0_3_0000028A00013CEC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A00011500	0_3_0000028A00011500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A00012F00	0_3_0000028A00012F00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A0001870C	0_3_0000028A0001870C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A0001710C	0_3_0000028A0001710C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A00023E95	0_3_0000028A00023E95
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000001696AC50967	2_3_000001696AC50967
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000001696C6E5E7C	2_3_000001696C6E5E7C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000001696C6E24F7	2_3_000001696C6E24F7
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000001696C6E58FC	2_3_000001696C6E58FC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000001696C6E1BA6	2_3_000001696C6E1BA6
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000001696C6E279C	2_3_000001696C6E279C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000001696C6E557C	2_3_000001696C6E557C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000001696C6E4A38	2_3_000001696C6E4A38
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000001696C6E2C3C	2_3_000001696C6E2C3C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_000001E29B541F40	4_3_000001E29B541F40
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_000001E29B54027B	4_3_000001E29B54027B
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_000001E29B542718	4_3_000001E29B542718
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_000001E29B54170E	4_3_000001E29B54170E
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_000001E29B543660	4_3_000001E29B543660
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0D2204	4_3_00007DF41D0D2204
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0D4EFC	4_3_00007DF41D0D4EFC
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0D392C	4_3_00007DF41D0D392C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0B60A5	4_3_00007DF41D0B60A5
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0A54C0	4_3_00007DF41D0A54C0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0B50D6	4_3_00007DF41D0B50D6
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0B58F8	4_3_00007DF41D0B58F8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0B6927	4_3_00007DF41D0B6927
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0ABD49	4_3_00007DF41D0ABD49
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0AF149	4_3_00007DF41D0AF149
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0B3D3B	4_3_00007DF41D0B3D3B
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0B7554	4_3_00007DF41D0B7554
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0A4F8A	4_3_00007DF41D0A4F8A
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0A83BA	4_3_00007DF41D0A83BA
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0ADFEB	4_3_00007DF41D0ADFEB
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0A8C19	4_3_00007DF41D0A8C19
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0B5456	4_3_00007DF41D0B5456
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0B5AB2	4_3_00007DF41D0B5AB2
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0B2F24	4_3_00007DF41D0B2F24
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0B6F4A	4_3_00007DF41D0B6F4A
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0B0F5A	4_3_00007DF41D0B0F5A
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0B6B5B	4_3_00007DF41D0B6B5B
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0AA5A5	4_3_00007DF41D0AA5A5
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0B21C7	4_3_00007DF41D0B21C7
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0AC5C4	4_3_00007DF41D0AC5C4
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0B71FE	4_3_00007DF41D0B71FE
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0B5227	4_3_00007DF41D0B5227
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_3_00007DF41D0B7A58	4_3_00007DF41D0B7A58
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B432628	4_2_000001E29B432628
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B442D24	4_2_000001E29B442D24
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B43C25C	4_2_000001E29B43C25C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B465918	4_2_000001E29B465918
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B4648D0	4_2_000001E29B4648D0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B450174	4_2_000001E29B450174
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B46E984	4_2_000001E29B46E984
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B46F940	4_2_000001E29B46F940
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B44D010	4_2_000001E29B44D010
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B46A81C	4_2_000001E29B46A81C
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B470874	4_2_000001E29B470874
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B457094	4_2_000001E29B457094
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B45D854	4_2_000001E29B45D854
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B453EA4	4_2_000001E29B453EA4
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B44BEB8	4_2_000001E29B44BEB8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B4586B4	4_2_000001E29B4586B4
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B465EC8	4_2_000001E29B465EC8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B463F70	4_2_000001E29B463F70
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B446F24	4_2_000001E29B446F24
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B44C750	4_2_000001E29B44C750
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B464DE8	4_2_000001E29B464DE8
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B44F618	4_2_000001E29B44F618
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B4655B0	4_2_000001E29B4655B0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B4695D4	4_2_000001E29B4695D4
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B457684	4_2_000001E29B457684
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B46ECE4	4_2_000001E29B46ECE4
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B44DCE4	4_2_000001E29B44DCE4
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B456D18	4_2_000001E29B456D18
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B4314D0	4_2_000001E29B4314D0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B470D90	4_2_000001E29B470D90
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B46CC00	4_2_000001E29B46CC00
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B460478	4_2_000001E29B460478
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B476434	4_2_000001E29B476434
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B445ADC	4_2_000001E29B445ADC
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B44E398	4_2_000001E29B44E398
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B46F1D0	4_2_000001E29B46F1D0
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B470270	4_2_000001E29B470270
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B447270	4_2_000001E29B447270
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B463A38	4_2_000001E29B463A38
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B464A50	4_2_000001E29B464A50
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_000001E29B473A4D	4_2_000001E29B473A4D
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Code function: 4_2_00007DF41D0D22CC	4_2_00007DF41D0D22CC
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB048980	5_2_0000021DDB048980
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB049998	5_2_0000021DDB049998
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB053210	5_2_0000021DDB053210
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB052254	5_2_0000021DDB052254
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB0370EA	5_2_0000021DDB0370EA
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB054144	5_2_0000021DDB054144
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB0427A4	5_2_0000021DDB0427A4
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB03BFE4	5_2_0000021DDB03BFE4
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB036FF8	5_2_0000021DDB036FF8
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB049818	5_2_0000021DDB049818
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB04A860	5_2_0000021DDB04A860
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB048EB8	5_2_0000021DDB048EB8
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB04F76C	5_2_0000021DDB04F76C
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB0525B4	5_2_0000021DDB0525B4
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB03C5D4	5_2_0000021DDB03C5D4
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB038DF4	5_2_0000021DDB038DF4
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB03D604	5_2_0000021DDB03D604
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB061E08	5_2_0000021DDB061E08
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB04AE10	5_2_0000021DDB04AE10
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB054660	5_2_0000021DDB054660
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB05C668	5_2_0000021DDB05C668
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB04A4F8	5_2_0000021DDB04A4F8
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB05C500	5_2_0000021DDB05C500
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB04E51C	5_2_0000021DDB04E51C
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB049D30	5_2_0000021DDB049D30
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB0453C8	5_2_0000021DDB0453C8
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB03BC68	5_2_0000021DDB03BC68
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB052AA0	5_2_0000021DDB052AA0
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB053B40	5_2_0000021DDB053B40
Source: C:\Windows\System32\dllhost.exe	Code function: 5_2_0000021DDB03737C	5_2_0000021DDB03737C

Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000000.2038878983.00007FF6CC9CD000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename4 vs SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073360622.0000028A009CB000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073091575.0000028A00BC6000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073514166.0000028A00850000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKernelbase.dllj% vs SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073301415.0000028A00850000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073301415.0000028A00850000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2072945441.0000028A009C8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073360622.0000028A00910000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073704673.0000028A00DC5000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKernelbase.dllj% vs SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Binary or memory string: OriginalFilename4 vs SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe

Source: classification engine

Classification label: mal100.troj.spyw.winEXE@7/0@1/1

Source: C:\Program Files\Windows Media Player\wmplayer.exe

Code function: 4_2_000001E29B432628 CreateToolhelp32Snapshot,Thread32First,Thread32Next,FindCloseChangeNotification,SuspendThread,

4_2_000001E29B432628

Source: C:\Windows\System32\OpenWith.exe

Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-4fb3f26-9d18-66b568-627b8a85e4b6}

Source: C:\Windows\System32\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: OpenWith.exe, 00000002.00000003.2146132400.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2151701654.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2173999560.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2162730362.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2172221902.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2144743517.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168919912.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2145943011.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2166530938.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2178284141.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2141380788.000001696D364000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: OpenWith.exe, 00000002.00000003.2146132400.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2151701654.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2173999560.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2162730362.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2172221902.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2144743517.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168919912.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2145943011.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2166530938.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2178284141.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2141380788.000001696D364000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: OpenWith.exe, 00000002.00000003.2146132400.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2151701654.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2173999560.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2162730362.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2172221902.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2144743517.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168919912.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2145943011.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2166530938.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2178284141.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2141380788.000001696D364000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: OpenWith.exe, 00000002.00000003.2146132400.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2151701654.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2173999560.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2162730362.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2172221902.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2144743517.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168919912.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2145943011.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2166530938.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2178284141.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2141380788.000001696D364000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: OpenWith.exe, 00000002.00000003.2146132400.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2151701654.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2173999560.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2162730362.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2172221902.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2144743517.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168919912.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2145943011.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2166530938.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2178284141.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2141380788.000001696D364000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: OpenWith.exe, 00000002.00000003.2146132400.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2151701654.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2173999560.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2162730362.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2172221902.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2144743517.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168919912.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2145943011.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2166530938.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2178284141.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2141380788.000001696D364000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: OpenWith.exe, 00000002.00000003.2173382185.000001696D9F3000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2169206679.000001696D9E8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168693807.000001696DA23000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168919912.000001696DA23000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2172949995.000001696DB63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: OpenWith.exe, 00000002.00000003.2146132400.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2151701654.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2173999560.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2162730362.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2172221902.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2144743517.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168919912.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2145943011.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2166530938.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2178284141.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2141380788.000001696D364000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe

ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe "C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\wmplayer.exe "C:\Program Files\Windows Media Player\wmplayer.exe"
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\wmplayer.exe "C:\Program Files\Windows Media Player\wmplayer.exe"	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wudfplatform.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\7.0\Outlook\Profiles\Outlook

Jump to behavior

Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: kernel32.pdbUGP source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073301415.0000028A00850000.00000004.00000001.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073360622.0000028A00910000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075692995.000001696D050000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075629839.000001696CF90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdbUGP source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073514166.0000028A00850000.00000004.00000001.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073704673.0000028A00B30000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075804118.000001696CF90000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075999920.000001696D270000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073091575.0000028A00A40000.00000004.00000001.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2072945441.0000028A00850000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075446574.000001696D180000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075164420.000001696CF90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: OpenWith.exe, 00000002.00000003.2166148051.000001696D2DD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073091575.0000028A00A40000.00000004.00000001.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2072945441.0000028A00850000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075446574.000001696D180000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075164420.000001696CF90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: kernel32.pdb source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073301415.0000028A00850000.00000004.00000001.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073360622.0000028A00910000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075692995.000001696D050000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075629839.000001696CF90000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: lfons\AppData\Local\Temp\Symbols\winload_prod.pdb source: OpenWith.exe, 00000002.00000003.2166148051.000001696D2D5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: win32u.pdb source: wmplayer.exe, 00000004.00000003.2291244045.000001E29B530000.00000004.00000001.00020000.00000000.sdmp, wmplayer.exe, 00000004.00000003.2291272850.000001E29B750000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: win32u.pdbGCTL source: wmplayer.exe, 00000004.00000003.2291244045.000001E29B530000.00000004.00000001.00020000.00000000.sdmp, wmplayer.exe, 00000004.00000003.2291272850.000001E29B750000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: kernelbase.pdb source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073514166.0000028A00850000.00000004.00000001.00020000.00000000.sdmp, SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, 00000000.00000003.2073704673.0000028A00B30000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075804118.000001696CF90000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2075999920.000001696D270000.00000004.00000001.00020000.00000000.sdmp

Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Static PE information: section name: .textbss
Source: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_00007FF6CC9B59E3 push esi; retf	0_3_00007FF6CC9B59E6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_00007FF6CC9B35EC push esi; ret	0_3_00007FF6CC9B35ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_00007FF6CC9B17D5 push cs; ret	0_3_00007FF6CC9B18C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_00007FF6CC9B4427 pushad ; ret	0_3_00007FF6CC9B4428
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_00007FF6CC9B6C12 push edx; retf	0_3_00007FF6CC9B6C26
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_00007FF6CC9B220B push eax; iretd	0_3_00007FF6CC9B2224
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_00007FF6CC9B62E3 push ebx; ret	0_3_00007FF6CC9B62E6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_00007FF6CC9B5ED9 push esi; ret	0_3_00007FF6CC9B5EDD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_00007FF6CC9B48BE push eax; retf	0_3_00007FF6CC9B48BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_00007FF6CC9B40F7 push eax; ret	0_3_00007FF6CC9B40FB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_00007FF6CC9B430B push eax; retf	0_3_00007FF6CC9B430C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_00007FF6CC9B1865 push cs; ret	0_3_00007FF6CC9B18C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_00007FF6CC9B5643 push eax; retf	0_3_00007FF6CC9B5645
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_00007FF6CC9B4EB2 pushad ; retf	0_3_00007FF6CC9B4EB3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A0001C219 pushad ; retf	0_3_0000028A0001C221
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A00028560 push ds; retf	0_3_0000028A00028577
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A00025C06 push esi; ret	0_3_0000028A00025C07
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A0002B627 push ebp; iretd	0_3_0000028A0002B628
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A00023E70 push ebp; retf	0_3_0000028A00023E94
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A00023E95 push ebp; retf	0_3_0000028A00023E94
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A000274C6 push esi; ret	0_3_0000028A000274CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A0002BACB pushad ; iretd	0_3_0000028A00352EB3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A000256D9 push ecx; ret	0_3_0000028A00025700
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_3_0000028A00024B35 push ss; iretd	0_3_0000028A0031919F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_2_00007FF6CC9593E6 push 3C95CC23h; iretd	0_2_00007FF6CC9593EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_2_00007FF6CC95A778 pushfq ; iretd	0_2_00007FF6CC95A779
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_2_00007FF6CC954918 push rsi; retf	0_2_00007FF6CC954923
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Code function: 0_2_00007FF6CC9596B5 push FFFFFF81h; retf	0_2_00007FF6CC9596B7
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000001696AC53F42 pushad ; retf	2_3_000001696AC53F43
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000001696AC546D3 push eax; retf	2_3_000001696AC546D5
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000001696AC508F5 push cs; ret	2_3_000001696AC50954

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\dllhost.exe

Code function: GetAdaptersInfo,

5_2_0000021DDB032AC4

Source: C:\Windows\System32\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\System32\OpenWith.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe

Code function: 0_3_0000028A00014FD4 GetSystemInfo,

0_3_0000028A00014FD4

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: OpenWith.exe, 00000002.00000003.2143323189.000001696CF4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkmbolicLinkSymbolicLink
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696428655f
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: OpenWith.exe, 00000002.00000003.2143323189.000001696CF4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkLinkcLinkSymbolicLink
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696428655
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: wmplayer.exe, 00000004.00000002.3277503574.000001E29B587000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000005.00000002.3277318260.0000021DDB11A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: dllhost.exe, 00000005.00000002.3277318260.0000021DDB11A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696428655
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: OpenWith.exe, 00000002.00000003.2075999920.000001696D270000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: OpenWith.exe, 00000002.00000003.2075999920.000001696D270000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: OpenWith.exe, 00000002.00000003.2171302580.000001696DA1B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Program Files\Windows Media Player\wmplayer.exe

Memory allocated: C:\Windows\System32\dllhost.exe base: 21DDB030000 protect: page read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Program Files\Windows Media Player\wmplayer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 21DDB030000			Jump to behavior
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 7FF6698214E0			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Program Files\Windows Media Player\wmplayer.exe "C:\Program Files\Windows Media Player\wmplayer.exe"	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Process created: C:\Windows\System32\dllhost.exe "C:\Windows\system32\dllhost.exe"	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files\Windows Media Player\wmplayer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Program Files\Windows Media Player\wmplayer.exe

Code function: 4_2_000001E29B43CDF4 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,

4_2_000001E29B43CDF4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe

Code function: 0_2_00007FF6CC9A615C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF6CC9A615C

Source: C:\Windows\System32\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000000.00000003.2072119815.0000028A00000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2162730362.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2146132400.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2152607598.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2172221902.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2144743517.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2173999560.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2160604237.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2151701654.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2168919912.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2145943011.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2143914701.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2156804131.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2166530938.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2149150890.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2162510756.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2153389081.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2178284141.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2144420099.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2158433515.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2155578371.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2160318605.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2158989228.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2168693807.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2161695796.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2147712177.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2170089401.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2155772326.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2149741241.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2158123556.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2163534539.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2177149426.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2156620245.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2173760062.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2168258050.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2170716518.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2151370818.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2161419525.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2149327727.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2159254038.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2160077344.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2161993900.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2157000461.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2145568055.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2148023665.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2156429560.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2147540781.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2157257186.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2155023843.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2167528754.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2147111279.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2160876076.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2153076808.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2154545113.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2153930987.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2157484419.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2154778492.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2161146099.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2150322070.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2169206679.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2159533104.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2177711934.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2159774834.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2147354231.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2155990457.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2179330379.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2074402005.000001696ACE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2146350943.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2163727757.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2169561570.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2168435601.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2156237400.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2158714760.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2146569417.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2146928114.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2153718645.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2173044127.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2145186850.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2167868673.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2157801248.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2154177761.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2143147524.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2173382185.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2155295704.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2148943136.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2143652418.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2143467189.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: OpenWith.exe, 00000002.00000003.2169367956.000001696CF6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Data%\Qtum-Electrum\config
Source: OpenWith.exe, 00000002.00000003.2172654033.000001696CF27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\ElectronCash\config
Source: OpenWith.exe, 00000002.00000003.2172654033.000001696CF3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\com.liberty.jaxx
Source: OpenWith.exe, 00000002.00000003.2172791367.000001696CF38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: OpenWith.exe, 00000002.00000003.2172791367.000001696CF38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\Exodus
Source: OpenWith.exe, 00000002.00000003.2172654033.000001696CF27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\Coinomi\Coinomi\wallets

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Bitcoin\Bitcoin-Qt			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\031db23f-f53a-4d6b-b429-cd0302ef56d3	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\3e445a25-c088-46bb-968a-82532b92e486	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\6490c938-fe3f-48ae-bc5e-e1986298f7c1	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\safebrowsing	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\a5f61848-f128-4a80-965b-a3000feed295	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\startupCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\settings\main	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\trash4675	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\settings\main\ms-language-packs\browser\newtab	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\safebrowsing\google4	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\58ef9818-5ea1-49a0-b5b0-9338401a7943	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\thumbnails	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\yiaxs5ej.default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\15702f96-fbc1-4934-99bf-a9a7406c1be7	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons Monochrome	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\settings\main\ms-language-packs\browser	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\settings\main\ms-language-packs	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons Maskable	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Directory queried: C:\Users\user\Documents\ZGGKNSUKOP	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000002.00000003.2178047810.000001696CF53000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2171203616.000001696CF4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2172654033.000001696CF4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2172791367.000001696CF4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: OpenWith.exe PID: 6468, type: MEMORYSTR

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000000.00000003.2072119815.0000028A00000000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2162730362.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2146132400.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2152607598.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2172221902.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2144743517.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2173999560.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2160604237.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2151701654.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2168919912.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2145943011.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2143914701.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2156804131.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2166530938.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2149150890.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2162510756.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2153389081.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2178284141.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2144420099.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2158433515.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2155578371.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2160318605.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2158989228.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2168693807.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2161695796.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2147712177.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2170089401.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2155772326.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2149741241.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2158123556.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2163534539.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2177149426.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2156620245.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2173760062.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2168258050.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2170716518.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2151370818.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2161419525.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2149327727.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2159254038.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2160077344.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2161993900.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2157000461.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2145568055.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2148023665.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2156429560.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2147540781.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2157257186.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2155023843.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2167528754.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2147111279.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2160876076.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2153076808.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2154545113.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2153930987.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2157484419.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2154778492.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2161146099.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2150322070.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2169206679.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2159533104.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2177711934.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2159774834.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2147354231.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2155990457.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2179330379.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2074402005.000001696ACE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2146350943.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2163727757.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2169561570.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2168435601.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2156237400.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2158714760.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2146569417.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2146928114.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2153718645.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2173044127.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2145186850.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2167868673.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2157801248.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2154177761.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2143147524.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2173382185.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2155295704.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2148943136.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2143652418.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2143467189.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Program Files\Windows Media Player\wmplayer.exe

Code function: 4_2_000001E29B43CDF4 CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,

4_2_000001E29B43CDF4

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	212 Process Injection	1 Virtualization/Sandbox Evasion	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	212 Process Injection	21 Input Capture	11 Security Software Discovery	Remote Desktop Protocol	21 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	2 Process Discovery	Distributed Component Object Model	21 Data from Local System	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	21 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	16 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe	32%	ReversingLabs	Win64.Spyware.Rhadamanthys

Source	Detection	Scanner	Label
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
servicehost.org	91.92.250.172	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168693807.000001696D9ED000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/chrome_newtab	OpenWith.exe, 00000002.00000003.2169206679.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168693807.000001696D9ED000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	OpenWith.exe, 00000002.00000003.2169206679.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168693807.000001696D9ED000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168693807.000001696D9ED000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168693807.000001696D9ED000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	OpenWith.exe, 00000002.00000003.2168569073.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2168693807.000001696D9ED000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2167995542.000001696D9EC000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
91.92.250.172	servicehost.org	Bulgaria		34368	THEZONEBG	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467092
Start date and time:	2024-07-03 18:06:37 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe
Detection:	MAL
Classification:	mal100.troj.spyw.winEXE@7/0@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 78% Number of executed functions: 87 Number of non-executed functions: 13
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target OpenWith.exe, PID 6468 because there are no executed function
Execution Graph export aborted for target SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe, PID 5508 because there are no executed function
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe

Simulations

Behavior and APIs

Time	Type	Description
12:07:56	API Interceptor	1x Sleep call for process: wmplayer.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
THEZONEBG	Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx	Get hash	malicious	AgentTesla	Browse	91.92.254.194
	Ship particulars.xls	Get hash	malicious	Unknown	Browse	91.92.254.29
	KVAoyRsrZC.exe	Get hash	malicious	Unknown	Browse	91.92.248.9
	MzXmoBVXtU.exe	Get hash	malicious	XenoRAT	Browse	91.92.248.167
	AVKlyo045S.exe	Get hash	malicious	XenoRAT	Browse	91.92.248.167
	Inquiry HA-22-28199 22-Q22024.doc	Get hash	malicious	FormBook	Browse	91.92.254.29
	Inquiry HA-22-28199 22-Q22024.doc	Get hash	malicious	FormBook	Browse	91.92.254.29
	RW-TS-Payment204_A3084_04893_D4084_Y5902_CE3018_S4081_W30981.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	91.92.255.36
	4YlwTsmpuZ.rtf	Get hash	malicious	Unknown	Browse	91.92.254.29
	02_07_2024_D#U00f6nemi_MEVDUAT Ekstre Bilgiler.exe	Get hash	malicious	AsyncRAT	Browse	91.92.240.178

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	5.530555360729326
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe
File size:	448'512 bytes
MD5:	7691d7d1f5928448074900950ff80ec7
SHA1:	65025ed3950eca0eb5c253bfcad472f969dc2177
SHA256:	bab017ca2aa472dc3b0370dba0bd356939a62947f4ff83ef4810a70a68fab1df
SHA512:	b6012e6c7cbbb60e234a80edf4cd11e784533d97753ad24b4be1b55b715722b5de2076f5d2fa794a5ca216306a2ed54eb402843c280a566cba7036c4719f177f
SSDEEP:	12288:6uZZani4FaYkizhRpfX54K+uiE85ZzhzJ:6+ZIi4Z95/54K+uiE8Dd
TLSH:	A294E058EAA5C3F5E16A0235C5951AE49233BC16C9218ECF06747A0B3F372D09E3BB71
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........MV.y#..y#..y#...'..y#... ..y#...&..y#...&..y#...'..y#... ..y#..."..y#..y".ey#.o.'..y#..y#..y#.o....y#.o.!..y#.Rich.y#........

File Icon


Icon Hash:	100109193979390f

Static PE Info

General

Entrypoint:	0x140055ef8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x645F7B5E [Sat May 13 11:58:22 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d7fa2572888c8bf82e5ce063fb4df4c4

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F6654FE4970h
dec eax
add esp, 28h
jmp 00007F6654FE458Fh
int3
int3
dec eax
sub esp, 28h
call 00007F6654FE4EF0h
test eax, eax
je 00007F6654FE4733h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ecx, dword ptr [eax+08h]
jmp 00007F6654FE4717h
dec eax
cmp ecx, eax
je 00007F6654FE4726h
xor eax, eax
dec eax
cmpxchg dword ptr [00025AE0h], ecx
jne 00007F6654FE4700h
xor al, al
dec eax
add esp, 28h
ret
mov al, 01h
jmp 00007F6654FE4709h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
movzx eax, byte ptr [00025ACBh]
test ecx, ecx
mov ebx, 00000001h
cmove eax, ebx
mov byte ptr [00025ABBh], al
call 00007F6654FE4CF7h
call 00007F6654FE5A4Eh
test al, al
jne 00007F6654FE4716h
xor al, al
jmp 00007F6654FE4726h
call 00007F6654FE7409h
test al, al
jne 00007F6654FE471Bh
xor ecx, ecx
call 00007F6654FE5A5Eh
jmp 00007F6654FE46FCh
mov al, bl
dec eax
add esp, 20h
pop ebx
ret
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
cmp byte ptr [00025A80h], 00000000h
mov ebx, ecx
jne 00007F6654FE4779h
cmp ecx, 01h
jnbe 00007F6654FE477Ch
call 00007F6654FE4E56h
test eax, eax
je 00007F6654FE473Ah
test ebx, ebx
jne 00007F6654FE4736h
dec eax
lea ecx, dword ptr [00025A6Ah]
call 00007F6654FE4726h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x79920	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7f000	0x1498	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x7d000	0xd44	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81000	0x638	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x78980	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x789a0	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x71000	0x5b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5ff50	0x60000	d2b5c2f4dd910846d8a862e02f7d720f	False	0.6495997111002604	data	5.4442354722854684	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.textbss	0x61000	0x10000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x71000	0x9a2c	0x9c00	5da18d921617bef5add30f80468286b1	False	0.42029747596153844	data	4.7892138231877635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x7b000	0x1bd8	0xa00	58d14148945a7e9043b6b305adfbed0f	False	0.1421875	DOS executable (block device driver)	1.984838250905176	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x7d000	0xd44	0xe00	3194ed7ae08ca6ee9e7bde5f4b5fa56f	False	0.466796875	data	5.1267516750195705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x7e000	0xf4	0x200	76c1a783e36f2ec0ef2ada66cc3ff494	False	0.318359375	data	2.461709986213087	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x7f000	0x1498	0x1600	9d9c4458cdc4369b104a60c9ea8cb180	False	0.2762784090909091	data	3.885567757203068	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x81000	0x638	0x800	3715f1b3a5a63032a2f2228242acdc23	False	0.4697265625	data	4.814197462204181	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x7f0f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 2834 x 2834 px/m	English	United States	0.2619606003752345
RT_GROUP_ICON	0x80198	0x14	data	English	United States	1.1
RT_VERSION	0x801b0	0x2e4	data	English	United States	0.4554054054054054

Imports

DLL	Import
KERNEL32.dll	LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, FreeEnvironmentStringsW, GetEnvironmentStringsW, WideCharToMultiByte, MultiByteToWideChar, GetCommandLineW, GetCommandLineA, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindFirstFileExW, FindClose, GetModuleHandleExW, TerminateProcess, ExitProcess, GetCurrentProcess, WriteFile, GetStdHandle, RaiseException, LoadLibraryExW, GetProcAddress, FreeLibrary, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, HeapSize, HeapReAlloc, FlushFileBuffers, GetConsoleCP, GetConsoleMode, SetFilePointerEx, CreateFileW, WriteConsoleW, lstrlenW, GetModuleHandleA, GetModuleFileNameW, CreateEventA, WaitForSingleObject, GetProcessHeap, HeapFree, HeapAlloc, HeapDestroy, HeapCreate, FindNextFileW, CloseHandle, LeaveCriticalSection, EnterCriticalSection, SetLastError, GetLastError, RtlUnwindEx, GetModuleHandleW, IsProcessorFeaturePresent, GetStartupInfoW, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, InitializeSListHead, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter
USER32.dll	GetClassInfoW, DeleteMenu, DefMDIChildProcW, CharUpperBuffW, SetMenuItemInfoW, GetDlgCtrlID, DispatchMessageW, GetDCEx, GetClassInfoExW, ShowWindow, DestroyWindow, IsDialogMessageW, LoadCursorW, CreateAcceleratorTableW, PeekMessageW, CreateWindowExW, RegisterClassW, IsIconic, GetSystemMenu, EnableWindow, FrameRect, LoadStringW, IsZoomed, LoadBitmapW, GetMenuItemInfoW, MsgWaitForMultipleObjectsEx, GetCursor, ShowCaret, PostMessageW, CreateIcon, GetClientRect, GetWindowTextW, CreateMenu, DrawMenuBar, CopyImage, FillRect, DefFrameProcW, EndPaint, GetScrollPos, SetScrollPos, GetMenuStringW, DestroyIcon, DrawFocusRect, BeginPaint, ReleaseDC, KillTimer, EndMenu, InsertMenuW, DestroyCursor, SetTimer, GetScrollInfo, DestroyMenu, GetScrollRange, LoadIconW, DrawIcon
GDI32.dll	GetEnhMetaFileHeader, CreateCompatibleBitmap, Polygon, SetAbortProc, RectVisible, SetBkMode, CreateICW, CreateSolidBrush, PolyBezierTo, RoundRect, SetTextColor, CreateDCW, GetWindowOrgEx, RestoreDC, StretchBlt, CreatePalette, MoveToEx, SetRectRgn, AngleArc, GetTextMetricsW, Pie, GetStockObject
ole32.dll	CoTaskMemFree, IsEqualGUID, CoUninitialize, CoInitialize, OleInitialize, CoTaskMemAlloc, OleUninitialize, CoCreateInstance
OLEAUT32.dll	SysFreeString, SafeArrayGetElement, SafeArrayCreate, SafeArrayPtrOfIndex, GetErrorInfo, SafeArrayGetUBound, SysAllocStringLen, VariantCopyInd, SysReAllocStringLen, SafeArrayPutElement, VariantInit, SafeArrayGetLBound, VariantClear, VariantChangeType, SafeArrayAccessData, SafeArrayUnaccessData, VariantCopy
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/03/24-18:07:51.707707	TCP	2854802	ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert	4433	49714	91.92.250.172	192.168.2.5
07/03/24-18:07:34.174738	TCP	2854802	ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert	4433	49705	91.92.250.172	192.168.2.5
07/03/24-18:07:42.652664	TCP	2854802	ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert	4433	49706	91.92.250.172	192.168.2.5
07/03/24-18:07:57.987769	TCP	2854802	ETPRO TROJAN Suspected Rhadamanthys Related SSL Cert	6015	49715	91.92.250.172	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 18:07:33.571692944 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:33.576980114 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:33.577167988 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:33.577200890 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:33.581945896 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.174737930 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.175195932 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.180149078 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.352490902 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.355454922 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.360340118 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.590322018 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.590379000 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.590429068 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.590450048 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.590462923 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.590501070 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.590507984 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.590537071 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.590569973 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.590579033 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.590604067 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.590637922 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.590639114 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.590672016 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.590717077 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.590725899 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.595884085 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.595949888 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.595993042 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.596026897 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.596071005 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.676534891 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.676573038 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.676620007 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.676628113 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.676661968 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.676696062 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.676708937 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.676729918 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.676765919 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.676774025 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.677439928 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.677499056 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.677649021 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.677689075 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.677722931 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.677738905 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.683156013 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.683212042 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.683223963 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.683244944 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.683286905 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.688978910 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.689081907 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.689116955 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.689141035 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.694540024 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.694608927 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.694618940 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.694662094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.694705963 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.699908018 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.699963093 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.699994087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.700012922 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.704742908 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.704790115 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.704801083 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.704812050 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.704842091 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.709978104 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.710032940 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.710043907 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.710095882 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.715584040 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.715630054 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.715641022 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.715684891 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.715696096 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.715739012 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.762758017 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.762881994 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.763183117 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.763211966 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.763237953 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.763248920 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.763259888 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.763263941 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.763318062 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.763328075 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.763366938 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.763397932 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.763411999 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.763446093 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.763813972 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.763870001 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.763881922 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.763914108 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.763951063 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.764000893 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.764456987 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.764513016 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.764523029 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.764588118 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.767854929 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.767889023 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.767899990 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.767937899 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.767971039 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.772223949 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.772234917 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.772264004 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.772281885 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.772320032 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.772386074 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.777198076 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.777337074 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.777400017 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.777434111 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.777851105 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.777934074 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.872215033 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.872261047 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.872273922 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.872313023 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.872342110 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.872353077 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.872363091 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.872386932 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.872414112 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.872452021 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.872463942 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.872474909 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.872498989 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.872708082 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.872750044 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.872762918 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.872775078 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.872816086 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.872879982 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.872893095 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.872934103 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.873198986 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.873254061 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.873265028 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.873327971 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.873691082 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.873702049 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.873712063 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.873723030 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.873758078 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.902113914 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.902184010 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.902193069 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.902206898 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.902247906 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.902299881 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.902312040 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.902323008 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.902333975 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.902359009 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.902395010 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.902477980 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.902694941 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.902741909 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.902746916 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.902760983 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.902796030 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.902901888 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.902914047 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.902924061 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.902934074 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.902949095 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.902975082 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.903032064 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.903577089 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.903625965 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.903626919 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.903640032 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.903672934 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.922267914 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.922290087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.922359943 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.922683954 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.922729969 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.922768116 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.922785997 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.922866106 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.922878981 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.922904015 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.923077106 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.923089981 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.923103094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.923119068 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.923141956 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.924084902 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.924134016 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.924145937 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.924171925 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.924304962 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.924318075 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.924329042 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.924340010 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.924350977 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.924360037 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.924391985 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.924575090 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.924587965 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.924597979 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.924612999 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.924623966 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.924628019 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.924652100 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.924792051 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.924803972 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.924834967 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.966028929 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966053009 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966063976 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966089010 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.966106892 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.966221094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966233015 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966242075 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966254950 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966267109 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.966301918 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.966357946 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966377974 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966415882 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.966523886 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966536045 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966546059 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966556072 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966572046 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.966593981 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.966809034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966820002 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966830969 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966840982 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966852903 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.966870070 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.966897011 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.967189074 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.967200994 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.967211008 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.967221022 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.967231035 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.967240095 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.967242002 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.967255116 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.967298031 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.967323065 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.967370033 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.967384100 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.967396021 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.967432022 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.968002081 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.968050957 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.968066931 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.968092918 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.968199015 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.968211889 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.968221903 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.968233109 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.968241930 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.968255043 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.968405962 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.968419075 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.968446970 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.968936920 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.968955994 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.968982935 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.988425970 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.988468885 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.988478899 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.988501072 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.988522053 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.988596916 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.988609076 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.988620996 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.988643885 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.988713980 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.988755941 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.988792896 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.988805056 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.988836050 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.988957882 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.988970041 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.988980055 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.988991976 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.989002943 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.989038944 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.989121914 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.989134073 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.989171028 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.989542007 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.989598989 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.989609957 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.989636898 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.989742041 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.989753962 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.989764929 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.989775896 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.989784956 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.989814997 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.989985943 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.989999056 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.990034103 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.990416050 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.990427971 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.990463018 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.990494013 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.990509033 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.990521908 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.990531921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.990536928 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.990545034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.990565062 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.990595102 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.990771055 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.990783930 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.990819931 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:34.991297007 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.991338968 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:34.991377115 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.009018898 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.009059906 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.009069920 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.009104013 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.009170055 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.009181976 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.009192944 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.009208918 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.009222031 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.009356022 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.009367943 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.009378910 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.009390116 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.009399891 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.009413004 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.009440899 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.009922981 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.009962082 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.009988070 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.010004044 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.010040045 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.010133982 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.010145903 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.010155916 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.010166883 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.010180950 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.010194063 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.010337114 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.010349989 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.010397911 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.010768890 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.010832071 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.010843992 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.010869980 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.010965109 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.010976076 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.010987997 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.010998011 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.011002064 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.011020899 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.011163950 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.011176109 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.011203051 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.011665106 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.011706114 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.011722088 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.011734009 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.011770964 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.011869907 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.011882067 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.011893034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.011903048 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.011919022 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.011944056 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.012003899 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049000978 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049022913 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049032927 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049047947 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.049071074 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.049170971 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049184084 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049196005 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049232006 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049236059 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.049245119 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049274921 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.049405098 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049448013 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.049462080 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049474001 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049513102 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.049580097 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049592018 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049602985 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049612999 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049626112 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.049640894 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.049921989 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049942017 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049952984 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.049982071 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.050049067 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.050060987 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.050095081 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.050283909 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.050297022 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.050331116 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.050390959 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.050404072 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.050415039 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.050425053 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.050435066 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.050435066 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.050451994 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.050477982 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.050575018 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.050586939 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.050628901 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.050947905 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.050959110 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.050995111 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.051001072 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.051007032 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.051018953 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.051033974 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.051043987 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.051045895 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.051071882 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.094099045 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.094631910 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.094643116 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.094717026 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.094892025 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.095149040 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.095159054 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.095168114 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.095187902 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.095206976 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.095552921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.095602989 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.095640898 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.095760107 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.095820904 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.095854998 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.095865011 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.095931053 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.095941067 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.095968962 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.096153975 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.096168995 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.096179962 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.096199989 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.096209049 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.096215963 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.096225023 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.096236944 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.096246958 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.096263885 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.096277952 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.096421957 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.096441031 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.096487999 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.096527100 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.096538067 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.096573114 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.096647978 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.096657991 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.096684933 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.096844912 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.096890926 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.096901894 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.096930981 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.097035885 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.097048044 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.097074032 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.097273111 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.097306013 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.097311020 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.097317934 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.097351074 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.097485065 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.097496986 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.097507954 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.097520113 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.097532034 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.097554922 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.097714901 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.097726107 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.097737074 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.097748041 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.097758055 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.097771883 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.097800970 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.098104954 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.098146915 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.098181009 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.098191977 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.098231077 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.098326921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.098337889 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.098349094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.098359108 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.098368883 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.098402023 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.098567963 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.098578930 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.098587990 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.098598003 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.098608017 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.098620892 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.098654985 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.099102974 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.099113941 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.099126101 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.099142075 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.099167109 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.099250078 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.099260092 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.099277020 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.099287987 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.099292994 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.099334002 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.099500895 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.099513054 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.099523067 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.099533081 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.099549055 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.099553108 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.099576950 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.099970102 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.099982023 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.100011110 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.100061893 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.100073099 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.100089073 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.100097895 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.100123882 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.100194931 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.100205898 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.100215912 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.100227118 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.100236893 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.100244045 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.100256920 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.100263119 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.100266933 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.100301981 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.100852013 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.100893021 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.100910902 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.100922108 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.100960970 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.101016998 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.101027966 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.101037979 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.101048946 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.101068974 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.101099968 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.135555029 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.135566950 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.135579109 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.135632038 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.135687113 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.135731936 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.135739088 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.135751009 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.135761976 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.135793924 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.136050940 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.136061907 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.136071920 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.136082888 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.136095047 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.136125088 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.136199951 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.136209965 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.136220932 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.136230946 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.136240005 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.136240959 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.136254072 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.136271000 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.136296988 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.136476040 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.136491060 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.136512995 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.136780977 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.136791945 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.136801004 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.136821985 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.136826992 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.136842966 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.144684076 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.144727945 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.144743919 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.144754887 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.144794941 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.144886017 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.144973993 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.144989967 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.145000935 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.145010948 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.145015955 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.145031929 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.181694984 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.181752920 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.181762934 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.181762934 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.181801081 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.181881905 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.181893110 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.181904078 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.181914091 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.181931973 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.181952000 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.182984114 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183033943 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183044910 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183079004 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.183160067 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183171034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183182001 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183206081 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.183234930 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.183306932 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183319092 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183329105 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183370113 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183373928 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.183382034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183393002 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183403969 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183408976 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.183432102 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.183769941 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183780909 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183789968 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183800936 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183811903 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183819056 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.183821917 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183835030 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183850050 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.183851004 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.183871984 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.184149027 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184159040 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184170008 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184180021 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184190989 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184190989 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.184207916 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.184235096 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.184396029 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184406996 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184425116 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184434891 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184444904 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184453011 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.184464931 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.184679031 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184689999 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184705973 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184716940 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184720039 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.184727907 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184736013 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.184743881 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184755087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.184775114 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.184792995 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.185137033 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185149908 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185158968 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185168982 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185178995 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185189009 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185199022 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185209036 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185210943 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.185240984 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.185251951 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.185525894 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185537100 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185545921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185558081 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185575962 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.185610056 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.185739040 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185776949 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185787916 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185797930 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185808897 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.185813904 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.185827971 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.186130047 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.186141014 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.186146021 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.186155081 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.186165094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.186175108 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.186186075 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.186187983 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.186222076 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.186605930 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.186655998 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.186666012 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.186693907 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.186793089 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.186804056 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.186814070 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.186824083 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.186830044 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.186850071 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.186950922 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.186963081 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.186995983 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.186995983 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.187036037 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.187105894 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.187117100 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.187159061 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.187655926 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.221771955 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.221808910 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.221820116 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.221841097 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.221858978 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.221946955 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.221959114 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.221967936 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.221980095 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.221992016 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.222027063 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.222093105 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.222105026 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.222115040 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.222125053 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.222142935 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.222157001 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.222313881 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.222323895 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.222335100 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.222373962 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.222537041 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.222583055 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.222599983 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.222610950 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.222651005 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.222711086 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.222722054 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.222735882 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.222747087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.222752094 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.222793102 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.230982065 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.231046915 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.231056929 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.231101990 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.231136084 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.231146097 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.231158018 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.231184006 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.231209993 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.231209993 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.231293917 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.231338978 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.267894983 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.267965078 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.267975092 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.268004894 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.268017054 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.268049955 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.268122911 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.268132925 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.268165112 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.268198967 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.268209934 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.268253088 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.268589020 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.268599987 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.268635988 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.268707991 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.268718004 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.268727064 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.268738031 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.268748045 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.268753052 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.268767118 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.268920898 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.268939018 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.268965960 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.269057035 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.269066095 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.269074917 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.269097090 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.269121885 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.269287109 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.269298077 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.269305944 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.269315958 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.269324064 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.269332886 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.269335032 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.269342899 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.269351959 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.269375086 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.269596100 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.269638062 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.269797087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.269819021 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.269855022 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.269911051 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.269922018 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.269929886 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.269954920 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.270032883 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.270071030 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.270234108 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.270287037 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.270296097 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.270304918 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.270324945 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.270339012 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.270529985 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.270539045 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.270548105 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.270555973 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.270565033 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.270572901 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.270585060 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.270585060 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.270607948 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.270834923 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.270878077 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.271075010 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.271142006 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.271151066 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.271179914 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.271282911 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.271292925 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.271301985 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.271312952 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.271328926 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.271353960 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.271528006 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.271538019 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.271548033 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.271558046 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.271564960 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.271579981 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.273164988 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273175955 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273185968 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273212910 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.273231983 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.273283958 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273294926 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273303986 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273313999 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273333073 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.273348093 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.273494959 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273505926 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273519039 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273529053 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273549080 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.273561001 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.273633957 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273646116 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273654938 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273682117 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.273770094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273813963 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.273849010 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273859978 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273891926 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.273930073 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273941040 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.273983002 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.274159908 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.274172068 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.274182081 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.274202108 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.274292946 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.274303913 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.274308920 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.274313927 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.274368048 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.274431944 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.274482012 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.307979107 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308052063 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308062077 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308073997 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308098078 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.308114052 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.308155060 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308166027 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308192968 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.308376074 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308387041 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308423996 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.308502913 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308514118 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308569908 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.308644056 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308698893 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308708906 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308717966 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308727980 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308742046 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.308760881 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.308929920 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308939934 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.308970928 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.309048891 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.309060097 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.309068918 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.309078932 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.309088945 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.309094906 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.309098959 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.309118986 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.309139013 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.317224979 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.317318916 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.317327023 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.317383051 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.317385912 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.317392111 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.317403078 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.317411900 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.317451954 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.317574978 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.354386091 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.354433060 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.354444027 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.354461908 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.354485035 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.354558945 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.354583979 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.354588985 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.354593992 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.354630947 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.354648113 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.354940891 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355016947 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355026960 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355057001 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.355144978 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355155945 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355165958 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355175018 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355185032 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355191946 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.355216980 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.355274916 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355365992 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355376005 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355386019 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355396032 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355401039 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355411053 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.355411053 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355428934 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.355611086 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355628014 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355637074 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355665922 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.355678082 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.355844021 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355855942 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355865002 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355874062 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355889082 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.355915070 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.355926037 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355937958 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355946064 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355957031 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355964899 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.355967045 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355978012 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355988026 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.355995893 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.356025934 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.356199026 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356209040 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356219053 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356229067 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356239080 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356237888 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.356262922 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.356287003 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.356465101 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356475115 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356489897 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356498957 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356508017 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356509924 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.356518984 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356529951 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356532097 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.356540918 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356550932 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356549025 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.356599092 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.356781006 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356791973 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356801033 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356811047 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356821060 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356822968 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.356834888 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.356864929 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.356915951 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356928110 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356937885 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356950998 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356961012 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356971025 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356973886 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.356981993 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.356993914 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357003927 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357003927 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.357013941 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.357016087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357028008 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357043028 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.357063055 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.357481003 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357491970 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357501030 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357511044 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357522011 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357527971 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.357533932 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357537985 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.357544899 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357564926 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.357604027 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.357800961 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357811928 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357824087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357834101 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357842922 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357852936 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357858896 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.357863903 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357868910 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.357876062 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357889891 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.357891083 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357902050 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357913971 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357923031 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357928991 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.357933044 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357944965 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.357947111 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.357956886 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.357986927 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.394356012 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.394417048 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.394427061 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.394464016 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.394499063 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.394510984 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.394520998 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.394531965 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.394546032 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.394577980 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.394665956 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.394706964 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.394782066 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.394793034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.394802094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.394812107 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.394823074 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.394831896 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.394845963 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.395044088 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.395055056 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.395098925 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.395111084 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.395123005 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.395155907 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.395251036 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.395262003 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.395271063 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.395281076 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.395286083 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.395296097 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.395301104 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.395324945 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.403671026 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.403692961 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.403707027 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.403728008 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.403748989 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.403882980 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.403894901 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.403903961 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.403913975 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.403939009 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.403970003 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.440629005 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.440648079 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.440659046 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.440696955 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.440818071 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.440829039 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.440838099 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.440849066 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.440867901 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.440895081 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.441354990 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.441395044 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.441420078 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.441431046 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.441468000 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.441570044 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.441581011 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.441591024 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.441600084 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.441611052 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.441620111 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.441658020 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.441838026 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.441847086 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.441857100 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.441869020 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.441879034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.441879034 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.441909075 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.441931963 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.442121029 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.442131996 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.442141056 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.442152023 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.442161083 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.442162037 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.442228079 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.442329884 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.442344904 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.442354918 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.442363977 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.442377090 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.442395926 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.442415953 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.442428112 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.442437887 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.442447901 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.442456961 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.442461014 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.442468882 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.442470074 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.442498922 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.443001986 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443012953 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443022966 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443032980 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443042040 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443052053 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443052053 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.443058014 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443063974 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443068027 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443073034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443074942 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.443084002 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443089008 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443094015 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443099022 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443104029 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443109035 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.443110943 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443180084 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.443840981 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443851948 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443861961 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443866968 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443871975 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443876982 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443878889 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.443882942 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443888903 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443893909 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443902969 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443907976 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443912983 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443917990 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443922997 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443928003 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443933010 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.443934917 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.444025993 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.444582939 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.444592953 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.444597960 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.444602966 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.444607973 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.444612980 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.444617987 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.444622993 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.444628000 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.444637060 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.444642067 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.444652081 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.444663048 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.444693089 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.444719076 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.445224047 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.445234060 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.445240021 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.445245028 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.445255041 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.445260048 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.445266008 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.445327997 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.480864048 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.480911970 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.480927944 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.480940104 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.480987072 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.481029987 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481040001 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481055975 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481060982 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481066942 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481112957 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.481309891 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481319904 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481342077 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481347084 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.481348038 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481359959 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481379986 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.481408119 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.481594086 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481605053 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481610060 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481618881 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481625080 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481630087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481667995 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.481695890 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.481868029 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481878996 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481889963 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.481920958 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.489972115 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.490024090 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.490031958 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.490034103 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.490082026 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.490190983 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.490200043 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.490210056 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.490215063 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.490219116 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.490267992 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.539740086 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.539767981 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.539772034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.539853096 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.539860010 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.539953947 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.539963961 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.539963007 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.539969921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.540040016 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.541099072 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541147947 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541158915 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541191101 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.541256905 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541264057 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541270018 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541275024 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541364908 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.541435003 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541445971 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541450977 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541610956 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541615963 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541621923 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541626930 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541632891 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541637897 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541644096 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541795969 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.541948080 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.541956902 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542016983 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542026997 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542027950 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.542033911 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542040110 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542046070 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542231083 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.542439938 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542483091 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542488098 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542622089 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.542640924 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542650938 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542656898 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542663097 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542792082 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.542895079 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542906046 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542912960 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542917967 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542922974 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542927980 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.542933941 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.543064117 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.543210030 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.543289900 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.543294907 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.543301105 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.543306112 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.543311119 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.543315887 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.543452978 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.543633938 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.543683052 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.543694019 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.543730021 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.543831110 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.543836117 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.543840885 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.543845892 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.543858051 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.543905973 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.544056892 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.544078112 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544089079 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544094086 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544099092 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544286013 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.544291019 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544301033 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544306993 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544313908 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544385910 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.544476032 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544547081 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544557095 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544563055 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544569016 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544574022 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544579029 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544759035 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.544858932 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544868946 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544874907 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544879913 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544886112 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544891119 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.544894934 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.545072079 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.547970057 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.548036098 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.567084074 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567125082 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567136049 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567189932 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.567272902 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567286968 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567291975 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567297935 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567302942 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567357063 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.567540884 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567550898 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567562103 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567567110 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567573071 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567578077 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567634106 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.567827940 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567837954 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567843914 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567848921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567854881 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567859888 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.567914009 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.568105936 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.568116903 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.568178892 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.568187952 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.568200111 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.568205118 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.568211079 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.568214893 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.568221092 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.568226099 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.568274975 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.569309950 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.576582909 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.576627016 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.576628923 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.576639891 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.576693058 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.576795101 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.576805115 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.576816082 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.576822042 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.576874018 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.632559061 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.632571936 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.632582903 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.632663965 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.632673979 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.632679939 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.632687092 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.632705927 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.632736921 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.632817984 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.632854939 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.632894993 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.632925034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.632935047 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.632941008 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.632988930 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.633100986 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633119106 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633128881 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633133888 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633138895 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633145094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633152008 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633214951 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.633409023 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633465052 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.633481026 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633491039 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633497000 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633502960 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633507967 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633585930 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.633678913 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633688927 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633737087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633740902 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.633749962 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633755922 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.633833885 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.634084940 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634103060 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634114027 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634124994 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634135008 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634140968 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.634146929 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634160042 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634164095 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.634171009 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634181023 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634191990 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634202957 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634206057 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.634215117 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634222984 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634278059 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.634844065 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634855986 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634865999 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634876013 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634886026 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634891987 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.634897947 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634910107 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634917974 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.634918928 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634931087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634936094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634942055 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634942055 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.634947062 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634953022 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634958029 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634963036 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.634968996 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.635013103 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.635683060 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.635691881 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.635698080 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.635703087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.635708094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.635713100 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.635719061 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.635724068 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.635729074 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.635734081 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.635745049 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.635750055 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.635762930 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.635768890 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.635780096 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.635833979 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.636349916 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.636360884 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.636379004 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.636389017 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.636396885 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.636403084 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.636415005 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.636420012 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.636426926 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.636445045 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.636466980 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.640419960 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.640501022 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.653358936 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.653477907 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.653486967 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.653520107 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.653534889 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.653546095 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.653551102 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.653557062 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.653599977 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.653729916 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.653791904 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.653858900 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.653867960 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.653877974 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.653883934 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.653888941 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.653932095 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.654042959 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654052973 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654098034 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.654120922 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654160023 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.654201031 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654212952 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654218912 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654225111 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654234886 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654246092 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654268980 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.654303074 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.654608011 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654712915 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654722929 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654727936 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654733896 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654738903 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654748917 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654755116 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.654799938 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.654830933 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.660162926 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.664892912 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.664969921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.664979935 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.665007114 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.665091991 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.665102959 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.665112972 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.665124893 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.665132999 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.665169954 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.753618956 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.753684044 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.753695965 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.753741980 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.753751993 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.753762960 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.753768921 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.753823996 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.753958941 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.756241083 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.756249905 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.756279945 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.756299973 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.756337881 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.756341934 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.756349087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.756360054 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.756388903 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.756514072 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.756525040 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.756565094 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.756782055 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.756824970 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.756836891 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.756846905 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.756880999 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.757097960 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757108927 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757142067 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.757314920 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757364988 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757375956 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757411003 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.757515907 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757527113 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757538080 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757548094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757572889 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.757587910 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.757805109 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757816076 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757826090 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757836103 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757846117 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757848024 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.757857084 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757868052 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757869005 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.757878065 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757888079 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.757900953 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.757926941 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.757946968 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.758630037 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.758668900 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.758680105 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.758706093 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.758800983 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.758811951 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.758821964 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.758833885 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.758852005 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.758872032 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.759036064 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.759078026 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.759109974 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.759120941 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.759138107 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.759160995 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.759210110 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.759249926 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.759299040 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.759309053 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.759320974 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.759346962 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.759390116 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.759428024 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.759454012 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.759464025 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.759473085 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.759481907 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.759490967 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.759505987 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.759517908 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.759592056 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.759632111 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.760576963 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.760595083 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.760605097 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.760639906 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.760742903 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.760752916 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.760761976 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.760771990 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.760780096 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.760797024 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.760879993 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.760890007 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.760917902 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.760945082 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.760955095 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.760981083 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.761077881 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.761089087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.761116982 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.761127949 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.761167049 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.761399031 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.761436939 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.761487961 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.761497974 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.761518955 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.761590004 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.761600971 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.761610985 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.761634111 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.761667013 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.761781931 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.769396067 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.769474030 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.775803089 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.775847912 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.775888920 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.775899887 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.775942087 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.776016951 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776027918 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776040077 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776051044 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776061058 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776063919 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.776084900 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.776277065 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776288986 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776298046 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776309013 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776326895 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.776370049 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.776428938 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776468039 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.776489019 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776499987 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776510954 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776520967 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776535988 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.776547909 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.776737928 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776756048 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776766062 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776792049 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.776793003 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776806116 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776817083 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776827097 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776828051 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.776837111 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776848078 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776851892 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.776859045 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776870012 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.776870966 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.776896000 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.777170897 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.777180910 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.777208090 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.777214050 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.777245045 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.777306080 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.777348995 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.777359009 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.777388096 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.777494907 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.777506113 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.777515888 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.777527094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.777534962 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.777538061 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.777564049 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.777576923 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.781366110 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.842889071 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.842932940 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.842943907 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843010902 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.843060970 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843072891 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843082905 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843094110 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843107939 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.843125105 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.843307018 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843318939 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843348980 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843358994 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843360901 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.843369961 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843380928 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843385935 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.843391895 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843409061 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.843430996 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.843660116 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843671083 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843681097 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843709946 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.843765020 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843776941 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843786001 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843796968 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.843813896 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.843838930 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.843988895 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.844033003 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.844271898 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.844283104 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.844291925 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.844302893 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.844312906 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.844316006 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.844319105 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.844336987 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.844361067 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.844444990 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.844456911 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.844492912 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.844568014 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.844579935 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.844588995 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.844598055 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.844609022 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.844621897 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.844651937 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.845154047 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.845165014 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.845174074 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.845192909 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.845202923 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.845206976 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.845212936 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.845226049 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.845233917 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.845237017 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.845259905 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.845288038 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.845494986 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.845571041 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.845580101 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.845612049 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.845668077 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.845679045 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.845688105 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.845698118 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.845710039 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.845731974 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.845830917 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.845870018 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.846555948 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.846617937 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.846627951 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.846637964 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.846645117 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.846673012 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.846843004 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.846853018 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.846860886 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.846874952 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.846887112 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.846919060 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.847003937 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847013950 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847022057 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847031116 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847039938 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847048044 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847048998 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.847059011 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847064018 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.847090960 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.847342968 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847382069 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847390890 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847393036 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.847423077 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.847543955 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847553968 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847562075 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847570896 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847582102 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.847604990 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.847713947 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847723961 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847733021 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847743034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847769976 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.847783089 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.847807884 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847819090 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847856998 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.847897053 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847907066 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.847942114 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.850301981 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.862447977 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.862545967 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.862556934 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.862582922 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.862696886 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.862709045 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.862720966 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.862732887 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.862737894 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.862751007 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.863120079 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.863159895 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.863168955 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.863181114 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.863217115 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.863351107 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.863363028 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.863373041 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.863388062 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.863399029 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.863399029 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.863420963 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.863746881 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.863759041 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.863769054 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.863780022 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.863790989 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.863801003 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.863801956 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.863832951 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.863959074 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.864002943 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.865350008 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.865379095 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.865390062 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.865415096 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.865525961 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.865571976 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.865616083 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.865628004 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.865672112 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.865770102 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.865782022 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.865792036 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.865803957 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.865818024 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.865849018 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.866003036 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.866014004 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.866024971 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.866041899 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.866050959 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.866072893 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.869584084 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.929522991 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.929533005 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.929541111 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.929558039 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.929567099 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.929575920 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.929584980 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.929600000 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.929707050 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.929845095 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.929855108 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.929864883 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.929894924 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.930084944 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930095911 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930109024 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930116892 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930121899 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.930151939 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930154085 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.930164099 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930175066 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930186033 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930197954 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.930207014 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.930393934 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930403948 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930413961 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930423021 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930452108 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.930479050 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.930546045 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930592060 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.930675030 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930686951 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930697918 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930707932 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930717945 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930722952 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.930728912 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930740118 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930749893 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930752039 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.930763006 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.930773020 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.930788994 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.931276083 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.931292057 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.931303978 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.931318998 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.931327105 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.931329966 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.931337118 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.931341887 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.931375027 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.931451082 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.931462049 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.931472063 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.931482077 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.931492090 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.931502104 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.931528091 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.931548119 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.931866884 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.931878090 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.931889057 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.931899071 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.931909084 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.931919098 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.931946993 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.932101011 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.932111025 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.932121038 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.932142973 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.932156086 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.933185101 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.933347940 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.933393955 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.933401108 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.933413029 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.933449030 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.933628082 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.933644056 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.933654070 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.933665037 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.933689117 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.933698893 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.933801889 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.933813095 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.933821917 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.933834076 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.933842897 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.933845043 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.933866024 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.934030056 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934045076 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934053898 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934071064 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934082031 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934082031 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.934092999 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934103012 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934112072 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934113979 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.934129000 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934134007 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.934139967 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934170008 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.934551954 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934562922 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934572935 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934581995 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934591055 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934597969 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.934607983 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934617996 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934628963 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.934639931 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.934649944 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.934668064 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.936814070 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.936844110 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.948741913 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.948756933 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.948765993 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.948776007 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.948786020 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.948795080 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.948796988 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.948806047 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.948816061 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.948833942 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.948852062 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.950097084 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.950113058 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.950123072 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.950133085 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.950138092 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.950144053 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.950158119 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.950165033 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.950170994 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.950193882 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.950210094 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.951663017 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.951704979 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.951716900 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.951742887 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.951848984 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.951859951 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.951872110 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.951883078 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.951893091 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.951895952 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.951931000 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.952042103 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.952147961 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.952158928 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.952168941 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.952181101 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.952191114 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.952193975 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.952202082 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.952219963 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.952253103 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.952444077 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.952455997 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.952474117 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.952495098 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.952506065 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.952506065 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.952516079 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.952524900 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.952528000 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:35.952557087 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:35.952580929 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.015860081 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.015887976 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.015919924 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.015979052 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.016011953 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016022921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016033888 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016046047 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016062975 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.016119957 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.016252041 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016263008 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016273975 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016284943 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016295910 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016305923 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016309023 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.016318083 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016335011 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.016375065 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.016558886 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016622066 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016633034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016665936 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.016730070 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016741037 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016757011 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016767979 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016772032 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.016794920 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.016904116 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.016949892 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.017080069 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017091990 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017102003 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017112970 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017122984 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017132044 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.017136097 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017147064 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017157078 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017168999 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017170906 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.017188072 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.017478943 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017489910 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017529964 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.017575026 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017587900 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017626047 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.017667055 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017679930 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017710924 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.017761946 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017811060 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.017853975 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017916918 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017929077 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.017966032 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.018004894 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.018016100 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.018050909 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.018085957 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.018142939 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.018142939 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.018153906 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.018199921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.018204927 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.018290997 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.018304110 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.018332958 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.018388033 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.018399954 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.018440008 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.019366980 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.019423008 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.019426107 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.019433975 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.019476891 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.019537926 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.019577026 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.019587994 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.019598007 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.019608021 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.019618034 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.019637108 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.019783974 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.019795895 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.019804955 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.019815922 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.019826889 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.019848108 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.020031929 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.020044088 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.020054102 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.020064116 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.020073891 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.020073891 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.020117998 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.020215034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.020226002 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.020236015 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.020246983 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.020284891 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.020440102 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.020451069 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.020488977 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.024327040 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.035531998 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.035620928 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.035634995 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.035686970 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.035840034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.035851955 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.035861969 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.035872936 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.035892963 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.035917044 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.035991907 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.036004066 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.036014080 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.036024094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.036036015 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.036057949 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.036154985 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.036200047 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.036281109 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.036292076 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.036302090 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.036313057 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.036322117 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.036331892 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.036338091 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.036343098 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.036354065 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.036361933 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.036365032 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.036408901 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.037986994 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.038037062 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.038142920 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.038160086 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.038199902 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.038281918 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.038362980 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.038372993 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.038408041 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.038599014 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.038609982 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.038619995 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.038630962 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.038641930 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.038650990 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.038666964 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.038692951 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.038743973 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.038755894 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.038764000 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.038774014 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.038830042 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.039005041 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.039016008 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.039025068 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.039036036 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.039047003 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.039057970 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.039057970 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.039087057 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.039113045 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.039444923 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.092318058 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.102339983 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.102411985 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.102423906 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.102454901 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.102503061 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.102514982 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.102524996 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.102535009 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.102550030 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.102587938 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.102744102 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.102790117 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.102794886 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.102807045 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.102849007 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.102940083 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.102951050 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.102960110 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.102972031 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.102982998 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.103022099 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.103184938 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103195906 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103205919 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103215933 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103226900 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103246927 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.103272915 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.103434086 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103445053 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103455067 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103465080 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103471041 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.103476048 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103487015 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103514910 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.103776932 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103787899 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103796959 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103805065 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103815079 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103821993 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.103827000 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103840113 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.103869915 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.103892088 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.104049921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.104301929 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.104311943 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.104321957 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.104331017 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.104355097 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.104398012 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.104981899 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.105025053 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.105032921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.105046988 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.105092049 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.105174065 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.105184078 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.105192900 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.105205059 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.105228901 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.105264902 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.105370998 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.105381966 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.105424881 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.105506897 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.105518103 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.105528116 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.105539083 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.105550051 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.105556965 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.105581999 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.105937958 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.105989933 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.105989933 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.106002092 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.106049061 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.106203079 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.106214046 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.106224060 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.106235027 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.106266975 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.106303930 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.106394053 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.106555939 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.106595993 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.106607914 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.106617928 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.106654882 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.106831074 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.106842041 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.106877089 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.106887102 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.106898069 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.106899023 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.106956959 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.107219934 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.107232094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.107243061 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.107254982 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.107265949 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.107274055 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.107306957 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.107331991 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.109780073 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.109822989 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.121823072 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.121907949 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.121917963 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.121928930 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.121941090 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.121952057 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.121995926 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.122040033 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122051954 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122061968 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122095108 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.122270107 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122281075 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122299910 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122309923 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122311115 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.122322083 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122332096 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122358084 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.122540951 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122550964 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122566938 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122579098 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122590065 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122594118 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.122634888 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.122755051 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122766972 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122777939 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122786999 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.122797966 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.122840881 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.124756098 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.124802113 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.124811888 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.124844074 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.124964952 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.124977112 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.124986887 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.124996901 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.125008106 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.125016928 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.125065088 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.125211954 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.125222921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.125232935 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.125245094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.125257015 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.125300884 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.125411034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.125422955 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.125461102 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.125559092 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.125570059 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.125613928 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.125626087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.125637054 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.125673056 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.125682116 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.125684977 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.125696898 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.125745058 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.188683033 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.188735962 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.188746929 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.188806057 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.188829899 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.188843012 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.188853979 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.188864946 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.188884974 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.188903093 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.188994884 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189039946 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.189086914 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189099073 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189109087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189120054 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189131975 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.189178944 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.189207077 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189261913 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189274073 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189284086 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189306021 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.189332008 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.189505100 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189546108 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189558029 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189591885 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.189707041 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189719915 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189730883 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189740896 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189753056 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189759016 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.189779997 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.189821959 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.189958096 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189969063 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189979076 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.189990044 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.190012932 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.190047979 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.190097094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.190109015 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.190119982 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.190169096 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.190323114 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.190334082 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.190344095 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.190355062 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.190365076 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.190375090 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.190375090 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.190386057 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.190418959 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.190443993 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.191082954 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.191133976 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.191143990 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.191195965 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.191227913 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.191239119 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.191248894 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.191277981 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.191302061 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.191385984 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.191396952 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.191406965 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.191442966 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.191498995 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.191549063 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.191629887 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.191652060 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.191667080 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.191680908 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.191695929 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.191696882 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.191720009 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.191777945 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.191827059 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.192147017 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192228079 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192243099 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192272902 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.192306042 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192320108 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192332983 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192347050 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192352057 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.192377090 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.192468882 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192516088 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.192529917 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192569971 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192584038 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192615986 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.192663908 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192677975 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192718983 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.192795038 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192810059 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192823887 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192837954 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192842960 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.192856073 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.192884922 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.192920923 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.193063974 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.193084955 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.193099976 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.193111897 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.193125010 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.193125010 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.193141937 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.193154097 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.193183899 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.196259022 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.210195065 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.210249901 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.210262060 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.210300922 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.210330963 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.210340977 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.210351944 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.210364103 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.210374117 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.210376978 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.210398912 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.210423946 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.210509062 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.210520983 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.210552931 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.210644960 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.210656881 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.210668087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.210716009 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.210740089 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.210786104 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.210830927 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.210843086 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.210887909 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.210952997 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.211946011 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.211990118 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.212001085 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.212004900 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.212049007 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.212147951 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.212161064 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.212172031 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.212182999 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.212214947 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.212259054 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.214056969 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214071989 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214092016 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214118958 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.214234114 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214246035 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214257002 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214268923 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214281082 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214281082 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.214323997 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.214363098 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214375019 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214421034 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.214554071 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214569092 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214579105 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214589119 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214601040 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214616060 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.214623928 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214668036 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.214688063 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.214744091 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214756012 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214804888 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.214828968 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214844942 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214903116 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.214986086 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.214998007 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.215039968 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.275129080 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275161028 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275173903 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275238037 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275250912 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275252104 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.275264978 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275279045 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275283098 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.275327921 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.275420904 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275469065 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.275563002 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275573015 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275583982 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275594950 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275605917 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275616884 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.275619030 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275635004 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275650024 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.275677919 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.275827885 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275840998 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275870085 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.275913000 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275924921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275943041 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.275954962 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.275988102 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.276037931 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276051044 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276062012 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276097059 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.276258945 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276269913 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276281118 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276307106 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.276346922 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.276390076 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276401997 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276437998 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276441097 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.276452065 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276515007 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.276738882 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276751041 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276762009 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276777983 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276788950 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276789904 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.276803017 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276814938 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.276832104 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.276865005 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.277673006 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.277721882 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.277743101 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.277756929 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.277789116 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.277869940 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.277884960 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.277909040 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.277925014 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.277940989 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.277966022 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.278119087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.278134108 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.278146982 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.278161049 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.278172970 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.278176069 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.278192043 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.278218031 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.278219938 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.278258085 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.278517962 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.278567076 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.278601885 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.278615952 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.278667927 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.278695107 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.278708935 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.278722048 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.278736115 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.278753996 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.278784037 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.278963089 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.279019117 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.279035091 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.279048920 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.279064894 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.279071093 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.279092073 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.279153109 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.279166937 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.279180050 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.279201031 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.279239893 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.279329062 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.279345036 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.279357910 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.279403925 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.279462099 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.279475927 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.279499054 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.279512882 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.279524088 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.279526949 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.279546976 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.279582977 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.282531023 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.297097921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.297131062 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.297142029 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.297178030 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.297240973 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.297254086 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.297277927 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.297291994 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.297293901 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.297317982 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.298078060 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.298121929 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.298149109 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.298161030 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.298199892 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.298304081 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.298316002 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.298327923 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.298338890 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.298348904 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.298361063 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.298384905 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.298614025 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.298625946 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.298635960 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.298656940 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.298683882 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.298897982 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.298908949 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.298919916 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.298940897 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.298964024 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.299004078 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.300617933 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.300667048 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.300678015 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.300723076 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.300795078 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.300808907 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.300822020 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.300838947 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.300847054 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.300869942 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.300952911 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.301002026 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.301037073 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.301050901 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.301084995 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.301182032 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.301198006 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.301213980 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.301225901 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.301258087 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.301291943 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.301531076 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.301588058 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.301599026 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.301640034 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.301703930 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.301714897 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.301726103 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.301760912 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.301774979 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.301913023 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.342314005 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.361712933 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.361743927 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.361754894 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.361891031 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.361903906 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.361912966 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.361920118 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.361936092 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.361942053 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.361972094 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.362231016 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362241983 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362252951 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362263918 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362277031 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.362318993 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.362329006 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362340927 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362351894 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362360954 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362370968 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.362380981 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362405062 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.362447023 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.362556934 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362566948 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362576962 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362586975 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362597942 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362605095 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.362610102 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362632036 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362646103 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.362674952 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.362875938 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362885952 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362895966 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362906933 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362917900 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362929106 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.362931013 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362946033 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.362957954 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.362983942 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.363145113 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.363248110 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.363257885 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.363269091 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.363280058 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.363290071 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.363293886 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.363303900 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.363317966 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.363336086 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.363337994 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.363364935 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.364253998 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.364300966 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.364413977 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.364433050 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.364478111 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.365647078 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.365801096 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.365813971 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.365845919 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.365967035 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.366014004 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.367609978 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367624998 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367675066 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.367754936 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367768049 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367778063 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367796898 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367804050 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.367810011 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367824078 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367834091 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367841005 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.367849112 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367868900 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367870092 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.367888927 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367897034 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.367904902 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367918015 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367930889 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367944002 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367949963 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.367959023 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367971897 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367985964 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.367995977 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.368000031 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.368011951 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.368052006 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.368062973 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.368067980 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.368083954 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.368098021 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.368108034 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.368110895 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.368124962 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.368134975 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.368180037 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.368191957 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.368206024 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.368218899 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.368218899 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.368236065 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.368248940 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.368282080 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.368799925 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.384452105 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.384510040 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.384526014 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.384542942 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.384593964 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.384608030 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.384620905 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.384632111 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.384648085 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.384673119 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.384713888 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.384845972 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.384886980 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.384901047 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.384927034 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.384985924 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.385000944 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.385026932 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.385179043 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.385191917 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.385235071 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.385277033 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.385288954 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.385299921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.385313034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.385323048 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.385328054 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.385345936 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.385528088 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.385541916 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.385551929 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.385596991 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.386991978 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.387052059 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.387068033 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.387084007 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.387095928 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.387128115 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.387177944 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.387192965 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.387233019 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.387619972 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.387636900 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.387651920 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.387665987 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.387684107 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.387692928 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.387697935 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.387710094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.387723923 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.387737989 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.387753963 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.387762070 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.387800932 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.388340950 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.388412952 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.388489008 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.388654947 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.388670921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.388698101 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.388748884 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.388762951 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.388777018 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.388791084 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.388817072 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.448384047 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.448402882 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.448414087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.448425055 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.448442936 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.448458910 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.448471069 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.448487997 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.448496103 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.448560953 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.448678970 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.448693991 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.448704004 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.448714972 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.448730946 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.448755980 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.449067116 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.449079037 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.449089050 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.449100018 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.449110985 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.449119091 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.449124098 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.449140072 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.449148893 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.449160099 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.449172020 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.449177980 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.449203014 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.449387074 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.449404955 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.449417114 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.449421883 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.449433088 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.449455976 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.449493885 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.470654011 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.470670938 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.470733881 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.470766068 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.470778942 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.470789909 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.470820904 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.470938921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.470951080 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.470961094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.470993042 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.471024036 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.471082926 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471093893 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471105099 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471115112 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471124887 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471134901 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471144915 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.471149921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471182108 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.471225023 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471271038 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.471554995 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471565962 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471576929 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471586943 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471596956 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471605062 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.471616030 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471628904 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471638918 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471647978 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.471652985 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471667051 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471674919 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.471681118 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471698999 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.471719027 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471719980 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.471734047 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471745014 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471755981 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471766949 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471780062 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.471781015 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.471805096 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.472163916 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472174883 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472183943 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472194910 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472204924 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472217083 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472219944 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.472232103 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472243071 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472248077 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.472256899 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472270012 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472276926 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.472305059 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.472490072 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472501993 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472512007 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472522020 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472532988 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472534895 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.472546101 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472558022 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472575903 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.472601891 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.472625971 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472639084 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472650051 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472677946 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.472819090 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472831011 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472861052 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.472963095 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472974062 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472984076 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.472995043 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.473005056 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.473006010 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.473018885 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.473031044 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.473042011 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.473042965 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.473068953 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.473402977 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.473445892 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.473453045 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.473464966 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.473500967 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.473642111 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.473658085 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.473669052 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.473680019 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.473690033 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.473707914 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.473742962 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.474113941 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.474128008 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.474139929 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.474153042 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.474165916 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.474179029 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.474180937 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.474194050 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.474210024 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.474236012 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.474550962 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.474723101 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.474770069 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.474869967 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.474884033 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.474894047 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.474905014 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.474915981 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.474920988 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.474941015 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.474963903 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.474988937 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.534933090 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535073042 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535084963 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535096884 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535106897 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535146952 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.535188913 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.535206079 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535219908 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535260916 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.535388947 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535399914 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535413027 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535425901 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535432100 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.535440922 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535459042 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535471916 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.535475016 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535490036 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.535517931 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.535680056 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535929918 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535939932 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535949945 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535959959 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535969973 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.535979033 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.535983086 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.536015034 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.538839102 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.538882971 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.538892031 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.538898945 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.538942099 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.539048910 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539060116 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539072037 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539083004 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539096117 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539096117 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.539124966 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.539298058 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539311886 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539325953 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539340019 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539356947 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.539386988 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.539535999 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539555073 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539567947 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539582968 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539588928 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.539597034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539609909 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.539613962 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539637089 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.539799929 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539810896 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539820910 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539841890 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.539841890 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539866924 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539874077 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.539880991 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539894104 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539906025 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539906979 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.539921045 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539933920 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.539935112 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.539954901 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.540561914 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.540574074 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.540584087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.540595055 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.540610075 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.540637970 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.540719032 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.540730953 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.540740967 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.540750980 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.540762901 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.540764093 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.540777922 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.540786982 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.540791035 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.540800095 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.540807009 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.540831089 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.541169882 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.541184902 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.541198015 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.541212082 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.541224957 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.541227102 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.541256905 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.541270018 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.541347027 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.541361094 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.541372061 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.541383028 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.541403055 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.541421890 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.541727066 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.558296919 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558326960 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558337927 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558348894 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558358908 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558368921 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558374882 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.558381081 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558406115 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.558506966 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558614016 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558624029 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558634043 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558645010 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558654070 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.558655977 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558670044 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558679104 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.558684111 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558718920 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.558952093 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558963060 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558979034 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.558998108 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.559011936 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.559102058 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.559113979 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.559124947 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.559144020 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.559271097 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.559401035 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.559693098 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.559743881 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.559752941 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.559787989 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.559803009 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.559813976 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.559823990 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.559845924 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.559863091 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.560025930 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.560039043 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.560075045 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.560173035 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.560183048 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.560218096 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.560318947 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.560331106 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.560358047 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.560365915 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.560373068 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.560385942 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.560396910 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.560420990 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.560446024 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.560941935 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.561032057 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.561043978 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.561057091 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.561069965 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.561083078 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.561084986 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.561096907 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.561108112 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.561110973 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.561121941 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.561156034 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.620843887 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.620945930 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.620955944 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.621001005 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.621089935 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.621100903 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.621113062 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.621125937 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.621139050 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.621151924 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.621406078 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.621417999 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.621428967 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.621438026 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.621445894 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.621450901 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.621467113 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.621478081 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.621494055 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.621520996 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.621531963 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.621542931 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.621572018 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.621598959 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.625134945 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625174999 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625189066 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625217915 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.625268936 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625281096 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625297070 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625312090 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625312090 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.625332117 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.625458002 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625473022 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625572920 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.625586987 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625600100 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625612974 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625626087 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625633955 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.625647068 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625657082 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.625669956 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625679016 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.625866890 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625881910 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625922918 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625925064 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.625937939 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625952005 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625966072 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625979900 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.625993967 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.626007080 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.626007080 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.626020908 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.626545906 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.626564026 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:36.626620054 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.634501934 CEST	49705	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:36.639615059 CEST	4433	49705	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:42.009695053 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:42.016572952 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:42.016700029 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:42.016853094 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:42.021882057 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:42.652663946 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:42.652687073 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:42.652864933 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:42.661226034 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:42.666134119 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:42.844150066 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:42.844414949 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:42.849716902 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.121541023 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.124661922 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.129717112 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.129774094 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.134632111 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.402170897 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.404917002 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.410856009 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.410979033 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.415992975 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.844058037 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.844083071 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.844151020 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.844182968 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.844230890 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.852591991 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.852751017 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.852853060 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.852961063 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.857897997 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.857913971 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.857923031 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.858000040 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.858098984 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.858108997 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.858118057 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.858134985 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.858138084 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.858144045 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.858154058 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.858163118 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.858170986 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.858179092 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.858210087 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.858210087 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.858232021 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.862566948 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.862683058 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.862771988 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.862817049 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.862910986 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.862921000 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.862929106 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.863004923 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.863173962 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.863184929 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.863301039 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.863377094 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.863404036 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.863660097 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.863670111 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.863730907 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.867650986 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.867741108 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:43.867760897 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.868324041 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.868438005 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.869544029 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.871073961 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.872406006 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.872416019 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.872431993 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.872461081 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.872469902 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.872649908 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.872658968 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.872737885 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.872746944 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.872756004 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:43.872764111 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.272555113 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.275491953 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:44.275656939 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:44.275748968 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:44.283672094 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.283689022 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.283698082 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.283725977 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.283735037 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.283735991 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:44.283745050 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.283754110 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.283948898 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.283957958 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.288602114 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.555911064 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.559643984 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:44.559777975 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:44.560024977 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:44.560126066 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:44.560172081 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:44.564750910 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.564851046 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.564882040 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.564924002 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.564973116 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.565102100 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.565216064 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.565231085 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.565265894 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.565280914 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.565298080 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.565418005 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.565471888 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.565532923 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.565550089 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.765446901 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:44.811089993 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:45.779905081 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:45.785161972 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:45.785223961 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:45.790030956 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:46.096451044 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:46.096471071 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:46.096529007 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:46.096662998 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:46.096735954 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:46.098114967 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:46.098156929 CEST	49706	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:46.101485014 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:46.102919102 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:46.102929115 CEST	4433	49706	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:51.092757940 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:51.097645998 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:51.097771883 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:51.097858906 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:51.102612019 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:51.707706928 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:51.707731962 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:51.707801104 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:51.716110945 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:51.720930099 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:51.909432888 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:51.915371895 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:51.922024965 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.191610098 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.194449902 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:52.199500084 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.199561119 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:52.204349041 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.477068901 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.479829073 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:52.486975908 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.487060070 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:52.492748976 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.977689981 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.981147051 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.981197119 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.981209040 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.981221914 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:52.981261015 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:52.981385946 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.981403112 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.981415033 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.981426001 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.981455088 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:52.981478930 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:52.988837957 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.988850117 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.988862038 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.988873005 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.988905907 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:52.988930941 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:52.994204998 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.994354963 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.994366884 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.994399071 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:52.994405985 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:52.994436026 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.000010967 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.000037909 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.000070095 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.068384886 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.068401098 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.068413019 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.068463087 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.068490982 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.068532944 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.068536997 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.068546057 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.068583012 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.069041967 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.069051981 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.069087982 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.069215059 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.069225073 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.069283009 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.074275017 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.074309111 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.074318886 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.074363947 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.078295946 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.078346014 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.078353882 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.078356028 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.078388929 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.083586931 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.083643913 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.083653927 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.083695889 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.089162111 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.089207888 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.089217901 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.089241028 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.089272022 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.095024109 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.095081091 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.095092058 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.095136881 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.099945068 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.099956989 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.099999905 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.100090981 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.100100994 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.100138903 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.105160952 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.105171919 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:53.105210066 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:53.154808998 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.149147034 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.154170036 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.154264927 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.161693096 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.472855091 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.473526955 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.473539114 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.473550081 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.473588943 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.473635912 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.476393938 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.476404905 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.476417065 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.476428986 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.476440907 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.476466894 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.480413914 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.480429888 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.480441093 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.480464935 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.481200933 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.481242895 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.483990908 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.484034061 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.484045029 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.484070063 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.487593889 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.487605095 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.487616062 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.487636089 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.487656116 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.491405964 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.491461039 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.491471052 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.491498947 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.494786978 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.494806051 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.494816065 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.494836092 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.494852066 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.498589993 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.498601913 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.498611927 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.498651981 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.506071091 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.506083012 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.506099939 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.506109953 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.506125927 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.506145000 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.507170916 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.507180929 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.507190943 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.507201910 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.507216930 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.507234097 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.511569023 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.511579037 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.511590004 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.511627913 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.511646986 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.511768103 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.517159939 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.517170906 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.517210007 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.517318964 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.517330885 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.517363071 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.520217896 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.520227909 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.520237923 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.520266056 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.520282984 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.520328999 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.523233891 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.523243904 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.523297071 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.523475885 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.523485899 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.523521900 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.527148008 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.527158022 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.527200937 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.527249098 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.527259111 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.527290106 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.531438112 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.531446934 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.531487942 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.531542063 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.531553030 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.531585932 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.539935112 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.539966106 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.539975882 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.539983988 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.540014982 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.541244030 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.541285038 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.541296005 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.541338921 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.541496992 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.541507006 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.541538954 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.541667938 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.541707039 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.541881084 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.559067965 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.559087992 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.559098005 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.559138060 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.559159040 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.559252024 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.559289932 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.559298992 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.559326887 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.562213898 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.562258005 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.562268019 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.562277079 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.562297106 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.562311888 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.562323093 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.562334061 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.562369108 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.567222118 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.567233086 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.567244053 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.567270994 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.567291975 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.567301035 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.570904970 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.570920944 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.570930958 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.570983887 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.574440956 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.574453115 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.574464083 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.574490070 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.578260899 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.578272104 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.578282118 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.578300953 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.578322887 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.581707001 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.581718922 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.581728935 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.581753969 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.581974030 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.581985950 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.582017899 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.585433960 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.585444927 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.585455894 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.585479975 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.585500002 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.585535049 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.588862896 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.588905096 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.588933945 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.589409113 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.589445114 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.589802027 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.592407942 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.592427969 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.592448950 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.592509985 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.592519999 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.592544079 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.595885992 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.595896959 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.595906973 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.595926046 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.595952034 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.599596977 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.599607944 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.599617958 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.599643946 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.602922916 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.602933884 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.602942944 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.602984905 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.603023052 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.606066942 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.606077909 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.606089115 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.606116056 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.608979940 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.609036922 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.609040022 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.609046936 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.609083891 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.611737967 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.611845970 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.611855030 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.611864090 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.611880064 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.611907005 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.614479065 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.614514112 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.614523888 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.614548922 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.617430925 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.617441893 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.617451906 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.617492914 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.620075941 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.620095015 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.620105028 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.620131969 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.622761965 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.622824907 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.622824907 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.622834921 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.622847080 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.622875929 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.625672102 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.625683069 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.625693083 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.625710964 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.625729084 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.628061056 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.628071070 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.628115892 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.628149033 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.628159046 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.628191948 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.630527020 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.630561113 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.630573034 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.630589962 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.632850885 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.632879972 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.632898092 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.632915974 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.632934093 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.632941008 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.635164022 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.635210037 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.635210991 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.635221004 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.635256052 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.637610912 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.637645006 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.637679100 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.637761116 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.637770891 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.637806892 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.638892889 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.638989925 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.639002085 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.639012098 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.639028072 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.639046907 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.640178919 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.640222073 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.640232086 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.640254021 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.641473055 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.641508102 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.641540051 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.641551018 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.641582012 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.642816067 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.642883062 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.642894030 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.642914057 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.644001007 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.644037008 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.644046068 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.644047976 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.644087076 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.645523071 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.645553112 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.645562887 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.645587921 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.646553993 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.646619081 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.646622896 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.646635056 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.646667004 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.647932053 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.648032904 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.648068905 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.648144007 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.648154020 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.648189068 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.649159908 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.649271965 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.649281979 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.649291992 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.649327040 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.650394917 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.650444031 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.650454044 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.650475979 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.651710033 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.651758909 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.651771069 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.651782990 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.651818991 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.652836084 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.652877092 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.652931929 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.652955055 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.652965069 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.652995110 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.654371023 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.654386997 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.654397964 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.654431105 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.655493975 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.655534983 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.655569077 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.655579090 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.655611038 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.655611038 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.656687975 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.656725883 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.656733990 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.656744003 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.656754017 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.656775951 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.657963991 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.657977104 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.657988071 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.658041000 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.659173965 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.659185886 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.659194946 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.659219027 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.660357952 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.660368919 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.660378933 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.660410881 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.660442114 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.661665916 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.661699057 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.661709070 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.661732912 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.662983894 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.663019896 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.663038969 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.663049936 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.663090944 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.664165974 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.664185047 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.664195061 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.664227962 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.665388107 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.665422916 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.665431976 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.665452957 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.665482044 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.665589094 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.666692019 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.666726112 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.666732073 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.666737080 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.666748047 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.666766882 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.668452024 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.668492079 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.668519020 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.668534994 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.668545961 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.668576002 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.669224977 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.669266939 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:55.669368029 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:55.717309952 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.282006979 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.282078028 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.282140970 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.373817921 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.378619909 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.378701925 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.383445978 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.690942049 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.691473007 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.691526890 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.691544056 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.691555977 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.691586018 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.691601992 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.691898108 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.691942930 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.691947937 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.691962004 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.691997051 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.692030907 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.692914963 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.692955971 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.692960024 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.692970037 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.693007946 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.693031073 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.693845987 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.693856955 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.693866968 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.693891048 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.693932056 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.694407940 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.694783926 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.694828987 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.694873095 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.694902897 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.694912910 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.694941044 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.695548058 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.695593119 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.695594072 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.695605993 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.695641041 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.696387053 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.696405888 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.696449041 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.762141943 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.766984940 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:56.767038107 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:56.771853924 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.081880093 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.081947088 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.081974983 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.081985950 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.082032919 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.082061052 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.082988024 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.083031893 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.083044052 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.083074093 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.083147049 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.083185911 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.084013939 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.084024906 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.084036112 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.084080935 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.084081888 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.084148884 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.084433079 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.084454060 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.084462881 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.084490061 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.084515095 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.084551096 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.085038900 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.085328102 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.085338116 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.085369110 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.085683107 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.085726976 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.085736036 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.085746050 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.085756063 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.085782051 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.086855888 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.086905003 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.086909056 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.086921930 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.086960077 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.087119102 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.087131023 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.087141037 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.087162971 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.087869883 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.087882996 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.087917089 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.087928057 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.087965965 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.088397026 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.088442087 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.088454962 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.088510990 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.089164972 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.089175940 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.089185953 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.089216948 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.089243889 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.089847088 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.089900970 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.089910984 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.089920998 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.089941025 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.089962959 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.090415001 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.090455055 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.090492964 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.090498924 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.090508938 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.090543985 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.091298103 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.091309071 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.091319084 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.091341019 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.091897011 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.091908932 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.091917992 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.091943979 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.091969967 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.092439890 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.092509985 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.092519045 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.092529058 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.092552900 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.092570066 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.093439102 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.093450069 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.093460083 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.093482971 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.093972921 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.093985081 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.093996048 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.094021082 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.094044924 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.094652891 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.094664097 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.094681978 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.094692945 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.094706059 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.094727039 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.095370054 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.095386982 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.095397949 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.095436096 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.095943928 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.095953941 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.095995903 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.096004963 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.096015930 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.096046925 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.096697092 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.096708059 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.096718073 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.096729040 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.096746922 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.096775055 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.097439051 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.097451925 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.097461939 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.097485065 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.097501040 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.098125935 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.098169088 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.098180056 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.098208904 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.098761082 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.098793030 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.098804951 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.098805904 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.098818064 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.098841906 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.099499941 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.099512100 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.099524021 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.099549055 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.099577904 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.100110054 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.100128889 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.100138903 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.100162983 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.100816965 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.100863934 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.100872993 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.100883007 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.100918055 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.100981951 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.101526022 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.101567984 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.101571083 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.101578951 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.101588964 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.101617098 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.102327108 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.102371931 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.102375984 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.102387905 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.102421045 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.102855921 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.102866888 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.102876902 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.102910042 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.102921963 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.102953911 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.103600025 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.103617907 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.103622913 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.103691101 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.104341030 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.104377985 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.104387999 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.104408979 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.104429960 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.104948997 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.104990959 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.105000973 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.105030060 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.105650902 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.105696917 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.105729103 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.105740070 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.105775118 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.106348991 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.106360912 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.106370926 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.106395960 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.107080936 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.107090950 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.107103109 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.107115030 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.107126951 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.107141972 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.107839108 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.107851028 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.107861042 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.107903957 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.107929945 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.108529091 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.108572006 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.108581066 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.108604908 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.108611107 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.108645916 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.109056950 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.109098911 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.109112024 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.109136105 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.109137058 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.109172106 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.109678030 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.109754086 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.109762907 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.109778881 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.109791994 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.109813929 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.110431910 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.110444069 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.110469103 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.110479116 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.110855103 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.110873938 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.110884905 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.110892057 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.110923052 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.111392975 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.111403942 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.111413956 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.111429930 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.111440897 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.111464977 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.112086058 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.112128019 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.112138033 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.112163067 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.154941082 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.168884993 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.168906927 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.168919086 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.169099092 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.169109106 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.169121027 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.169132948 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.169142962 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.169157982 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.169186115 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.170655966 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.170717955 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.170726061 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.170738935 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.170778990 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.170815945 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.170836926 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.170874119 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.170934916 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.170947075 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.170957088 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.170980930 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.172678947 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.172728062 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.172782898 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.217305899 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.250945091 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.255809069 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.255906105 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.260660887 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.358877897 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.364949942 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.365025043 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.365117073 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.370168924 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.567540884 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.567770004 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.567784071 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.567800045 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.567820072 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.567838907 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.567853928 CEST	49714	4433	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.572884083 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.573344946 CEST	4433	49714	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.987768888 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.987785101 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:57.987828970 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:57.997303963 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:58.002074003 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:58.220319033 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:58.221899986 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:58.226701975 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:58.393779993 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:07:58.393970013 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:07:58.398942947 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:03.566194057 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:03.566375017 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:08:03.571347952 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:08.738630056 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:08.738776922 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:08:08.743793964 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:13.911160946 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:13.914530039 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:08:13.919667006 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:19.089638948 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:19.089775085 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:08:19.094557047 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:24.332470894 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:24.332737923 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:08:24.337656021 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:29.506654978 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:29.506803036 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:08:29.511672020 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:34.680447102 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:34.680569887 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:08:34.685348034 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:39.856570005 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:39.856693983 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:08:39.861443996 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:45.030046940 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:45.030385017 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:08:45.035228014 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:50.203898907 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:50.204025030 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:08:50.208785057 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:55.377609968 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:08:55.377840042 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:08:55.383335114 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:09:00.552314997 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:09:00.552448034 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:09:00.557207108 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:09:05.725884914 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:09:05.725999117 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:09:05.730786085 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:09:10.900222063 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:09:10.900408030 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:09:10.906219006 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:09:16.075016022 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:09:16.075232983 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:09:16.080043077 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:09:21.248210907 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:09:21.248338938 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:09:21.253243923 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:09:26.424163103 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:09:26.424299002 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:09:26.429626942 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:09:31.596596956 CEST	6015	49715	91.92.250.172	192.168.2.5
Jul 3, 2024 18:09:31.596883059 CEST	49715	6015	192.168.2.5	91.92.250.172
Jul 3, 2024 18:09:31.602058887 CEST	6015	49715	91.92.250.172	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 18:07:33.381628036 CEST	60979	53	192.168.2.5	1.1.1.1
Jul 3, 2024 18:07:33.567881107 CEST	53	60979	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 18:07:33.381628036 CEST	192.168.2.5	1.1.1.1	0x94dd	Standard query (0)	servicehost.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 18:07:33.567881107 CEST	1.1.1.1	192.168.2.5	0x94dd	No error (0)	servicehost.org		91.92.250.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	12:07:27
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe"
Imagebase:	0x7ff6cc950000
File size:	448'512 bytes
MD5 hash:	7691D7D1F5928448074900950FF80EC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000000.00000003.2072119815.0000028A00000000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.2073704673.0000028A00B30000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.2073514166.0000028A00850000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:07:30
Start date:	03/07/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\openwith.exe"
Imagebase:	0x7ff7aba70000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2178047810.000001696CF53000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2162730362.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2146132400.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2152607598.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2172221902.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2144743517.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2173999560.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2160604237.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2151701654.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2168919912.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2145943011.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2143914701.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2156804131.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2166530938.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2149150890.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2162510756.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2153389081.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2178284141.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2144420099.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2158433515.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2155578371.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2160318605.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2158989228.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2168693807.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2161695796.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2147712177.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2170089401.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2155772326.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2149741241.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2158123556.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2163534539.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2177149426.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2156620245.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2173760062.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2168258050.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2170716518.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2151370818.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2161419525.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2149327727.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2159254038.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2160077344.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2161993900.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2157000461.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2145568055.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2148023665.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2156429560.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2147540781.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2157257186.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2155023843.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2167528754.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2147111279.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2160876076.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2171203616.000001696CF4E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2153076808.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2154545113.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2153930987.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2157484419.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2154778492.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2161146099.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2150322070.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2169206679.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2159533104.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000003.2075804118.000001696CF90000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2177711934.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2159774834.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2147354231.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2155990457.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2179330379.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2074402005.000001696ACE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2146350943.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2163727757.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2169561570.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2168435601.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2156237400.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2158714760.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2146569417.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2172654033.000001696CF4E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2146928114.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2172791367.000001696CF4E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2153718645.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000002.00000003.2075999920.000001696D270000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2173044127.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2145186850.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2167868673.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2157801248.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2154177761.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2143147524.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2173382185.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2155295704.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2148943136.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2143652418.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2143467189.000001696DA2D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:07:52
Start date:	03/07/2024
Path:	C:\Program Files\Windows Media Player\wmplayer.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Media Player\wmplayer.exe"
Imagebase:	0x7ff6fe090000
File size:	171'008 bytes
MD5 hash:	89DCD2D4C0EC638AADC00D3530E07E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	12:07:55
Start date:	03/07/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\dllhost.exe"
Imagebase:	0x7ff669820000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Function 0000028A000156A8 Relevance: 7.8, APIs: 5, Instructions: 253nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL ref: 0000028A0001571C
NtQuerySystemInformation.NTDLL ref: 0000028A00015743

Part of subcall function 0000028A000151B4: NtQueryInformationProcess.NTDLL ref: 0000028A00015223

GetTokenInformation.KERNELBASE ref: 0000028A00015853
FindCloseChangeNotification.KERNELBASE ref: 0000028A00015867
FindCloseChangeNotification.KERNELBASE ref: 0000028A00015878

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Information$Query$ChangeCloseFindNotificationSystem$ProcessToken
String ID:
API String ID: 222865090-0
Opcode ID: b9a3c4ba72519c8822dfc57c731493710fdc37b3db7567c16f04e989f1c331f2
Instruction ID: 774bef10e2954938751f80e55a7cc1b6d6e52390ea397b7346b5b68e419b329b
Opcode Fuzzy Hash: b9a3c4ba72519c8822dfc57c731493710fdc37b3db7567c16f04e989f1c331f2
Instruction Fuzzy Hash: AD71B734219E05CBFB55EF289C9A7AA73D1FBE4311F60852AE846C7191EF38D9018783

Function 0000028A00014FD4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE ref: 0000028A00015010

Strings

@, xrefs: 0000028A0001505F

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InfoSystem
String ID: @
API String ID: 31276548-2766056989
Opcode ID: 7df665d085f366cb99ab2ed896b311d25e2371bb223fb157703b8fcce2dda1a5
Instruction ID: d1f42002f7af568fa96a6abe00e41559073ecf4df9d5a2d15edc3c0b8e273c6f
Opcode Fuzzy Hash: 7df665d085f366cb99ab2ed896b311d25e2371bb223fb157703b8fcce2dda1a5
Instruction Fuzzy Hash: F521443461DE088FEB55EB58DC85B9A73E1F7E8351F10462AB086C3154DE7CE94487C2

Function 0000028A00014A54 Relevance: 1.8, APIs: 1, Instructions: 310COMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT ref: 0000028A00014B46

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _malloc_dbg
String ID:
API String ID: 1527718024-0
Opcode ID: e53356f1062cacf861271dc336240a7330d37cd7133727a4fd0f385aae3edfcc
Instruction ID: 07b7ca32ca04550ee4e1217e6ff3d18736a57dc60a4b9165ae253e9aa38d901c
Opcode Fuzzy Hash: e53356f1062cacf861271dc336240a7330d37cd7133727a4fd0f385aae3edfcc
Instruction Fuzzy Hash: F69159316199484BF76C9F28889A3F9B7D1F795305F24822FE49BC2292DE38D507C782

Function 0000028A000151B4 Relevance: 1.6, APIs: 1, Instructions: 54nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 0000028A00015223

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 5cd943b8ec8f82312c43e3a2f06d1ea5450dc20cd0d98dd920086ada27a54906
Instruction ID: bf30b0321f9f038923f6b6be27f5aea8242355a338230562b1f335d1b872f176
Opcode Fuzzy Hash: 5cd943b8ec8f82312c43e3a2f06d1ea5450dc20cd0d98dd920086ada27a54906
Instruction Fuzzy Hash: 5A017139329A098BFB89EF689C5ABE673E1F7A5301F10452AE55AC2191EF7CC5018742

Function 0000028A00016F40 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 188registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE ref: 0000028A00016FC9
RegCreateKeyExW.KERNELBASE ref: 0000028A00017001
RegSetValueExW.KERNELBASE ref: 0000028A000170C4
RegCloseKey.KERNELBASE ref: 0000028A000170DE

Strings

@, xrefs: 0000028A000170B7
@, xrefs: 0000028A00017051

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CloseCreateOpenValue
String ID: @$@
API String ID: 776291540-149943524
Opcode ID: d0f705a3185ad35ba5479375eab81183ddc54abaa6c67952c2e0273967de8d7a
Instruction ID: 38557568e26435905d85c8edb53766d24c6420b302189940169ebdb9ea73d7d4
Opcode Fuzzy Hash: d0f705a3185ad35ba5479375eab81183ddc54abaa6c67952c2e0273967de8d7a
Instruction Fuzzy Hash: BA518171608B0C4FE754EF68988A7AAB7E1F794301F104A3FE58AC3261DF78D8458742

Function 00007FF6CC9B14D4 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00007FF6CC9B153B

Part of subcall function 00007FF6CC9B10F0: VirtualAlloc.KERNELBASE ref: 00007FF6CC9B1143
Part of subcall function 00007FF6CC9B10F0: VirtualFree.KERNELBASE ref: 00007FF6CC9B13AB

VirtualAlloc.KERNELBASE ref: 00007FF6CC9B1599
VirtualProtect.KERNELBASE ref: 00007FF6CC9B1603
VirtualFree.KERNELBASE ref: 00007FF6CC9B1645

Strings

,, xrefs: 00007FF6CC9B157A

Memory Dump Source

Source File: 00000000.00000003.2072207134.00007FF6CC9B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6CC9B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_7ff6cc9b1000_SecuriteInfo.jbxd

Similarity

API ID: Virtual$Alloc$Free$Protect
String ID: ,
API String ID: 1004437363-3772416878
Opcode ID: 8a57ff5ef109ebab1fcadb133502250ce132c3a796e799e615fc61f91456b295
Instruction ID: 55e38c783d972db0a7026946bad2d7decf6d64eba447724a9a41c68096aa6c06
Opcode Fuzzy Hash: 8a57ff5ef109ebab1fcadb133502250ce132c3a796e799e615fc61f91456b295
Instruction Fuzzy Hash: 4E51A33061CB499BDB54EF1CD885679B7E1FB98351F14422EE88EC3246DE74E8428BC2

Function 0000028A000180A8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 0000028A00018191
FindCloseChangeNotification.KERNELBASE ref: 0000028A0001824A
??3@YAXPEAX@Z.MSVCRT ref: 0000028A00018266

Strings

,, xrefs: 0000028A00018109

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ??3@$ChangeCloseFindNotification
String ID: ,
API String ID: 3227463076-3772416878
Opcode ID: 5797dcfcb43276d353d1c4b34606bb2198c28a6318ae347a702950fb364732a2
Instruction ID: 638ada1c8f4f3ca2563f56c91e30b5082d03e354bd2dd1a8957c8e89faaa33ee
Opcode Fuzzy Hash: 5797dcfcb43276d353d1c4b34606bb2198c28a6318ae347a702950fb364732a2
Instruction Fuzzy Hash: 9851953460CB448FE755EF68D88A7EA77E5FB94310F14851EE449C3291DE78D942C782

Function 0000028A00017358 Relevance: 4.9, APIs: 3, Instructions: 392memoryfileCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 0000028A00017489
CreateFileMappingW.KERNELBASE ref: 0000028A000175FB
MapViewOfFile.KERNELBASE ref: 0000028A00017620

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: File$AllocateCreateHeapMappingView
String ID:
API String ID: 926293428-0
Opcode ID: 5fec29907ddb1701cf10de724f589e78f00012b775457189f3dd736ffc916fed
Instruction ID: f058bf220261dc98b0df4de3bc7ece997672ed96419a073d3bb479e8947b6087
Opcode Fuzzy Hash: 5fec29907ddb1701cf10de724f589e78f00012b775457189f3dd736ffc916fed
Instruction Fuzzy Hash: 58C1BC34619B084BFB59EF68D88A7DA77D1F794300F10862EE44EC3296EF38D5458786

Function 0000028A00016858 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 360COMMON

Download Yara Rule

Strings

NJI@, xrefs: 0000028A0001688F

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID: NJI@
API String ID: 0-1894075864
Opcode ID: b44a22c076ccd1acb9e2f8e5ba2d76a45960d7bbffd51b82d392d0dff46be180
Instruction ID: 71132004cb4874a7c9da975698eba984d0943557b1d683a89ed4fca674a5b9d0
Opcode Fuzzy Hash: b44a22c076ccd1acb9e2f8e5ba2d76a45960d7bbffd51b82d392d0dff46be180
Instruction Fuzzy Hash: 95E12D7051C7D48BD7759F2998953EBBBE0FB99701F10892EE4CA82291DF389501DB83

Function 0000028A00017748 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 0000028A00016F40: RegOpenKeyExW.KERNELBASE ref: 0000028A00016FC9
Part of subcall function 0000028A00016F40: RegCreateKeyExW.KERNELBASE ref: 0000028A00017001

FindCloseChangeNotification.KERNELBASE ref: 0000028A000178A0

Strings

!RHY, xrefs: 0000028A0001779B

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ChangeCloseCreateFindNotificationOpen
String ID: !RHY
API String ID: 2255866768-2095432132
Opcode ID: c545dde5e07c6fdd6486d446e1ae2076eb245cb8cfaea0d8e7e37b9c6cf897c6
Instruction ID: d346b3b36082dc65f3a28ac7b06ec73d6a83a759fd236694921fed684145f2a2
Opcode Fuzzy Hash: c545dde5e07c6fdd6486d446e1ae2076eb245cb8cfaea0d8e7e37b9c6cf897c6
Instruction Fuzzy Hash: 73715E3521DB498BF755EF24C49A7AAB7F1FBA5300F10891EE48AC2291DF24E945CB43

Function 0000028A000182F4 Relevance: 3.1, APIs: 2, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000028A0001B6B8: RtlAddFunctionTable.KERNEL32 ref: 0000028A0001B6E5

Part of subcall function 0000028A0001B6FC: RtlAllocateHeap.NTDLL ref: 0000028A0001B761
Part of subcall function 0000028A0001B6FC: VirtualFree.KERNELBASE(?,?,?,?,?,?,?,0000028A00018387), ref: 0000028A0001B794

SetErrorMode.KERNELBASE ref: 0000028A000183EC
VirtualProtect.KERNELBASE ref: 0000028A0001840A

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Virtual$AllocateErrorFreeFunctionHeapModeProtectTable
String ID:
API String ID: 1745504778-0
Opcode ID: b9fa2546218daecafac8371862f5133473872b13f594cfe74a88cb58fc4cacee
Instruction ID: b09e135afd0cb3d4096df5781523ec974b32d2cca6911cb47c628c663ed25ef7
Opcode Fuzzy Hash: b9fa2546218daecafac8371862f5133473872b13f594cfe74a88cb58fc4cacee
Instruction Fuzzy Hash: EB3176352199484BFB49FF68D89ABE973D5FBA4300F60851AF44AC7192DF2CDA418742

Function 0000028A0001B6FC Relevance: 3.1, APIs: 2, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 0000028A0001B761
VirtualFree.KERNELBASE(?,?,?,?,?,?,?,0000028A00018387), ref: 0000028A0001B794

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocateFreeHeapVirtual
String ID:
API String ID: 1178447867-0
Opcode ID: 1c01f51b02100d5787d3c740cd9cf9adac7cf30a888cb21a2aefd7a5d9ca2737
Instruction ID: c2ca301b9eff5e156b43e527bded82ecb2c3fe7d09ff4ca4065080221a6f671f
Opcode Fuzzy Hash: 1c01f51b02100d5787d3c740cd9cf9adac7cf30a888cb21a2aefd7a5d9ca2737
Instruction Fuzzy Hash: 98318534215A094FFB48EF19D499BB673E1FBA8341F11816AD81AC7296DF38D841CB41

Function 0000028A00014148 Relevance: 3.1, APIs: 2, Instructions: 69COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE ref: 0000028A0001417F
GetTokenInformation.KERNELBASE ref: 0000028A000141C0

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: f2a1e79b7b26677e822afdf5a4e6683d0756c7f32a7c3fa8149006c40cea31b1
Instruction ID: 60fb5b5dfce6e382aa66129b926f68515a3a7d273352b642d53e37b7b9c9f5eb
Opcode Fuzzy Hash: f2a1e79b7b26677e822afdf5a4e6683d0756c7f32a7c3fa8149006c40cea31b1
Instruction Fuzzy Hash: C411DA382096499FEB44DF64D8DCA6A77E2FB94305F104929E846C3270DF78ED44CB42

Function 00007FF6CC9B10F0 Relevance: 2.7, APIs: 2, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00007FF6CC9B1143
VirtualFree.KERNELBASE ref: 00007FF6CC9B13AB

Memory Dump Source

Source File: 00000000.00000003.2072207134.00007FF6CC9B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6CC9B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_7ff6cc9b1000_SecuriteInfo.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: abb3666d5f0e7e3691c5e241d5b349d303e7c196ced747a2022f8ae30c0d6593
Instruction ID: 74f48bcad1c15754cb8a59cd6177af9c8e738179854b5a1a3533213e7b3ce305
Opcode Fuzzy Hash: abb3666d5f0e7e3691c5e241d5b349d303e7c196ced747a2022f8ae30c0d6593
Instruction Fuzzy Hash: F191B17061C7819FD3A0CF18C495A2ABBF0FF89349F14092DF5CAC7692DA35E9419B06

Function 0000028A00014964 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

_calloc_dbg.MSVCRT ref: 0000028A00014989

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: _calloc_dbg
String ID:
API String ID: 1170608187-0
Opcode ID: 620f80c2b9699efe7816b714392ec837dbdb63c5ddafa07cbea2920cfd12994d
Instruction ID: 3df031a6918e2abab5807d93a8725ebee4cad13f9565e8d0d277ae59a1aea799
Opcode Fuzzy Hash: 620f80c2b9699efe7816b714392ec837dbdb63c5ddafa07cbea2920cfd12994d
Instruction Fuzzy Hash: 90314B24618D5907F72D4F3C186F3B27BC1E7EA321F29815EE99AC22D3DC1988478382

Function 0000028A00017B14 Relevance: 1.6, APIs: 1, Instructions: 111processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE ref: 0000028A00017C24

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c382783190e2699510103071945f14469c23df6a9e14ed2142866911cb1ccdc2
Instruction ID: 5f8c661ff187df46d936ad8f92276cecc4e1090871f4e918e7cded2dca4e6da3
Opcode Fuzzy Hash: c382783190e2699510103071945f14469c23df6a9e14ed2142866911cb1ccdc2
Instruction Fuzzy Hash: 4C318F71508F488FF765EF28D8497DAB7E1FBA4305F50492EA14AC3151DF788544CB82

Function 0000028A0001B808 Relevance: 1.5, APIs: 1, Instructions: 47libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0000028A0001B85F

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fd13a936f88e8be3d3c1b5e1ebd4b6078f4080b08cf0cb1db8c120c48f9afd6e
Instruction ID: 07cb694d937769f3227af709ecdce1714737be26924874e5670a89489ac0bb85
Opcode Fuzzy Hash: fd13a936f88e8be3d3c1b5e1ebd4b6078f4080b08cf0cb1db8c120c48f9afd6e
Instruction Fuzzy Hash: 83014425625A484BF754EB28948A7FA73D5F764305F60852AE48AC3191EF28C6448743

Function 0000028A0001B6B8 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 0000028A0001B6E5

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: bc689134c4cfe8144a64a4e0970b0539573de333fb4e1730050f8c92ab09a126
Instruction ID: c5452222f6bff5e93b4c28a37959d11e8051731daf9e21e3a229488b820d6603
Opcode Fuzzy Hash: bc689134c4cfe8144a64a4e0970b0539573de333fb4e1730050f8c92ab09a126
Instruction Fuzzy Hash: E5E012341118055BFB68DA1DC81D3A036D0E76830AF64816EA400C6291CF7DC497CF43

Function 0000028A00013BC8 Relevance: 1.3, APIs: 1, Instructions: 90stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNELBASE ref: 0000028A00013BF0

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 227dcba3b2cb73bb29811a929ed74bd779d041a6fbe6ede9585de0365d398b59
Instruction ID: a7e2e56246019968a2e24a905e37886ec15e8aa99282ccba41881f133f48b8dc
Opcode Fuzzy Hash: 227dcba3b2cb73bb29811a929ed74bd779d041a6fbe6ede9585de0365d398b59
Instruction Fuzzy Hash: A82188347129098FFBA6EF38AD4E3E536D1FBA4311F64C2669006C71A9EF388A048741

Non-executed Functions

Function 0000028A00015BC0 Relevance: 3.7, Strings: 2, Instructions: 1155COMMON

Download Yara Rule

Strings

,, xrefs: 0000028A00015EEC
,, xrefs: 0000028A00016448

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: InformationProcessQuery
String ID: ,$,
API String ID: 1778838933-220654547
Opcode ID: a0299abcad1f0eeb53ce8430316abf2ed11eb634f56fbeef89e460d6d348ee9f
Instruction ID: ddf848a5ac5b31880b79f41a40d34999c4a6ff6edc9d38891f4e753751a7d10b
Opcode Fuzzy Hash: a0299abcad1f0eeb53ce8430316abf2ed11eb634f56fbeef89e460d6d348ee9f
Instruction Fuzzy Hash: AE826534619B088FE758EF64D89A7DA77D1FBA8301F20852ED45AC3291DF38D945CB82

Function 00007FF6CC9B18D7 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

+Y0+, xrefs: 00007FF6CC9B199B

Memory Dump Source

Source File: 00000000.00000003.2072207134.00007FF6CC9B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00007FF6CC9B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_7ff6cc9b1000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: +Y0+
API String ID: 0-1189096879
Opcode ID: 700d9b7284bfbab16c442717931a76e877bd874bda736dc46fcea473d1972563
Instruction ID: e51e1d335bcef394721551d578479a4025017b87d9a1977bb03315fc7d8d194b
Opcode Fuzzy Hash: 700d9b7284bfbab16c442717931a76e877bd874bda736dc46fcea473d1972563
Instruction Fuzzy Hash: B531472580C6C69FDB2B4B3488691E1BFB0EF2732470D12EDC8C59F8A7CA146985C741

Function 0000028A00011500 Relevance: .7, Instructions: 737COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96607074e16f4868b5be774e877e5912d3aaae97ba57364b39b2a72336f57c8b
Instruction ID: e9cbca5ff23928a116e468eee26f5c3eb1e8be49bfe999d7fb0ec61f7329a709
Opcode Fuzzy Hash: 96607074e16f4868b5be774e877e5912d3aaae97ba57364b39b2a72336f57c8b
Instruction Fuzzy Hash: ED22143811A6558AFB2D8E6884AB3F13BC1EB66704F38925ECAE7871C3DD1D84078757

Function 0000028A00012F00 Relevance: .7, Instructions: 735COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7508843e0d615cd037e1ec8aa7846b8b8c4448116137d463d462d581942205d
Instruction ID: fc20377304a65c284ca8a3d75e2f328c32f8ba743a8923c0f3d729c5d58d0255
Opcode Fuzzy Hash: f7508843e0d615cd037e1ec8aa7846b8b8c4448116137d463d462d581942205d
Instruction Fuzzy Hash: 9312E41435982407FB1E592C999F3B832C2E3A5316F34923EDDC7C15CAEC28966386CB

Function 0000028A00023E95 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00022000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00022000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00022000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31879db383ebb8d5dde9c040e419a0f231d7ef384da0a7eea47c253b5ee4a878
Instruction ID: d6543940b97cd67a725e336c4c0e321e68156775ffa08ef46f63ddb98ba35db2
Opcode Fuzzy Hash: 31879db383ebb8d5dde9c040e419a0f231d7ef384da0a7eea47c253b5ee4a878
Instruction Fuzzy Hash: 3362689684E7C29FE7138B304CBA284BFB06E2320476D89DFC4C14B4E3E649955AD767

Function 0000028A00013CEC Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11f99f4912cc1f7b5290a762f61ca7177c15b4b468f00e92ea1a3a253ec1089c
Instruction ID: 893998cb53f1df72d400abd658dcafe9c29921c1571149b48d821347af420c0a
Opcode Fuzzy Hash: 11f99f4912cc1f7b5290a762f61ca7177c15b4b468f00e92ea1a3a253ec1089c
Instruction Fuzzy Hash: 4E919271A6C3444BD35CCE189C861BAB3D5F7C6215F14953EF9CBC3302EA35A9078A86

Function 0000028A0001870C Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a97ef2a92983f2fd7f4c0e136ef4c983bbffc174d00ebbc24951b3730f05a3cb
Instruction ID: b851d76b72030e81b40f54ca523d6d4643cd2e4c5bfd4670a5ba60f9a8f7129d
Opcode Fuzzy Hash: a97ef2a92983f2fd7f4c0e136ef4c983bbffc174d00ebbc24951b3730f05a3cb
Instruction Fuzzy Hash: 64A18FB26687448BD35CDE1CDC826A6B3D5FB8A319F14457DE4CBC3242DA34E8478A86

Function 0000028A0001710C Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef0da2dc336cb695c55fe7557c083638bce03003c3af981621f0897e44abfbe7
Instruction ID: 436c6ad6122b08e193fad3dbe9fca7074039046e163e302eaeb2bd6f38925a09
Opcode Fuzzy Hash: ef0da2dc336cb695c55fe7557c083638bce03003c3af981621f0897e44abfbe7
Instruction Fuzzy Hash: 1C612D3511DA484BF71AEB28845A7EA77D1F7A5300F64866EE48AC31C3DD698506C783

Function 0000028A00018A58 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 442b0520738e8f0b26db511281fac152362a0c0e853cfc2e2b038376264e2d07
Instruction ID: 28732057275ab7b3479c24b7c387cfa8f5d4ddf8c159dba22102d5268fc93f67
Opcode Fuzzy Hash: 442b0520738e8f0b26db511281fac152362a0c0e853cfc2e2b038376264e2d07
Instruction Fuzzy Hash: 7341D930715A494BEB49DF2C48C979477D1EBAA310B5482AAEC45CB287CD14D985C3D2

Function 0000028A00019FFC Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2074250320.0000028A00011000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000028A00011000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_28a00011000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b7480ddab4bcce6f18969b185a19d6807d5f220cd067d20dfcfaf6ebbcfae67
Instruction ID: de1404af39e3c6f90b48393609511b5b93ec1509a3771649ab854ce5ffac0aea
Opcode Fuzzy Hash: 6b7480ddab4bcce6f18969b185a19d6807d5f220cd067d20dfcfaf6ebbcfae67
Instruction Fuzzy Hash: D8418D1521EAC59EC70ACF6C4490095FFB0EBAA100B0C83DEE8D9CB747C504E65AC7B6

Analysis Process: OpenWith.exePID: 6468, Parent PID: 5308COMMON

Executed Functions

Function 000001696C6E30C7 Relevance: 10.9, APIs: 7, Instructions: 390memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 000001696C6E3810
RtlAllocateHeap.NTDLL ref: 000001696C6E386D
NtAllocateVirtualMemory.NTDLL ref: 000001696C6E3957
NtProtectVirtualMemory.NTDLL ref: 000001696C6E39E4
NtProtectVirtualMemory.NTDLL ref: 000001696C6E3AA3
RtlDeleteBoundaryDescriptor.NTDLL ref: 000001696C6E3AC0
RtlDeleteBoundaryDescriptor.NTDLL ref: 000001696C6E3AD2

Memory Dump Source

Source File: 00000002.00000003.2134124718.000001696C6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001696C6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_1696c6e0000_OpenWith.jbxd

Similarity

API ID: AllocateMemoryVirtual$BoundaryDeleteDescriptorHeapProtect
String ID:
API String ID: 4057188902-0
Opcode ID: a9fd694707c269641c72358b47429bb5f77c7a1edad2659c0ecf870e01028855
Instruction ID: b4ed8529be2e7a5554502a16abe1669e835fb195043dbac52f7898cfab9a2c3c
Opcode Fuzzy Hash: a9fd694707c269641c72358b47429bb5f77c7a1edad2659c0ecf870e01028855
Instruction Fuzzy Hash: B8C1973061CB498FDB58EF18C885BA9B7E5FB98310F40452EF48AC7256DB35E885C785

Function 000001696AC504E0 Relevance: 10.8, APIs: 7, Instructions: 252memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001696AC5054E

Part of subcall function 000001696AC500FC: VirtualAlloc.KERNEL32 ref: 000001696AC5014F
Part of subcall function 000001696AC500FC: VirtualFree.KERNELBASE ref: 000001696AC503B7

VirtualAlloc.KERNEL32 ref: 000001696AC505AD
VirtualProtect.KERNEL32 ref: 000001696AC50626
VirtualFree.KERNELBASE ref: 000001696AC5064D
MapViewOfFile.KERNEL32 ref: 000001696AC50686
VirtualAlloc.KERNEL32 ref: 000001696AC506B4
FindCloseChangeNotification.KERNEL32 ref: 000001696AC506E1

Memory Dump Source

Source File: 00000002.00000003.2074477349.000001696AC50000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001696AC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_1696ac50000_OpenWith.jbxd

Similarity

API ID: Virtual$Alloc$Free$ChangeCloseFileFindNotificationProtectView
String ID:
API String ID: 2870039258-0
Opcode ID: ff9d2ba7a0c9f70c7bdc5bf2a784896198b97f8e626e79ac36cfea1478692e2c
Instruction ID: 2717fa822c00dd667de56739a3481c77cbceec9ce5bfaf31b19391cf370a50c5
Opcode Fuzzy Hash: ff9d2ba7a0c9f70c7bdc5bf2a784896198b97f8e626e79ac36cfea1478692e2c
Instruction Fuzzy Hash: 4C717431618B095FDB58AB29DC857AAB3D5FB94315F10452DF88BC3282DE38E85287C1

Function 000001696C6E33B0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 344memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 000001696C6E3527
RtlAllocateHeap.NTDLL ref: 000001696C6E367A
RtlDeleteBoundaryDescriptor.NTDLL ref: 000001696C6E36F9

Strings

l, xrefs: 000001696C6E33D6

Memory Dump Source

Source File: 00000002.00000003.2134124718.000001696C6E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001696C6E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_1696c6e0000_OpenWith.jbxd

Similarity

API ID: AllocateHeap$BoundaryDeleteDescriptor
String ID: l
API String ID: 2279964584-2517025534
Opcode ID: e41b5771679d7fa1d24798423fff3f792628284bc932efa5f746d48606e4ab4c
Instruction ID: c8b813be1adf8c0411d8cd3786dd2492cd621f96d801d7656ed3b28b5cebe91f
Opcode Fuzzy Hash: e41b5771679d7fa1d24798423fff3f792628284bc932efa5f746d48606e4ab4c
Instruction Fuzzy Hash: 9EA1133191C7998BD729AA28CC816FA77D5FB99300F90066FF4CBC3183D936D9478685

Function 000001696AC500FC Relevance: 2.7, APIs: 2, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 000001696AC5014F
VirtualFree.KERNELBASE ref: 000001696AC503B7

Memory Dump Source

Source File: 00000002.00000003.2074477349.000001696AC50000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001696AC50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_1696ac50000_OpenWith.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: abb3666d5f0e7e3691c5e241d5b349d303e7c196ced747a2022f8ae30c0d6593
Instruction ID: 6e0f355923d7c87f67369fb761ed92ef4b2a33f03b177378b970960a47d271be
Opcode Fuzzy Hash: abb3666d5f0e7e3691c5e241d5b349d303e7c196ced747a2022f8ae30c0d6593
Instruction Fuzzy Hash: C5919E706187808FE7A0CB19C881B6ABBF0FB99308F54096DF5CAC7291D77AD951DB06

Analysis Process: wmplayer.exePID: 6844, Parent PID: 6468COMMON

Execution Graph

Execution Coverage:	5.2%
Dynamic/Decrypted Code Coverage:	15.4%
Signature Coverage:	5.2%
Total number of Nodes:	286
Total number of Limit Nodes:	23

Executed Functions

Function 00007DF41D0D1958 Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 337nativememoryCOMMON

Download Yara Rule

APIs

_calloc_dbg.MSVCRT ref: 00007DF41D0D199B
NtAllocateVirtualMemory.NTDLL ref: 00007DF41D0D1A3A
NtWriteVirtualMemory.NTDLL ref: 00007DF41D0D1A88
NtQueryInformationProcess.NTDLL ref: 00007DF41D0D1AB0
NtReadVirtualMemory.NTDLL ref: 00007DF41D0D1AE0
NtReadVirtualMemory.NTDLL ref: 00007DF41D0D1B13
NtReadVirtualMemory.NTDLL ref: 00007DF41D0D1B42
NtReadVirtualMemory.NTDLL ref: 00007DF41D0D1B76
NtProtectVirtualMemory.NTDLL ref: 00007DF41D0D1BBD
NtProtectVirtualMemory.NTDLL ref: 00007DF41D0D1C44
NtWriteVirtualMemory.NTDLL ref: 00007DF41D0D1C69
NtProtectVirtualMemory.NTDLL ref: 00007DF41D0D1C8D

Strings

H, xrefs: 00007DF41D0D1BF2
H, xrefs: 00007DF41D0D1C15

Memory Dump Source

Source File: 00000004.00000003.2323060245.00007DF41D0D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_7df41d0d1000_wmplayer.jbxd

Similarity

API ID: MemoryVirtual$Read$Protect$Write$AllocateInformationProcessQuery_calloc_dbg
String ID: H$H
API String ID: 3959100322-136785262
Opcode ID: 8b723a4ddad616be20f9dda8abf44bc9042e1d61a48c0cd72079f3722cd3507a
Instruction ID: e05b94611a84f7321f16156ed0ac3801e42c2be5721797a6375ce314adb9d987
Opcode Fuzzy Hash: 8b723a4ddad616be20f9dda8abf44bc9042e1d61a48c0cd72079f3722cd3507a
Instruction Fuzzy Hash: D9B160B060CF888BD764DF18D885A9ABBF5FBD4305F100A2EE58FC3251DA34E5458B96

Function 000001E29B442D24 Relevance: 17.0, APIs: 2, Strings: 7, Instructions: 1263
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFormatCurrentUserKeyPath.NTDLL ref: 000001E29B44386B
_calloc_dbg.MSVCRT ref: 000001E29B4439C1

Strings

MZ, xrefs: 000001E29B443971
N, xrefs: 000001E29B443A58
MZ, xrefs: 000001E29B443583
t, xrefs: 000001E29B443A60
;Ln, xrefs: 000001E29B4431B4
;$dW, xrefs: 000001E29B44352D
;$dW, xrefs: 000001E29B443D1C

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: CurrentFormatPathUser_calloc_dbg
String ID: ;$dW$;$dW$MZ$MZ$N$t$;Ln
API String ID: 2292065830-84560671
Opcode ID: 1512b8534d4c685afcc9061355cc33150ae67fa718ee72ec55426bd84ba67b64
Instruction ID: b849f32737600b2219045ddec31f10844276b69db82adcd059d5f823aa8b766e
Opcode Fuzzy Hash: 1512b8534d4c685afcc9061355cc33150ae67fa718ee72ec55426bd84ba67b64
Instruction Fuzzy Hash: C3A2ADB0518B988FD7B5DF18D8943EAB7E4FB99701F501A2ED88EC3252DB709540CB86

Function 00007DF41D0D1CE8 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 296processnativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00007DF41D0D1290: RtlAddFunctionTable.KERNEL32 ref: 00007DF41D0D12BD

Part of subcall function 00007DF41D0D12C8: VirtualProtect.KERNELBASE ref: 00007DF41D0D12F5

Part of subcall function 00007DF41D0D1438: RegOpenKeyExW.KERNELBASE ref: 00007DF41D0D1497
Part of subcall function 00007DF41D0D1438: RegQueryValueExW.KERNELBASE ref: 00007DF41D0D14E6
Part of subcall function 00007DF41D0D1438: RegCloseKey.KERNELBASE ref: 00007DF41D0D150C
Part of subcall function 00007DF41D0D1438: GetVolumeInformationW.KERNELBASE ref: 00007DF41D0D1570

_calloc_dbg.MSVCRT ref: 00007DF41D0D1DE3
CreateProcessW.KERNELBASE ref: 00007DF41D0D1F80
NtResumeThread.NTDLL ref: 00007DF41D0D1FA5
FindCloseChangeNotification.KERNELBASE ref: 00007DF41D0D1FBF
??3@YAXPEAX@Z.MSVCRT ref: 00007DF41D0D1FDC

Strings

-, xrefs: 00007DF41D0D1E95

Memory Dump Source

Source File: 00000004.00000003.2323060245.00007DF41D0D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_7df41d0d1000_wmplayer.jbxd

Similarity

API ID: Close$??3@ChangeCreateFindFunctionInformationNotificationOpenProcessProtectQueryResumeTableThreadValueVirtualVolume_calloc_dbg
String ID: -
API String ID: 3202447450-2547889144
Opcode ID: 105c85825427e7c8ed203293b96c467a96f9bba36c05be2648f83f100e5bc7da
Instruction ID: daf2d4e2cd6e88107e7f6122757b471e5278213853ac862daa8f00197b4d1e8f
Opcode Fuzzy Hash: 105c85825427e7c8ed203293b96c467a96f9bba36c05be2648f83f100e5bc7da
Instruction Fuzzy Hash: 3F9191B0A0CE894FEB54EB65D8946AB77F1FF94305F20462BE54BC2191DF78E8018792

Function 000001E29B541F40 Relevance: 7.9, APIs: 5, Instructions: 426memorythreadCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 000001E29B54234A
RtlAllocateHeap.NTDLL ref: 000001E29B5424ED
RtlDeleteBoundaryDescriptor.NTDLL ref: 000001E29B542572
VirtualFree.KERNELBASE ref: 000001E29B5426C4
RtlRestoreThreadPreferredUILanguages.NTDLL ref: 000001E29B5426ED

Memory Dump Source

Source File: 00000004.00000003.2331860023.000001E29B540000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001E29B530000, based on PE: true

Associated: 00000004.00000003.2290917522.000001E29B530000.00000004.00000800.00020000.00000000.sdmpDownload File
Associated: 00000004.00000003.2291244045.000001E29B530000.00000004.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_1e29b530000_wmplayer.jbxd

Similarity

API ID: AllocateHeap$BoundaryDeleteDescriptorFreeLanguagesPreferredRestoreThreadVirtual
String ID:
API String ID: 1657951989-0
Opcode ID: 4a31878d395c09715c277c8a646cf8155ab96e1fd1f79bed96d174791fc66f4e
Instruction ID: 7d7489cbc94cfe749c6dd2211d3b3760b0a38ee5302e877397d49b79a035ed80
Opcode Fuzzy Hash: 4a31878d395c09715c277c8a646cf8155ab96e1fd1f79bed96d174791fc66f4e
Instruction Fuzzy Hash: E0023F726246F086D7248F69D0607AE7BE6F384788F849012DF9F83749DE3AC945CB50

Function 000001E29B43CDF4 Relevance: 4.6, APIs: 3, Instructions: 110
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateNamedPipeW.KERNELBASE ref: 000001E29B43CEA7
BindIoCompletionCallback.KERNEL32 ref: 000001E29B43CEDE
ConnectNamedPipe.KERNELBASE ref: 000001E29B43CEEF

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: NamedPipe$BindCallbackCompletionConnectCreate
String ID:
API String ID: 2502124517-0
Opcode ID: 1f39a579d535edce93b33f8ad890ac1eeea552d42be0d6d7d28d92d913c1a808
Instruction ID: 6042163122f4a2d195619e03735dfa7aafa68ca97971c247276b065da444e2d0
Opcode Fuzzy Hash: 1f39a579d535edce93b33f8ad890ac1eeea552d42be0d6d7d28d92d913c1a808
Instruction Fuzzy Hash: 8A31B130208A488FEB95EF28D8A8B9A77E9FB88314F505629D45BC21D2DF34C945DB81

Function 00007DF41D0E2704 Relevance: 4.5, APIs: 3, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00007DF41D0E2715
_malloc_dbg.MSVCRT ref: 00007DF41D0E2731
NtQuerySystemInformation.NTDLL ref: 00007DF41D0E2755

Memory Dump Source

Source File: 00000004.00000002.3278269568.00007DF41D0E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df41d0e1000_wmplayer.jbxd

Similarity

API ID: InformationQuerySystem$_malloc_dbg
String ID:
API String ID: 1031377829-0
Opcode ID: eaf85d99e703aa885d9be82610ad3d8d03a394a4204a017367fdf17adc8f3dbe
Instruction ID: cc8b0d67351fa60ed3f6b55a8302cbc7fe56461463256a4806d6415f536bd40d
Opcode Fuzzy Hash: eaf85d99e703aa885d9be82610ad3d8d03a394a4204a017367fdf17adc8f3dbe
Instruction Fuzzy Hash: 89013C70B199498FE789EF24DCA8BA677F1FB94305F540129E44BC21A0DF38D945CB42

Function 000001E29B442C64 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0, xrefs: 000001E29B442CBC

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f6b0f352e34b93935ac2a1f97fa2b0892be8d0a68ee0d9962c8f94757f801c03
Instruction ID: a507fd007676cc8cae9a88247277508c1263f5dea6a97a0020543b83970d4a05
Opcode Fuzzy Hash: f6b0f352e34b93935ac2a1f97fa2b0892be8d0a68ee0d9962c8f94757f801c03
Instruction Fuzzy Hash: 4021F3703149984FE7509E98C8E43BE72D5F798306FA0253EE90FC3291DB3488589749

Function 000001E29B432628 Relevance: 3.3, APIs: 2, Instructions: 293
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 000001E29B43272E
SuspendThread.KERNELBASE ref: 000001E29B432770

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: ChangeCloseFindNotificationSuspendThread
String ID:
API String ID: 186804629-0
Opcode ID: ee0b4b29cbf429cf193f7da3647d56e0b1a845656fd74a12addcfb7ee39e090b
Instruction ID: 2b4c6cd9a9365f9a3c7f5e60562d4ff7c131450ccf555f7ec7ef507d09bfa3b8
Opcode Fuzzy Hash: ee0b4b29cbf429cf193f7da3647d56e0b1a845656fd74a12addcfb7ee39e090b
Instruction Fuzzy Hash: F7913430208A658BEB6C9B58E9703BD73D4FB45358F98625DD88BC7182CF35D842DB89

Function 00007DF41D0D22CC Relevance: 2.0, APIs: 1, Instructions: 450timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00007DF41D0D1290: RtlAddFunctionTable.KERNEL32 ref: 00007DF41D0D12BD

Part of subcall function 00007DF41D0D12C8: VirtualProtect.KERNELBASE ref: 00007DF41D0D12F5

SetTimer.USER32 ref: 00007DF41D0D2762

Memory Dump Source

Source File: 00000004.00000002.3278193797.00007DF41D0D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df41d0d1000_wmplayer.jbxd

Similarity

API ID: FunctionProtectTableTimerVirtual
String ID:
API String ID: 2248422592-0
Opcode ID: 907297c01f2e853a7e6e6be3efaf92a15819b9f7a160a726e89f0d05781fa5e1
Instruction ID: b3092d9eeeb447d0b966947405a5bd34822b7beddca970e3b76e09bbc1473f99
Opcode Fuzzy Hash: 907297c01f2e853a7e6e6be3efaf92a15819b9f7a160a726e89f0d05781fa5e1
Instruction Fuzzy Hash: B7E16170A08E494FEB65EF28D8885AA7BF1FF98314F24462FD44BC3191DB38E9458B51

Function 000001E29B43C25C Relevance: 1.8, APIs: 1, Instructions: 560memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000001E29B43C65C

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1463b6e579e83794cd598155eb9e3160b38bf0e3bcb0f61670329aaf0c67c5a2
Instruction ID: fa8da3a00a5e4d8e80a3298afa421240aa41e4f512246101befbb19dfd0705b4
Opcode Fuzzy Hash: 1463b6e579e83794cd598155eb9e3160b38bf0e3bcb0f61670329aaf0c67c5a2
Instruction Fuzzy Hash: 6DF14A3065C6B80EE72C9B2CE8A52BD77D5F785305F28226ED8DBC2183DE34C5468B85

Function 000001E29B4429D4 Relevance: 1.8, APIs: 1, Instructions: 260nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001E29B442A94

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: f13696e1930880e2e19ebf6412232386b6a4ab7a0f564d2111b2459b68bcc0da
Instruction ID: 17b88742350d486079db0d6e7c397b7417a3618999c5b19fef62aa4963d9b10c
Opcode Fuzzy Hash: f13696e1930880e2e19ebf6412232386b6a4ab7a0f564d2111b2459b68bcc0da
Instruction Fuzzy Hash: 8D81D330228B998BE7759E94C4757AEB3DAFB94308F90751DDC4BC3282EFB0D8149649

Function 000001E29B4427B8 Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001E29B442807

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: d9381645012d00cf6e7f8dfe8da443d67e907387f0873f85681973196ff3555c
Instruction ID: 615797678c8efcae3641a6cc8834b3abe48c3f79fd90ad86c7774db41331cf47
Opcode Fuzzy Hash: d9381645012d00cf6e7f8dfe8da443d67e907387f0873f85681973196ff3555c
Instruction Fuzzy Hash: 43F0DA74A28B948FDB64EF2CD489B9E77E1FB99305F904519E84CC3246DB34D8448B86

Function 000001E29B442990 Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001E29B4429BA

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 98d03459468cdcd74854b97b597847e55f0ea75636d4913b4c299d0c762e3800
Instruction ID: f5af2a1aebe7f0bd4e9b9654dbb10f9361d50bb51886395135b7b5bc82dc8120
Opcode Fuzzy Hash: 98d03459468cdcd74854b97b597847e55f0ea75636d4913b4c299d0c762e3800
Instruction Fuzzy Hash: 3BE02270218A088FDB00DF98CCC09ADB3F4F7D8304F400D2AEC8BCA020C360D658CA82

Function 000001E29B4428B8 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001E29B4428D9

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: bd75e34d41d0a0c218f00c4b384fa59cf13494ae4b0fc6bee219bc2a66024f0a
Instruction ID: 183293b30f7e4859076e55a16dc629404fbd66b7e1ba419e4ae3de2e8a3cf8c7
Opcode Fuzzy Hash: bd75e34d41d0a0c218f00c4b384fa59cf13494ae4b0fc6bee219bc2a66024f0a
Instruction Fuzzy Hash: 7AD01234D687858BDA50AB68C85060D7BE1BBD9318FA45618E889C3315E738D4519786

Function 000001E29B44288C Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001E29B4428A7

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 1d483c746a178fd7cebb358bd60c8d391381be698edd62c71eedc0381d53c554
Instruction ID: 4ed8afb1dbaeb4c3a238458edc82bc241f51a8957a882233a7815b5cd168d495
Opcode Fuzzy Hash: 1d483c746a178fd7cebb358bd60c8d391381be698edd62c71eedc0381d53c554
Instruction Fuzzy Hash: 57D05E34A28B894BEA10A768895030D36D2F7D5308F905608E84DC2255DA3DD41052C6

Function 000001E29B44252C Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001E29B44254D

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 27a0ab9b8b81d19b55a36d5b88940b5d877d47714e961321c564cf766a84aa8c
Instruction ID: 5b369e03a984e2ab318f046660031548c819dac77f8784041f05f1ce5a254f21
Opcode Fuzzy Hash: 27a0ab9b8b81d19b55a36d5b88940b5d877d47714e961321c564cf766a84aa8c
Instruction Fuzzy Hash: 2ED01234A287858BD710AB68C9516097BE1B7C9358F945618EC4D83315E738D491868A

Function 000001E29B4428E8 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL(?,?,?,?,?,?,?,?,?,000001E29B43531B), ref: 000001E29B4428F8

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 14fbc5d4ea2d13eb613c5f0cfb1986910ad3174e43fd425e2ce4bb45159b65c3
Instruction ID: 530152ca07fc9227a011aae297254657650fed84382bb2eb6204d5eef1770147
Opcode Fuzzy Hash: 14fbc5d4ea2d13eb613c5f0cfb1986910ad3174e43fd425e2ce4bb45159b65c3
Instruction Fuzzy Hash: C8C08C20628D0E0AE900A2E98CA174C22D4B749308FC02000DC0AC2181EE1CD5E0639A

Function 000001E29B442418 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 000001E29B442428

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 2134b33d09b848e70ba1f23de37cfdd97cd4e92c7083e33fbb9b34bfa8345c36
Instruction ID: ef77e976ec8442b8895f555f35b4e1a606341a2667f061d948fbe80ab5998c7d
Opcode Fuzzy Hash: 2134b33d09b848e70ba1f23de37cfdd97cd4e92c7083e33fbb9b34bfa8345c36
Instruction Fuzzy Hash: 19C08C24B2482B0AE91562FACCA074D20C4EB8A388FC02400EC0EC2180FE1CC8E053AA

Function 000001E29B447DA0 Relevance: 7.6, APIs: 5, Instructions: 130
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 000001E29B447DA9
WSAStartup.WS2_32 ref: 000001E29B44B1DC
socket.WS2_32 ref: 000001E29B44B24B
getsockopt.WS2_32 ref: 000001E29B44B27F
socket.WS2_32 ref: 000001E29B44B2B4

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: socket$ErrorModeStartupgetsockopt
String ID:
API String ID: 2955919026-0
Opcode ID: 3bad8950bc8ed42d49e75fcab8a12e6def80f6fb96da2e8da31b13afe45452c3
Instruction ID: b91114181ae97aa7cd2a16322e5334d674619f0a396ea627a1c906a8495e4a9c
Opcode Fuzzy Hash: 3bad8950bc8ed42d49e75fcab8a12e6def80f6fb96da2e8da31b13afe45452c3
Instruction Fuzzy Hash: EA41BA306087498FE755DF29D8986AA77E6FB98300F50563DE44BC33A2DF388515DB41

Function 00007DF41D0D1438 Relevance: 6.1, APIs: 4, Instructions: 134registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE ref: 00007DF41D0D1497
RegQueryValueExW.KERNELBASE ref: 00007DF41D0D14E6
RegCloseKey.KERNELBASE ref: 00007DF41D0D150C
GetVolumeInformationW.KERNELBASE ref: 00007DF41D0D1570

Memory Dump Source

Source File: 00000004.00000003.2323060245.00007DF41D0D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_7df41d0d1000_wmplayer.jbxd

Similarity

API ID: CloseInformationOpenQueryValueVolume
String ID:
API String ID: 4069062851-0
Opcode ID: 3ebb744f0aebbecadcf06631c3d65907a1788fb7df7ced3004579ef494ef68f9
Instruction ID: 7a3cc73cc9993ba1a4126fc24f069d193f32f6948f3052ad59ebb578f808104b
Opcode Fuzzy Hash: 3ebb744f0aebbecadcf06631c3d65907a1788fb7df7ced3004579ef494ef68f9
Instruction Fuzzy Hash: D241197051CE488BE755EB24C899BDBB7F1FB94305F104A2EE48BC2191EF78E5048B52

Function 000001E29B43DFC4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000001E29B43E047
VirtualProtect.KERNELBASE ref: 000001E29B43E070

Strings

rE\, xrefs: 000001E29B43DFDC

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: ProtectVirtual
String ID: rE\
API String ID: 544645111-988334199
Opcode ID: fd197d1d460a7a7097ebc69198cfe8898b84731961e3c45740b5833891c72836
Instruction ID: db0e24ae51f308d02b0fbe4d8b0e1c3df1b71e1880fa68431fad1e7f72870deb
Opcode Fuzzy Hash: fd197d1d460a7a7097ebc69198cfe8898b84731961e3c45740b5833891c72836
Instruction Fuzzy Hash: 5E1190313049490BEB45FB58E9A1BED72AAF7D8304F942529E80BC3286EF38D9459745

Function 000001E29B43BBF0 Relevance: 4.6, APIs: 3, Instructions: 110
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenFileMappingW.KERNELBASE ref: 000001E29B43BC4C
MapViewOfFile.KERNELBASE ref: 000001E29B43BC6E
FindCloseChangeNotification.KERNELBASE ref: 000001E29B43BCE6

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: File$ChangeCloseFindMappingNotificationOpenView
String ID:
API String ID: 1008110341-0
Opcode ID: 8bb8605ac1c349b7ed951fd2da0efd1c73228fe5391c7a5f19e2fcd3618d3200
Instruction ID: 4c4fc0134233acb62469ed362687f484d48982d9a83853ad9875b5dc59a5c062
Opcode Fuzzy Hash: 8bb8605ac1c349b7ed951fd2da0efd1c73228fe5391c7a5f19e2fcd3618d3200
Instruction Fuzzy Hash: D231A4316149488FDB95FF24E8A66EEB3D9FB94305F94652EE84BC3182DF30D9098781

Function 000001E29B43B9D8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32 ref: 000001E29B43BB1F

Strings

P, xrefs: 000001E29B43BA46

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: CreateWindow
String ID: P
API String ID: 716092398-3110715001
Opcode ID: 3958d680dd61ed40200acf61cd907bfc270c34c5250da5fbb8d7e78c828db693
Instruction ID: c7ae5b954f3cf3c56ef52a556d3b1eeee35fed7c2ca82a30c2a6abc4b4f9b6b7
Opcode Fuzzy Hash: 3958d680dd61ed40200acf61cd907bfc270c34c5250da5fbb8d7e78c828db693
Instruction Fuzzy Hash: 0A516D70518B448FE7A5EF28E89679AB7E4FB99300F104A2EE48EC2251DF349545CB83

Function 00007DF41D0E3018 Relevance: 3.3, APIs: 2, Instructions: 297
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007DF41D0E1708: RtlAddFunctionTable.KERNEL32 ref: 00007DF41D0E1735

Part of subcall function 00007DF41D0E1740: VirtualProtect.KERNELBASE ref: 00007DF41D0E176D

_calloc_dbg.MSVCRT ref: 00007DF41D0E313A
SendMessageA.USER32 ref: 00007DF41D0E31FB

Memory Dump Source

Source File: 00000004.00000002.3278269568.00007DF41D0E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df41d0e1000_wmplayer.jbxd

Similarity

API ID: FunctionMessageProtectSendTableVirtual_calloc_dbg
String ID:
API String ID: 963881631-0
Opcode ID: 06791c2761ba3497e0c9077ab5921302019734c58a86a701aa2be8a22ea6a1e2
Instruction ID: ed207a9f5e1c9505ef11d12ff55c2dd20b030385c32356a7023f446d7c64123e
Opcode Fuzzy Hash: 06791c2761ba3497e0c9077ab5921302019734c58a86a701aa2be8a22ea6a1e2
Instruction Fuzzy Hash: 8191B671B0CE485FEB59EF28D4955AA7BF2FB54305B204A7ED08BC3191DA38E841C791

Function 000001E29B4322D0 Relevance: 3.2, APIs: 2, Instructions: 222
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 000001E29B4322E8
VirtualAlloc.KERNELBASE ref: 000001E29B4323B4

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: 9420d4d47bb5eb7f06d7fea4bf54311970c83033f74d5905fb72208c54926d5e
Instruction ID: 30e8200497711e01457391880b8a3d54b2b63c06d07302b6bf4a7526b03f2855
Opcode Fuzzy Hash: 9420d4d47bb5eb7f06d7fea4bf54311970c83033f74d5905fb72208c54926d5e
Instruction Fuzzy Hash: C2514930218E6D4FF795EBACE5683AD72D5F7A8344F986029D84AC3192EF74C8818785

Function 000001E29B43D594 Relevance: 3.1, APIs: 2, Instructions: 132
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNELBASE ref: 000001E29B43D5D8
FindCloseChangeNotification.KERNELBASE ref: 000001E29B43D62C

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: ChangeCloseFileFindNotificationView
String ID:
API String ID: 556135526-0
Opcode ID: f5e4ace49f8dbf4d208ab68c6c07d1c08f373a7b01313fe5be4b999b6ef0fbb6
Instruction ID: ee3c709ea2c58631b8978d2a92e3a4de070b8a490f39abd0ba41fc76a2716b71
Opcode Fuzzy Hash: f5e4ace49f8dbf4d208ab68c6c07d1c08f373a7b01313fe5be4b999b6ef0fbb6
Instruction Fuzzy Hash: C641C3302049584FEB46FF28E9B46AE73E8FB95318F452519D80BC3196DF34D8409B85

Function 000001E29B432974 Relevance: 3.1, APIs: 2, Instructions: 97
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 000001E29B4329B3
VirtualProtect.KERNELBASE ref: 000001E29B432A19

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9af94119fb7637b7a971dd9e5dfe6689dbe62cc4b897151fb24c5dcbfab40a36
Instruction ID: fcbaf6460d7f81f959690eae0337299f247bbe746b54d35b88e9792dc81dcf59
Opcode Fuzzy Hash: 9af94119fb7637b7a971dd9e5dfe6689dbe62cc4b897151fb24c5dcbfab40a36
Instruction Fuzzy Hash: 9A312B3030CA954BEB149B6CE9B47993BD4FB5A318F591295EC8AC72C6DB68C802C356

Function 00007DF41D0E1740 Relevance: 3.1, APIs: 2, Instructions: 90
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007DF41D0E176D
VirtualProtect.KERNELBASE ref: 00007DF41D0E17F6

Memory Dump Source

Source File: 00000004.00000002.3278269568.00007DF41D0E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df41d0e1000_wmplayer.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 555ee51bdfbe110a30625e9d65cd405c650e6e50b938efdbc78372c29de57681
Instruction ID: 70a22d32e84b5c3ecf2b172975b17b4fe4627ee81a29ed059f2c2b01b7ccfa91
Opcode Fuzzy Hash: 555ee51bdfbe110a30625e9d65cd405c650e6e50b938efdbc78372c29de57681
Instruction Fuzzy Hash: E121F6B1F0895547D7189B2C84446B7BBF1FFA4B04F24422AE48BC7184D668E841C2A2

Function 00007DF41D0A1D6C Relevance: 3.1, APIs: 2, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007DF41D0A1D99
VirtualProtect.KERNELBASE ref: 00007DF41D0A1E22

Memory Dump Source

Source File: 00000004.00000003.2331797233.00007DF41D0A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_7df41d0a1000_wmplayer.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 53d1f5fc2553b1aed198646ddb2b775e91b1462906af7418210f7ec683df6e8f
Instruction ID: abf842261269b15e1815d61440d5897f2a3a84ce6910e3e62c909de3f2274be6
Opcode Fuzzy Hash: 53d1f5fc2553b1aed198646ddb2b775e91b1462906af7418210f7ec683df6e8f
Instruction Fuzzy Hash: 1B21E5B1E0894547EB18CA28D894676BBF5FF94384F24472AE44FC7285C778ED018266

Function 00007DF41D0D12C8 Relevance: 3.1, APIs: 2, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007DF41D0D12F5
VirtualProtect.KERNELBASE ref: 00007DF41D0D137E

Memory Dump Source

Source File: 00000004.00000003.2323060245.00007DF41D0D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_7df41d0d1000_wmplayer.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 89563af4fe1d572c43706a2c5b782feb3df9d02bfd1ff06021ce1d81ad062eb6
Instruction ID: 12244d077d37052e064529737148aab4365bd13c906dfe2b6a53ed0ef78ff926
Opcode Fuzzy Hash: 89563af4fe1d572c43706a2c5b782feb3df9d02bfd1ff06021ce1d81ad062eb6
Instruction Fuzzy Hash: 8A21F7B1E08E8547EB18DB6CD444676BBF1FF94304F24433BE84BC7A85DA68F8018266

Function 00007DF41D0D12C8 Relevance: 3.1, APIs: 2, Instructions: 90
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007DF41D0D12F5
VirtualProtect.KERNELBASE ref: 00007DF41D0D137E

Memory Dump Source

Source File: 00000004.00000002.3278193797.00007DF41D0D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df41d0d1000_wmplayer.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: aa55061d99e775b82e27cc6da46f8fa59da2ee6fc95db4891e67f0932caa2168
Instruction ID: 6a49a294585e56f2e629ac8aa24904893f322e5a3c4e7ac18e34553c53a6d87e
Opcode Fuzzy Hash: aa55061d99e775b82e27cc6da46f8fa59da2ee6fc95db4891e67f0932caa2168
Instruction Fuzzy Hash: E421F7B1E08D8547EB18DB6CD444676BBF1FF94304F24023BE84BC7A85DA68E8018266

Function 00007DF41D0A4464 Relevance: 1.8, APIs: 1, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF41D0A1D34: RtlAddFunctionTable.KERNEL32 ref: 00007DF41D0A1D61

Part of subcall function 00007DF41D0A1D6C: VirtualProtect.KERNELBASE ref: 00007DF41D0A1D99

_calloc_dbg.MSVCRT ref: 00007DF41D0A4549

Memory Dump Source

Source File: 00000004.00000003.2331797233.00007DF41D0A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_7df41d0a1000_wmplayer.jbxd

Similarity

API ID: FunctionProtectTableVirtual_calloc_dbg
String ID:
API String ID: 343637562-0
Opcode ID: 8f131b3f7a0fe3efe94bcf360181135b30d73787cc5bce35fad1c891b4eeab41
Instruction ID: 9cf39fb45baec8da0a3b6132af71f4e8d4d293002f60639166ff67fff6de7fa3
Opcode Fuzzy Hash: 8f131b3f7a0fe3efe94bcf360181135b30d73787cc5bce35fad1c891b4eeab41
Instruction Fuzzy Hash: 2181B470A18E494FEB55EF2888956A67BF1FF94304B25462EC48FC3191DF38E8058792

Function 000001E29B43C784 Relevance: 1.8, APIs: 1, Instructions: 272COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 000001E29B43C9BF

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 59198f789e8770a8feb484424aff911a50a4b1632d60f2ad6db9f6e5577744bf
Instruction ID: cd887d187f12f27c788508e735b690c5e09c94bc77cb75aff46fc10f1ec27de5
Opcode Fuzzy Hash: 59198f789e8770a8feb484424aff911a50a4b1632d60f2ad6db9f6e5577744bf
Instruction Fuzzy Hash: A8916E31518B984BDB65EF14D8A17EEB3E5FB94304F84292EE48BC3193DF3099449786

Function 000001E29B43CA8C Relevance: 1.7, APIs: 1, Instructions: 228fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 000001E29B43CC99

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: e26a3d902f64fdb1e6a29b1ddfd8af137ced715061d327bbcfc87f3b72d7e64f
Instruction ID: 42d9c9ac44107f13c3b5644b835230bb5cb257b4be8754eca9d12c71b5d27dd8
Opcode Fuzzy Hash: e26a3d902f64fdb1e6a29b1ddfd8af137ced715061d327bbcfc87f3b72d7e64f
Instruction Fuzzy Hash: AA712731208B588FE768EB18E9B1AAD73E5FB84714F54221DD88BC3193DF34E8469785

Function 00007DF41D0D15E8 Relevance: 1.7, APIs: 1, Instructions: 228COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE ref: 00007DF41D0D172D

Memory Dump Source

Source File: 00000004.00000003.2323060245.00007DF41D0D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_7df41d0d1000_wmplayer.jbxd

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: a4d7378eb0dc183d45dac9fde789c38604b4b9a60361aa9a1ccba498305d516d
Instruction ID: dff99e333faf82e8e75a1893e35c8cbb112f2f11534a8e69e4e53512b2685bb7
Opcode Fuzzy Hash: a4d7378eb0dc183d45dac9fde789c38604b4b9a60361aa9a1ccba498305d516d
Instruction Fuzzy Hash: 45715570A1CB854FD765DB28D4857ABBBF1FB99300F104A3FE58FC2152EA34A5058792

Function 000001E29B436C10 Relevance: 1.6, APIs: 1, Instructions: 142COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE ref: 000001E29B436CD6

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: c27442c9625b69612e30a0c621dafdc38b3cd1b2ea33eefe8ec2cdf5f7c33623
Instruction ID: 130a90109754c98199d241f2395237bb8e8f795e095d158b68d014aad1414a6b
Opcode Fuzzy Hash: c27442c9625b69612e30a0c621dafdc38b3cd1b2ea33eefe8ec2cdf5f7c33623
Instruction Fuzzy Hash: E3419430318A5A0AEB5DE724E9B17EE32D9E794318F882629EC0BC71C3DF35D9019745

Function 000001E29B43A76C Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT ref: 000001E29B43A7FB

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: _malloc_dbg
String ID:
API String ID: 1527718024-0
Opcode ID: d2cb0783aaccdf533b8783a245833ea662784d452517a49626c29c14fb2d72e4
Instruction ID: 335f61780dc15cd1365396b4930d58af51b88e3a88c48956cf152401fe632135
Opcode Fuzzy Hash: d2cb0783aaccdf533b8783a245833ea662784d452517a49626c29c14fb2d72e4
Instruction Fuzzy Hash: 2841C731214D0E4FDF98EF2CD498AA9B7E4FB68305B14522AD409C3651DB35E881CBC0

Function 000001E29B43778C Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE ref: 000001E29B4378B2

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: c6fe4b8a49b1c432d16a5d1b2244a4336856686fe2f0bc0d983b446ba2d85ae3
Instruction ID: 6071d8e4908f90aaba648d5570b07e81adcb23c74dba91ac32ea7ddce4b98842
Opcode Fuzzy Hash: c6fe4b8a49b1c432d16a5d1b2244a4336856686fe2f0bc0d983b446ba2d85ae3
Instruction Fuzzy Hash: 304180311186888BE76AEB24D4A5BDFB3E5FB94304F405A1DE48BC3192EF749504CB86

Function 000001E29B43CCD0 Relevance: 1.6, APIs: 1, Instructions: 55fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 000001E29B43CD2F

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 2f464fde3477c0bba4832f44d3340180ae7d23497e5ed422822a87f1e6a42210
Instruction ID: 984283e1b1cbd6e024c8c30dd69c43682b866636467878067643e0abb51a8123
Opcode Fuzzy Hash: 2f464fde3477c0bba4832f44d3340180ae7d23497e5ed422822a87f1e6a42210
Instruction Fuzzy Hash: E401C071204A4C8FEB40FB19D8D59ADB3E9FBD8314F54162AE88AC2151EF30EA548785

Function 000001E29B44D4AC Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 000001E29B44D4FE

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: e53db298d0d7d8de9701e8a24c72cb59212fc55ca396913229799ff2ccd7724d
Instruction ID: 65a955597e858e1239bfa87833469560e454bf52b4e7d1e6acc4fdaf34fb577c
Opcode Fuzzy Hash: e53db298d0d7d8de9701e8a24c72cb59212fc55ca396913229799ff2ccd7724d
Instruction Fuzzy Hash: 851161302009698FEFA59F29C8B43A932D5EB58319F54227ADC0ECA196CF309C50D795

Function 000001E29B432904 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 000001E29B43293C

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a3e65a005f3911c52a3a19618f507bf36bcbd5794d57615cb3bbd7cad2f75c67
Instruction ID: 4883faddcb5bbd376f1fb5b6a936292194500dbe66908c0d531860beba773572
Opcode Fuzzy Hash: a3e65a005f3911c52a3a19618f507bf36bcbd5794d57615cb3bbd7cad2f75c67
Instruction Fuzzy Hash: CE01763070491D8FFB44EBA9ECB866933E8FF8A31AF480064D80AC3105DA3AAC01CB45

Function 00007DF41D0E2F60 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SetWinEventHook.USER32 ref: 00007DF41D0E2FCD

Memory Dump Source

Source File: 00000004.00000002.3278269568.00007DF41D0E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df41d0e1000_wmplayer.jbxd

Similarity

API ID: EventHook
String ID:
API String ID: 3661607649-0
Opcode ID: e6b188324f96a1e03f166e4287a2793acb406422b2b30f8b11d607c185f61fee
Instruction ID: 0efc573b95c6d87ec79bc2730bccd2dc30017560286438dcadb3bab97ad57c9f
Opcode Fuzzy Hash: e6b188324f96a1e03f166e4287a2793acb406422b2b30f8b11d607c185f61fee
Instruction Fuzzy Hash: 9D1161B0E19D858FEB54AB20D8697AB7FB0FF1031AF600A79D08BC21D1DB3DA5449751

Function 000001E29B43BE7C Relevance: 1.5, APIs: 1, Instructions: 48libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000001E29B43BED6

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4d57d7d5982399080f90361c2699a999889f8feb933735bc5bb6e787f07df0d3
Instruction ID: 3d3db7a25545d99140b421a7d08c5514e1612653126d172cdd8a47885bee9425
Opcode Fuzzy Hash: 4d57d7d5982399080f90361c2699a999889f8feb933735bc5bb6e787f07df0d3
Instruction Fuzzy Hash: 74018630314A8C0FFB45EB28E4753AD32D9E754305F54256AE40BC32D2EE34CD049745

Function 000001E29B43A960 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT(?,?,?,?,?,?,?,?,-00000002,000001E29B440CE7), ref: 000001E29B43A976

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 85df9ee76aeee916477ee65bd03fae0aa34298d7a375d21a792168504e9e5af9
Instruction ID: c5b97d9fa24ec174692dcaa380e5110de062c6e97a224dcdf0374562dac83b6f
Opcode Fuzzy Hash: 85df9ee76aeee916477ee65bd03fae0aa34298d7a375d21a792168504e9e5af9
Instruction Fuzzy Hash: C9F06D30210E1E4FEB85EF19D4B8769B3E8FB5C309FA41569C80AC2590CB729850CB01

Function 000001E29B474468 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 000001E29B474496

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 5a17d2a82900e38e66e0587de357cfea25c88adc918405c2cab64094945da2f0
Instruction ID: 20466742e51cf901e4fdaf2ea1f8c77670cd77a1763df39b66f71380e85371ff
Opcode Fuzzy Hash: 5a17d2a82900e38e66e0587de357cfea25c88adc918405c2cab64094945da2f0
Instruction Fuzzy Hash: F3F0497021891A4FEFA4EB69C4F4B7933E4FB58314FA02259980AC7586EB25CC81E784

Function 000001E29B432B50 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 000001E29B432B70

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: eab2b32177be9564e25d5777707ea1ca30621b5695f0306aefe172fe800bc35c
Instruction ID: 5b46704abb6717c9ea9535a4304891e95871bb8d698a6653ad3f3d1a409ddd0e
Opcode Fuzzy Hash: eab2b32177be9564e25d5777707ea1ca30621b5695f0306aefe172fe800bc35c
Instruction Fuzzy Hash: D6F0A7316046644FF720AEB5BDB439E3149E344356FAC393ED807C6183DE3D88416344

Function 000001E29B43697C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 000001E29B4369A3

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: c691d5039295ecc8b7e044fb40fc3c69618cf93c91779b6bda279d67736a12d8
Instruction ID: 6ce2e4165634de28756c8ca27d7ac68aff99bc4625ec00ed1041dd3f04bebe7d
Opcode Fuzzy Hash: c691d5039295ecc8b7e044fb40fc3c69618cf93c91779b6bda279d67736a12d8
Instruction Fuzzy Hash: FBE0CD21704C1A0BAB6861AD64AC6BA11D6C7DC276B44517BE81DC3295DD20CC410344

Function 00007DF41D0E1708 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 00007DF41D0E1735

Memory Dump Source

Source File: 00000004.00000002.3278269568.00007DF41D0E1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df41d0e1000_wmplayer.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: 62df2a061ef9a83e40c3da8f8fbf33d98cfabe8aaf6c816d3fbd47a45bbcd3fe
Instruction ID: dd5782aa022d24019ed806accd612646eb197b6b6fd88e30061862c6ca57258b
Opcode Fuzzy Hash: 62df2a061ef9a83e40c3da8f8fbf33d98cfabe8aaf6c816d3fbd47a45bbcd3fe
Instruction Fuzzy Hash: EBE04F70640D054BEBA8E61DC8497903AF0FB5830AF604269D445CA291CB39949BCF42

Function 00007DF41D0A1D34 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 00007DF41D0A1D61

Memory Dump Source

Source File: 00000004.00000003.2331797233.00007DF41D0A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_7df41d0a1000_wmplayer.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: c9293ce4b305ba9868cbd6c67d8039fb85aeebd9cc4eecdb21d56eb0f10a1afb
Instruction ID: 9005898ca46b63e15200d9b5caa327edb4e7dcf7854ebe0d587872371bce56d2
Opcode Fuzzy Hash: c9293ce4b305ba9868cbd6c67d8039fb85aeebd9cc4eecdb21d56eb0f10a1afb
Instruction Fuzzy Hash: 22E04F309109095BEBA8D61DC9093903AE1EB5C30AF604269D409C9291CB39949BCF42

Function 000001E29B433C84 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 000001E29B433CB1

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: a4029a93bfcd341c8676454adb8c6f5f12b6913b14ed0bccef0902b234b6dd47
Instruction ID: c0aca28647e573675d9e89854a9d662c01f255e5b6be3a65802e35c355793750
Opcode Fuzzy Hash: a4029a93bfcd341c8676454adb8c6f5f12b6913b14ed0bccef0902b234b6dd47
Instruction Fuzzy Hash: 31E086301009055FEF98DB1DCA1939036D0EB9C30EFA8529CE805C9396CB39C49BCF41

Function 000001E29B4374A0 Relevance: 1.5, APIs: 1, Instructions: 276COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 000001E29B43757E

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: ef59572018a9deb8cc9717970e2f4ccce5bc515e763955c946e33fff9a11c9f9
Instruction ID: da9f1969bb49cde8b6489df94524432105ee2ee3e8283d6f73262367a2c16946
Opcode Fuzzy Hash: ef59572018a9deb8cc9717970e2f4ccce5bc515e763955c946e33fff9a11c9f9
Instruction Fuzzy Hash: 3791D130218A588FEB48EF18D4A5AEA73E5FB54300F846519E88BC7197EF30E855DB85

Function 00007DF41D0D1290 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 00007DF41D0D12BD

Memory Dump Source

Source File: 00000004.00000003.2323060245.00007DF41D0D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_7df41d0d1000_wmplayer.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: fc492990cf9c193ed0fed28dab1318ef1c2e9243cee28bd6a774944ac56baf31
Instruction ID: 04f99ef3079e87c003558e96e3739c64db6703aac57dcd404219879e1d8b6996
Opcode Fuzzy Hash: fc492990cf9c193ed0fed28dab1318ef1c2e9243cee28bd6a774944ac56baf31
Instruction Fuzzy Hash: 79E04F70904D055BEB98D61DC8097603AE1EB5830AF60466AD505C9295CB7A94ABCF82

Function 00007DF41D0D1290 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 00007DF41D0D12BD

Memory Dump Source

Source File: 00000004.00000002.3278193797.00007DF41D0D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df41d0d1000_wmplayer.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: cff89ce48d21670ef986fb34dbe231ab83686b2b911df37c38ad495f9c0b2048
Instruction ID: a7183136a1cc64b946792c3ca2591c6d811a3d19c37ea5ef1958f4d62a73c945
Opcode Fuzzy Hash: cff89ce48d21670ef986fb34dbe231ab83686b2b911df37c38ad495f9c0b2048
Instruction Fuzzy Hash: DDE04F30904D054BEB98D61DC8097603AE1EB5C30AF60466AD506C9295CB3A98ABCF82

Function 000001E29B436950 Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000001E29B436972

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction ID: a0fbeabb4979543d3fde6b78e7c8fa056366feaaa08cbb76bcd86c549c5046ad
Opcode Fuzzy Hash: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction Fuzzy Hash: 2CD05E20320D0E1BEA48632D68B53695199E7C8325F94223AB80AC2282DE68CC550255

Non-executed Functions

Function 00007DF41D0D199C Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 00007DF41D0D1AB6

Strings

(, xrefs: 00007DF41D0D1A2C
o, xrefs: 00007DF41D0D1A38
., xrefs: 00007DF41D0D1A32

Memory Dump Source

Source File: 00000004.00000002.3278193797.00007DF41D0D1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF41D0D1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7df41d0d1000_wmplayer.jbxd

Similarity

API ID: InformationProcessQuery
String ID: ($.$o
API String ID: 1778838933-116743476
Opcode ID: 4bc1349027c11bed1782b00e19f7c38053766996ee3beef85e27a3dd3919dec8
Instruction ID: 6eb0b744cb95142f5a87f258c81daaee60c03ccfca328b44985cbe9dc642e752
Opcode Fuzzy Hash: 4bc1349027c11bed1782b00e19f7c38053766996ee3beef85e27a3dd3919dec8
Instruction Fuzzy Hash: F8818F7090CFD44EE3759B6894183EBBBF1EF55314F241A2FE0DB83292DA28A5458763

Function 000001E29B43108E Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5b569557ea8fd9e703e276da5cc2075190dd5c6eabafacfb0724013e1746740
Instruction ID: 11de81072df7d8745d20a3fcb056ffa8c08fe26ab0c839a6fe344ef454606689
Opcode Fuzzy Hash: d5b569557ea8fd9e703e276da5cc2075190dd5c6eabafacfb0724013e1746740
Instruction Fuzzy Hash: D2414F7188F7D08ED71346309EB66897FB95F03358F5D26EBC8818E9ABDA280805C755

Function 000001E29B435641 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3277237788.000001E29B431000.00000020.00000001.00020000.00000000.sdmp, Offset: 000001E29B431000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_1e29b431000_wmplayer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1b86d1722e9186f201356204767bb0696bac90eedf2af1379dd67ace5ea2e2
Instruction ID: 6c4a121da8751a802d0ceae1c66e56475db702b58b26a1783e6caea7a4917f49
Opcode Fuzzy Hash: ec1b86d1722e9186f201356204767bb0696bac90eedf2af1379dd67ace5ea2e2
Instruction Fuzzy Hash: 61B01120E28A0082E3080E0AF802332F2B0C30B302F0030302000F3220C828CC80028F

Analysis Process: dllhost.exePID: 5840, Parent PID: 6844COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	63
Total number of Limit Nodes:	0

Executed Functions

Function 0000021DDB03385C Relevance: 1.8, APIs: 1, Instructions: 269
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000021DDB033484: GetVolumeInformationW.KERNELBASE ref: 0000021DDB0335BB

NtQuerySystemInformation.NTDLL ref: 0000021DDB0339CF

Memory Dump Source

Source File: 00000005.00000002.3277121165.0000021DDB030000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021DDB030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21ddb030000_dllhost.jbxd

Similarity

API ID: Information$QuerySystemVolume
String ID:
API String ID: 2187445334-0
Opcode ID: bca2527ebfddbfeddfc74320ecfb344a71f08446d0bfa8d9099063a8a135c2dc
Instruction ID: 44cb30cb3c5a19228c1d7bc1a7402426db5cda1c7d8a78f4d2825f4a83bf99e7
Opcode Fuzzy Hash: bca2527ebfddbfeddfc74320ecfb344a71f08446d0bfa8d9099063a8a135c2dc
Instruction Fuzzy Hash: 8891A231208E098FE7B5EB34D89D7FA73E1FB69301F104A2AD45BC32A1EE3495458B81

Function 0000021DDB032AC4 Relevance: .3, Instructions: 327
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.3277121165.0000021DDB030000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021DDB030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21ddb030000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8512d78b354c5844fd4c36e09df8179ddcddeb38f1392decb0dcb4a473f28df8
Instruction ID: e622a94a1a7e17df1d3f4fa327311b70c4eea44787d8a64c17295ed7ea766852
Opcode Fuzzy Hash: 8512d78b354c5844fd4c36e09df8179ddcddeb38f1392decb0dcb4a473f28df8
Instruction Fuzzy Hash: 3EB13932114A19CBE776EB14D499BEB73E1FBBB308F404619A487C7296DE34E505CB81

Function 0000021DDB056E1C Relevance: 7.6, APIs: 5, Instructions: 130
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0000021DDB056E25
WSAStartup.WS2_32 ref: 0000021DDB05A3BC
socket.WS2_32 ref: 0000021DDB05A42B
getsockopt.WS2_32 ref: 0000021DDB05A45F
socket.WS2_32 ref: 0000021DDB05A494

Memory Dump Source

Source File: 00000005.00000002.3277121165.0000021DDB030000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021DDB030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21ddb030000_dllhost.jbxd

Similarity

API ID: socket$ErrorModeStartupgetsockopt
String ID:
API String ID: 2955919026-0
Opcode ID: 2b6fb284fe353a32addd25f3df84090d0ecaa741c51bc7f7119ce81397f063fd
Instruction ID: f61a5ef157b6bf702b21b4ea6a1ae7b8b8a82fa084fb6bf531538e805f20053e
Opcode Fuzzy Hash: 2b6fb284fe353a32addd25f3df84090d0ecaa741c51bc7f7119ce81397f063fd
Instruction Fuzzy Hash: 3A412331618A48CFE754EF28E89C6AA77E1FBA9304F40972EE046C36E5DF389505CB41

Function 0000021DDB033658 Relevance: 3.2, APIs: 2, Instructions: 175
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE ref: 0000021DDB033792
MapViewOfFile.KERNELBASE ref: 0000021DDB0337B9

Memory Dump Source

Source File: 00000005.00000002.3277121165.0000021DDB030000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021DDB030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21ddb030000_dllhost.jbxd

Similarity

API ID: File$CreateMappingView
String ID:
API String ID: 3452162329-0
Opcode ID: cffb7890a827fe9a5a832accfdda4080e78a7defe143b7e9f1866298b49a1528
Instruction ID: f3198ffd50da77397020a35f67d9e100aa4bc0ff059a8eca592448d643f75140
Opcode Fuzzy Hash: cffb7890a827fe9a5a832accfdda4080e78a7defe143b7e9f1866298b49a1528
Instruction Fuzzy Hash: 9451703151CB988BD735EB25D8897FAB7E0FB96305F00492FA4DAC2291DF34A505CB92

Function 0000021DDB0579E0 Relevance: 3.1, APIs: 2, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateIoCompletionPort.KERNELBASE ref: 0000021DDB057A42
SetFileCompletionNotificationModes.KERNEL32 ref: 0000021DDB057A88

Memory Dump Source

Source File: 00000005.00000002.3277121165.0000021DDB030000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021DDB030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21ddb030000_dllhost.jbxd

Similarity

API ID: Completion$CreateFileModesNotificationPort
String ID:
API String ID: 3755109111-0
Opcode ID: eeb08bc5de237f5e444c97fd1ce16522b32e43acae38c6d5ea8ba3eb6f6df761
Instruction ID: cba117ad73d0af80f4aba67891d8f9001288beba2977294556e3ad5aa1251ce0
Opcode Fuzzy Hash: eeb08bc5de237f5e444c97fd1ce16522b32e43acae38c6d5ea8ba3eb6f6df761
Instruction Fuzzy Hash: A731C4323185298FFB789B28B88D3B932D4F7A7319F5001A9E80BC25D2DB25CD41A791

Function 0000021DDB033484 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNELBASE ref: 0000021DDB0335BB

Memory Dump Source

Source File: 00000005.00000002.3277121165.0000021DDB030000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021DDB030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21ddb030000_dllhost.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: cbef5665e4e33130d77fabd6912371dd21022a2eb90503feaf05fbace3e60585
Instruction ID: 697a97d63a250607826cd6b82424179405afa6aa8234a2039cd132146563cce3
Opcode Fuzzy Hash: cbef5665e4e33130d77fabd6912371dd21022a2eb90503feaf05fbace3e60585
Instruction Fuzzy Hash: 2A5123311187488BE77AEF24D8987EBB3E0FBA5304F404A2DE08AC31A1EF759505CB42

Function 0000021DDB057DD0 Relevance: 1.6, APIs: 1, Instructions: 93
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 0000021DDB057DFD

Memory Dump Source

Source File: 00000005.00000002.3277121165.0000021DDB030000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021DDB030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21ddb030000_dllhost.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: ddc7d61f354267cb303f3c162d0fc5aee7ca0d8d37550dc82b6934c7685345cf
Instruction ID: de7664f4c0727fa2d1f4b7e1b3bbaa159c52b8013415fd08db8fb987b34f7a2d
Opcode Fuzzy Hash: ddc7d61f354267cb303f3c162d0fc5aee7ca0d8d37550dc82b6934c7685345cf
Instruction Fuzzy Hash: 2921DB313086148FEB689F38A88D7B533D1FB6A329F200669E82BC76D5DF348C419652

Function 0000021DDB0328D4 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0000021DDB032949

Memory Dump Source

Source File: 00000005.00000002.3277121165.0000021DDB030000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021DDB030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21ddb030000_dllhost.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 147b7861b8d55a5ae4162ffc4259640c3a28b81395385b0f304c643425426fcc
Instruction ID: c8003ccdc62060771ebf2f18eaa9909c994d0f6325665d4763b3dc074e5f5e04
Opcode Fuzzy Hash: 147b7861b8d55a5ae4162ffc4259640c3a28b81395385b0f304c643425426fcc
Instruction Fuzzy Hash: 84014432314A298AFA79B374696D7FD22D6EBB7319F440129E90AD33D2DE14C9044641

Function 0000021DDB0328A0 Relevance: 1.5, APIs: 1, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddressForCaller.KERNELBASE ref: 0000021DDB0328C7

Memory Dump Source

Source File: 00000005.00000002.3277121165.0000021DDB030000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021DDB030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21ddb030000_dllhost.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: be8164fcd6bb8b439b0c6dd95cb79210c8cf986f476e4ea7066077b0df3d1665
Instruction ID: d0098b6f5f1393eb7a91d5902be261a883581839369e7b0469ed7606d34b6a2d
Opcode Fuzzy Hash: be8164fcd6bb8b439b0c6dd95cb79210c8cf986f476e4ea7066077b0df3d1665
Instruction Fuzzy Hash: DBE0C222714C190BAB7862AE248C6B651C6C7EE276704027BE41CC3395ED10CC410390

Function 0000021DDB032874 Relevance: 1.5, APIs: 1, Instructions: 24
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000021DDB032896

Memory Dump Source

Source File: 00000005.00000002.3277121165.0000021DDB030000.00000040.00000400.00020000.00000000.sdmp, Offset: 0000021DDB030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_21ddb030000_dllhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction ID: 80e53085fb98798305be22b476e22311d78e796d0b6b1e28aafe5ace1dc81bda
Opcode Fuzzy Hash: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction Fuzzy Hash: 3BD0A721321D0E5BEA68633D2CAC3B511C5E7EE229F50153AF409C2381DE58CC950300

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
SecuriteInfo.com.Win64.Evo-gen.8364.21532.exe

Function 000001E29B442D24 Relevance: 17.0, APIs: 2, Strings: 7, Instructions: 1263
COMMON

Function 000001E29B43CDF4 Relevance: 4.6, APIs: 3, Instructions: 110
pipeCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre