Edit tour

Windows Analysis Report
z5zecWP4su.dll

Overview

General Information

Sample name:	z5zecWP4su.dll (renamed file extension from none to dll, renamed because original name is a hash value)
Original sample name:	ec1205a050693f750dd6a984b68eb2533539a34a5602744127d1b729b22f42fd
Analysis ID:	1467832
MD5:	20ee5ab5724339f16c19be92d0912bb6
SHA1:	73055a139a248cccb2b6f4360f072f7626b4ce7c
SHA256:	ec1205a050693f750dd6a984b68eb2533539a34a5602744127d1b729b22f42fd
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

AI detected suspicious sample

Found direct / indirect Syscall (likely to bypass EDR)

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Tries to detect virtualization through RDTSC time measurements

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 5888 cmdline: loaddll64.exe "C:\Users\user\Desktop\z5zecWP4su.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 3408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5712 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\z5zecWP4su.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 344 cmdline: rundll32.exe "C:\Users\user\Desktop\z5zecWP4su.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

regsvr32.exe (PID: 3568 cmdline: regsvr32.exe /s C:\Users\user\Desktop\z5zecWP4su.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

rundll32.exe (PID: 3560 cmdline: rundll32.exe C:\Users\user\Desktop\z5zecWP4su.dll,DllMain MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 4052 cmdline: rundll32.exe C:\Users\user\Desktop\z5zecWP4su.dll,DllRegisterServer MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Sigma Signatures

Sigma detected: Network Connection Initiated By Regsvr32.EXE

Source: Network Connection

Author: Dmitriy Lifanov, oscd.community: Data: DestinationIp: 10.45.6.7, DestinationIsIpv6: false, DestinationPort: 13111, EventID: 3, Image: C:\Windows\System32\regsvr32.exe, Initiated: true, ProcessId: 3568, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 53463

Snort Signatures

ET TROJAN Win32/MataDoor CnC Beacon Over UDP - Source IP: 192.168.2.5 - Destination IP: 10.45.6.7

Timestamp:	07/04/24-21:06:49.123349
SID:	2048550
Source Port:	53463
Destination Port:	13111
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: z5zecWP4su.dll

ReversingLabs: Detection: 54%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: loaddll64.exe, 00000000.00000002.3240584265.00007FF8A7E43000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN RSA PUBLIC KEY-----

memstr_f3dc30d5-6

Source: z5zecWP4su.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2048550 ET TROJAN Win32/MataDoor CnC Beacon Over UDP 192.168.2.5:53463 -> 10.45.6.7:13111

Source: z5zecWP4su.dll	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: z5zecWP4su.dll	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: z5zecWP4su.dll	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: z5zecWP4su.dll	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: z5zecWP4su.dll	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: z5zecWP4su.dll	String found in binary or memory: http://ocsp.comodoca.com0
Source: z5zecWP4su.dll	String found in binary or memory: http://ocsp.sectigo.com0
Source: z5zecWP4su.dll	String found in binary or memory: https://sectigo.com/CPS0

Source: z5zecWP4su.dll

Static PE information: invalid certificate

Source: classification engine

Classification label: mal72.evad.winDLL@12/0@0/1

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3408:120:WilError_03

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\z5zecWP4su.dll",#1

Source: z5zecWP4su.dll

ReversingLabs: Detection: 54%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\z5zecWP4su.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\z5zecWP4su.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\z5zecWP4su.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\z5zecWP4su.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\z5zecWP4su.dll,DllMain
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\z5zecWP4su.dll,DllRegisterServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\z5zecWP4su.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\z5zecWP4su.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\z5zecWP4su.dll,DllMain	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\z5zecWP4su.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\z5zecWP4su.dll",#1	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mswsock.dll	Jump to behavior

Source: z5zecWP4su.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: z5zecWP4su.dll

Static file information: File size 6738848 > 1048576

Source: z5zecWP4su.dll

Static PE information: Raw size of .6L1 is bigger than: 0x100000 < 0x66a800

Source: z5zecWP4su.dll

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Source: initial sample

Static PE information: section where entry point is pointing to: .6L1

Source: z5zecWP4su.dll	Static PE information: section name: _RDATA
Source: z5zecWP4su.dll	Static PE information: section name: ..qC
Source: z5zecWP4su.dll	Static PE information: section name: ._a8
Source: z5zecWP4su.dll	Static PE information: section name: .6L1

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\z5zecWP4su.dll

Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000FA1137DEB3 push ecx; retf	4_2_000000FA1137DF19
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000FA1137EC24 push ecx; retf	4_2_000000FA1137EF39
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000FA1137D998 push ecx; retf	4_2_000000FA1137D999
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000FA1137EA4B pushad ; ret	4_2_000000FA1137EA7C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000FA1137EF3A push ecx; retf	4_2_000000FA1137EF39
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000006D9B47E868 push ecx; retf	5_2_0000006D9B47E869
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000006D9B47E37B pushad ; ret	5_2_0000006D9B47E3AC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_0000006D9B47D78A push ecx; retf	5_2_0000006D9B47D849

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\System32\loaddll64.exe	Memory written: PID: 5888 base: 7FF8C8A50008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Memory written: PID: 5888 base: 7FF8C88ED9F0 value: E9 20 26 16 00	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Memory written: PID: 3568 base: 7FF8C8A50008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Memory written: PID: 3568 base: 7FF8C88ED9F0 value: E9 20 26 16 00	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 344 base: 7FF8C8A50008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 344 base: 7FF8C88ED9F0 value: E9 20 26 16 00	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 3560 base: 7FF8C8A50008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 3560 base: 7FF8C88ED9F0 value: E9 20 26 16 00	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 4052 base: 7FF8C8A50008 value: E9 EB D9 E9 FF	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Memory written: PID: 4052 base: 7FF8C88ED9F0 value: E9 20 26 16 00	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\System32\rundll32.exe	RDTSC instruction interceptor: First address: 7FF8A8A4E137 second address: 7FF8A8A4E155 instructions: 0x00000000 rdtsc 0x00000002 cbw 0x00000004 inc ax 0x00000006 movzx eax, dh 0x00000009 inc ecx 0x0000000a pop eax 0x0000000b cwd 0x0000000d inc cx 0x0000000f bswap edx 0x00000011 inc ecx 0x00000012 pop ecx 0x00000013 dec eax 0x00000014 arpl ax, si 0x00000016 inc ecx 0x00000017 pop ebp 0x00000018 dec eax 0x00000019 cdq 0x0000001a inc eax 0x0000001b setns bh 0x0000001e rdtsc
Source: C:\Windows\System32\rundll32.exe	RDTSC instruction interceptor: First address: 7FF8A89A1C6E second address: 7FF8A89A1C84 instructions: 0x00000000 rdtsc 0x00000002 lahf 0x00000003 dec eax 0x00000004 cwde 0x00000005 inc ecx 0x00000006 pop ebp 0x00000007 lahf 0x00000008 inc sp 0x0000000a movsx edx, ch 0x0000000d inc sp 0x0000000f movzx esi, dh 0x00000012 inc ecx 0x00000013 pop esp 0x00000014 inc ecx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Windows\System32\regsvr32.exe	RDTSC instruction interceptor: First address: 7FF8A8A4E137 second address: 7FF8A8A4E155 instructions: 0x00000000 rdtsc 0x00000002 cbw 0x00000004 inc ax 0x00000006 movzx eax, dh 0x00000009 inc ecx 0x0000000a pop eax 0x0000000b cwd 0x0000000d inc cx 0x0000000f bswap edx 0x00000011 inc ecx 0x00000012 pop ecx 0x00000013 dec eax 0x00000014 arpl ax, si 0x00000016 inc ecx 0x00000017 pop ebp 0x00000018 dec eax 0x00000019 cdq 0x0000001a inc eax 0x0000001b setns bh 0x0000001e rdtsc
Source: C:\Windows\System32\rundll32.exe	RDTSC instruction interceptor: First address: 7FF8A8A2E926 second address: 7FF8A8A2E956 instructions: 0x00000000 rdtsc 0x00000002 sal bl, cl 0x00000004 inc ecx 0x00000005 pop ebp 0x00000006 inc cx 0x00000008 ror eax, FFFFFFBEh 0x0000000b inc ecx 0x0000000c shl bl, FFFFFFBFh 0x0000000f inc ecx 0x00000010 pop ecx 0x00000011 sbb ecx, ebx 0x00000013 inc bp 0x00000015 xor edi, edx 0x00000017 dec esp 0x00000018 arpl sp, sp 0x0000001a inc ecx 0x0000001b pop edi 0x0000001c inc ecx 0x0000001d test cl, cl 0x0000001f ror bp, FFA4h 0x00000023 clc 0x00000024 popfd 0x00000025 movsx edx, cx 0x00000028 bswap dx 0x0000002b pop esi 0x0000002c dec eax 0x0000002d movsx ecx, bx 0x00000030 rdtsc
Source: C:\Windows\System32\regsvr32.exe	RDTSC instruction interceptor: First address: 7FF8A89A1C6E second address: 7FF8A89A1C84 instructions: 0x00000000 rdtsc 0x00000002 lahf 0x00000003 dec eax 0x00000004 cwde 0x00000005 inc ecx 0x00000006 pop ebp 0x00000007 lahf 0x00000008 inc sp 0x0000000a movsx edx, ch 0x0000000d inc sp 0x0000000f movzx esi, dh 0x00000012 inc ecx 0x00000013 pop esp 0x00000014 inc ecx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Windows\System32\regsvr32.exe	RDTSC instruction interceptor: First address: 7FF8A8A2E926 second address: 7FF8A8A2E956 instructions: 0x00000000 rdtsc 0x00000002 sal bl, cl 0x00000004 inc ecx 0x00000005 pop ebp 0x00000006 inc cx 0x00000008 ror eax, FFFFFFBEh 0x0000000b inc ecx 0x0000000c shl bl, FFFFFFBFh 0x0000000f inc ecx 0x00000010 pop ecx 0x00000011 sbb ecx, ebx 0x00000013 inc bp 0x00000015 xor edi, edx 0x00000017 dec esp 0x00000018 arpl sp, sp 0x0000001a inc ecx 0x0000001b pop edi 0x0000001c inc ecx 0x0000001d test cl, cl 0x0000001f ror bp, FFA4h 0x00000023 clc 0x00000024 popfd 0x00000025 movsx edx, cx 0x00000028 bswap dx 0x0000002b pop esi 0x0000002c dec eax 0x0000002d movsx ecx, bx 0x00000030 rdtsc
Source: C:\Windows\System32\rundll32.exe	RDTSC instruction interceptor: First address: 7FF8A8413C20 second address: 7FF8A8413C25 instructions: 0x00000000 rdtsc 0x00000002 cwde 0x00000003 inc ecx 0x00000004 pop ebp 0x00000005 rdtsc
Source: C:\Windows\System32\rundll32.exe	RDTSC instruction interceptor: First address: 7FF8A8413C25 second address: 7FF8A8413C2D instructions: 0x00000000 rdtsc 0x00000002 inc ecx 0x00000003 mov dl, 89h 0x00000005 lahf 0x00000006 inc ecx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Windows\System32\rundll32.exe	RDTSC instruction interceptor: First address: 7FF8A83749A5 second address: 7FF8A83749AB instructions: 0x00000000 rdtsc 0x00000002 dec esp 0x00000003 arpl ax, bp 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Windows\System32\rundll32.exe	RDTSC instruction interceptor: First address: 7FF8A840AF78 second address: 7FF8A840AF96 instructions: 0x00000000 rdtsc 0x00000002 cbw 0x00000004 inc ax 0x00000006 movzx eax, dh 0x00000009 inc ecx 0x0000000a pop eax 0x0000000b cwd 0x0000000d inc cx 0x0000000f bswap edx 0x00000011 inc ecx 0x00000012 pop ecx 0x00000013 dec eax 0x00000014 arpl ax, si 0x00000016 inc ecx 0x00000017 pop ebp 0x00000018 dec eax 0x00000019 cdq 0x0000001a inc eax 0x0000001b setns bh 0x0000001e rdtsc
Source: C:\Windows\System32\regsvr32.exe	RDTSC instruction interceptor: First address: 7FF8A8413C20 second address: 7FF8A8413C25 instructions: 0x00000000 rdtsc 0x00000002 cwde 0x00000003 inc ecx 0x00000004 pop ebp 0x00000005 rdtsc
Source: C:\Windows\System32\rundll32.exe	RDTSC instruction interceptor: First address: 7FF8A83E210B second address: 7FF8A83E213B instructions: 0x00000000 rdtsc 0x00000002 sal bl, cl 0x00000004 inc ecx 0x00000005 pop ebp 0x00000006 inc cx 0x00000008 ror eax, FFFFFFBEh 0x0000000b inc ecx 0x0000000c shl bl, FFFFFFBFh 0x0000000f inc ecx 0x00000010 pop ecx 0x00000011 sbb ecx, ebx 0x00000013 inc bp 0x00000015 xor edi, edx 0x00000017 dec esp 0x00000018 arpl sp, sp 0x0000001a inc ecx 0x0000001b pop edi 0x0000001c inc ecx 0x0000001d test cl, cl 0x0000001f ror bp, FFA4h 0x00000023 clc 0x00000024 popfd 0x00000025 movsx edx, cx 0x00000028 bswap dx 0x0000002b pop esi 0x0000002c dec eax 0x0000002d movsx ecx, bx 0x00000030 rdtsc
Source: C:\Windows\System32\regsvr32.exe	RDTSC instruction interceptor: First address: 7FF8A8413C25 second address: 7FF8A8413C2D instructions: 0x00000000 rdtsc 0x00000002 inc ecx 0x00000003 mov dl, 89h 0x00000005 lahf 0x00000006 inc ecx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Windows\System32\regsvr32.exe	RDTSC instruction interceptor: First address: 7FF8A83749A5 second address: 7FF8A83749AB instructions: 0x00000000 rdtsc 0x00000002 dec esp 0x00000003 arpl ax, bp 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Windows\System32\regsvr32.exe	RDTSC instruction interceptor: First address: 7FF8A840AF78 second address: 7FF8A840AF96 instructions: 0x00000000 rdtsc 0x00000002 cbw 0x00000004 inc ax 0x00000006 movzx eax, dh 0x00000009 inc ecx 0x0000000a pop eax 0x0000000b cwd 0x0000000d inc cx 0x0000000f bswap edx 0x00000011 inc ecx 0x00000012 pop ecx 0x00000013 dec eax 0x00000014 arpl ax, si 0x00000016 inc ecx 0x00000017 pop ebp 0x00000018 dec eax 0x00000019 cdq 0x0000001a inc eax 0x0000001b setns bh 0x0000001e rdtsc
Source: C:\Windows\System32\loaddll64.exe	RDTSC instruction interceptor: First address: 7FF8A8A4E137 second address: 7FF8A8A4E155 instructions: 0x00000000 rdtsc 0x00000002 cbw 0x00000004 inc ax 0x00000006 movzx eax, dh 0x00000009 inc ecx 0x0000000a pop eax 0x0000000b cwd 0x0000000d inc cx 0x0000000f bswap edx 0x00000011 inc ecx 0x00000012 pop ecx 0x00000013 dec eax 0x00000014 arpl ax, si 0x00000016 inc ecx 0x00000017 pop ebp 0x00000018 dec eax 0x00000019 cdq 0x0000001a inc eax 0x0000001b setns bh 0x0000001e rdtsc
Source: C:\Windows\System32\loaddll64.exe	RDTSC instruction interceptor: First address: 7FF8A89A1C6E second address: 7FF8A89A1C84 instructions: 0x00000000 rdtsc 0x00000002 lahf 0x00000003 dec eax 0x00000004 cwde 0x00000005 inc ecx 0x00000006 pop ebp 0x00000007 lahf 0x00000008 inc sp 0x0000000a movsx edx, ch 0x0000000d inc sp 0x0000000f movzx esi, dh 0x00000012 inc ecx 0x00000013 pop esp 0x00000014 inc ecx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Windows\System32\loaddll64.exe	RDTSC instruction interceptor: First address: 7FF8A8A2E926 second address: 7FF8A8A2E956 instructions: 0x00000000 rdtsc 0x00000002 sal bl, cl 0x00000004 inc ecx 0x00000005 pop ebp 0x00000006 inc cx 0x00000008 ror eax, FFFFFFBEh 0x0000000b inc ecx 0x0000000c shl bl, FFFFFFBFh 0x0000000f inc ecx 0x00000010 pop ecx 0x00000011 sbb ecx, ebx 0x00000013 inc bp 0x00000015 xor edi, edx 0x00000017 dec esp 0x00000018 arpl sp, sp 0x0000001a inc ecx 0x0000001b pop edi 0x0000001c inc ecx 0x0000001d test cl, cl 0x0000001f ror bp, FFA4h 0x00000023 clc 0x00000024 popfd 0x00000025 movsx edx, cx 0x00000028 bswap dx 0x0000002b pop esi 0x0000002c dec eax 0x0000002d movsx ecx, bx 0x00000030 rdtsc
Source: C:\Windows\System32\loaddll64.exe	RDTSC instruction interceptor: First address: 7FF8A8413C20 second address: 7FF8A8413C25 instructions: 0x00000000 rdtsc 0x00000002 cwde 0x00000003 inc ecx 0x00000004 pop ebp 0x00000005 rdtsc
Source: C:\Windows\System32\loaddll64.exe	RDTSC instruction interceptor: First address: 7FF8A8413C25 second address: 7FF8A8413C2D instructions: 0x00000000 rdtsc 0x00000002 inc ecx 0x00000003 mov dl, 89h 0x00000005 lahf 0x00000006 inc ecx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Windows\System32\loaddll64.exe	RDTSC instruction interceptor: First address: 7FF8A83749A5 second address: 7FF8A83749AB instructions: 0x00000000 rdtsc 0x00000002 dec esp 0x00000003 arpl ax, bp 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Windows\System32\loaddll64.exe	RDTSC instruction interceptor: First address: 7FF8A840AF78 second address: 7FF8A840AF96 instructions: 0x00000000 rdtsc 0x00000002 cbw 0x00000004 inc ax 0x00000006 movzx eax, dh 0x00000009 inc ecx 0x0000000a pop eax 0x0000000b cwd 0x0000000d inc cx 0x0000000f bswap edx 0x00000011 inc ecx 0x00000012 pop ecx 0x00000013 dec eax 0x00000014 arpl ax, si 0x00000016 inc ecx 0x00000017 pop ebp 0x00000018 dec eax 0x00000019 cdq 0x0000001a inc eax 0x0000001b setns bh 0x0000001e rdtsc

Source: C:\Windows\System32\loaddll64.exe	Window / User API: threadDelayed 3985	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Window / User API: threadDelayed 3325	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 3582	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe TID: 3480	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe TID: 2828	Thread sleep time: -54000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe TID: 3480	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe TID: 3480	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe TID: 2828	Thread sleep time: -11955000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe TID: 3480	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe TID: 5312	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 6788	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1600	Thread sleep count: 277 > 30	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1600	Thread sleep time: -831000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 6788	Thread sleep time: -480000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 6788	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1600	Thread sleep count: 3325 > 30	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 1600	Thread sleep time: -9975000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 6788	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe TID: 6056	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 736	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 4480	Thread sleep time: -75000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 736	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 736	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 4480	Thread sleep count: 3582 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 4480	Thread sleep time: -10746000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 736	Thread sleep time: -120000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\regsvr32.exe	Last function: Thread delayed
Source: C:\Windows\System32\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll64.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 120000	Jump to behavior

Source: loaddll64.exe, 00000000.00000002.3240179330.000002132FB18000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllaaywP
Source: regsvr32.exe, 00000003.00000002.3240054781.0000000000980000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll'
Source: rundll32.exe, 00000007.00000002.3240226568.00000189F656F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll"

Source: C:\Windows\System32\loaddll64.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Indirect: 0x7FF8A894F6CC	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtOpenFile: Direct from: 0xE05E8FE9AA	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Direct from: 0x282	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtUnmapViewOfSection: Direct from: 0xD0A58	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	NtProtectVirtualMemory: Indirect: 0x7FF8A7DB5129	Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\z5zecWP4su.dll",#1

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	21 Virtualization/Sandbox Evasion	1 Credential API Hooking	111 Security Software Discovery	Remote Services	1 Credential API Hooking	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	11 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Regsvr32	LSA Secrets	11 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Rundll32	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
z5zecWP4su.dll	54%	ReversingLabs	Win64.Trojan.Generic

Source	Detection	Scanner	Label
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	Avira URL Cloud	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	z5zecWP4su.dll	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	z5zecWP4su.dll	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	z5zecWP4su.dll	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	z5zecWP4su.dll	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	z5zecWP4su.dll	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	z5zecWP4su.dll	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
10.45.6.7

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467832
Start date and time:	2024-07-04 21:06:00 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	z5zecWP4su.dll (renamed file extension from none to dll, renamed because original name is a hash value)
Original Sample Name:	ec1205a050693f750dd6a984b68eb2533539a34a5602744127d1b729b22f42fd
Detection:	MAL
Classification:	mal72.evad.winDLL@12/0@0/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 344 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 3560 because there are no executed function
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: z5zecWP4su.dll

Simulations

Behavior and APIs

Time	Type	Description
15:06:47	API Interceptor	3872x Sleep call for process: regsvr32.exe modified
15:06:47	API Interceptor	3852x Sleep call for process: rundll32.exe modified
15:06:52	API Interceptor	4200x Sleep call for process: loaddll64.exe modified

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	7.930757126160959
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	z5zecWP4su.dll
File size:	6'738'848 bytes
MD5:	20ee5ab5724339f16c19be92d0912bb6
SHA1:	73055a139a248cccb2b6f4360f072f7626b4ce7c
SHA256:	ec1205a050693f750dd6a984b68eb2533539a34a5602744127d1b729b22f42fd
SHA512:	8444cde4bd65e04f81a7bec549d994190b7d5c72e5f3012d8f40ee73cea219148efa4da02cbc29cf24bd143814fdaf4d8e38e6f721b33237c3b620bf1a07033b
SSDEEP:	196608:6cSBIRVmc1K2RpqaLcoolauwCEsjkP3AI:H3mUK2RpBcWzP3J
TLSH:	076612BD61943328C41BC8389533BE18B2B2552B5BF9887EB1DB7AC07B9E414E651F13
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....%>c.........." .................xo.............................................}.g...`................................

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x1806f7803
Entrypoint Section:	.6L1
Digitally signed:	true
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x633E25C2 [Thu Oct 6 00:48:02 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	db53459cb7c27bb8104be7d6f472c9ac

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file
Error Number:	-2146762495
Not Before, Not After	05/09/2022 02:00:00 06/09/2023 01:59:59
Subject Chain	CN=Jones Richard, O=Jones Richard, S=South Carolina, C=US
Version:	3
Thumbprint MD5:	31F25FFBFC2F4C1AA7E73C38A8DD3F48
Thumbprint SHA-1:	86B46FB832138CA0503215CBEA529F6CA7DF1599
Thumbprint SHA-256:	00EEAC40AED556F26006CABFFA52759335E066EA4A14A74A106DB79EA6D6CD29
Serial:	00FA5E102F065235523BF7B0D2A386125C

Entrypoint Preview

Instruction
push edx
inc ecx
push esi
dec eax
mov edx, 69EC12D3h
mov es, word ptr [eax]
call far D562h : 5EBE4921h
jnle 00007FED28E60D45h
rol dword ptr [edi-18h], 1
push edi
mov byte ptr [ebx], al
add byte ptr [edi], al
sub al, 6Ah
push ds
or eax, edi
adc cl, al
fistp dword ptr [esi+ebx+60CC3AEBh]
test bl, al
in eax, dx
or bh, byte ptr [ebp-0D14EEA1h]
xchg eax, esp
sar ah, 1
push ebx
movsb
fisub word ptr [eax-5B797A02h]
in eax, dx
add dword ptr [edi-02h], eax
dec edi
add bl, bh
cmp byte ptr [edi-40C6E69Eh], bl
aam 83h
out dx, eax
sahf
int1
sub dword ptr [edx+3AD790EFh], esp
popfd
in eax, dx
xchg eax, esi
jnl 00007FED28E60D30h
in al, 14h
sbb al, 9Ah
mov byte ptr [6CBB3C7Eh], al
jnle 00007FED28E60C77h
out dx, al
lea edi, dword ptr [esi+edx*2]
sub al, byte ptr [ebx]
sbb eax, 015A1C2Ah
mov esi, dword ptr [eax+66h]
pop ss

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x6ad440	0x91	.6L1
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6afe88	0x12c	.6L1
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd10000	0x1b2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xd03960	0xae54	.6L1
IMAGE_DIRECTORY_ENTRY_SECURITY	0x66be00	0x15a0	..qC
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd0f000	0xcc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xd03820	0x138	.6L1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6a3000	0x110	._a8
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc1bc0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc3000	0x2b166	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xef000	0x209440	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x2f9000	0x85a4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x302000	0xf4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
..qC	0x303000	0x39f54b	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
._a8	0x6a3000	0xd88	0xe00	07c2342fb2177b181bb4d2f868c465e7	False	0.034877232142857144	data	0.20600233601762455	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.6L1	0x6a4000	0x66a7b4	0x66a800	d6b76680f78aa146b0d44cfa2f979e58	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_NOT_PAGED, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0xd0f000	0xcc	0x200	f990ac2d8929aabf58e54bd827203e2f	False	0.326171875	data	1.9744465186364137	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xd10000	0x1b2	0x200	4787f49a4c15e698faf173a11ab5c478	False	0.466796875	data	4.457673908393964	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xd10058	0x15a	ASCII text, with CRLF line terminators	English	United States	0.5491329479768786

Imports

DLL	Import
WS2_32.dll	inet_ntoa
KERNEL32.dll	FindFirstFileExW
USER32.dll	wsprintfW
ole32.dll	CoSetProxyBlanket
OLEAUT32.dll	VariantInit
ADVAPI32.dll	GetTokenInformation
IPHLPAPI.DLL	GetIpNetTable
USERENV.dll	DestroyEnvironmentBlock
SHLWAPI.dll	PathMatchSpecW
NETAPI32.dll	NetUseEnum
MPR.dll	WNetAddConnection2W
KERNEL32.dll	GetVersion
USER32.dll	CharUpperBuffW
KERNEL32.dll	LocalAlloc, LocalFree, GetModuleFileNameW, ExitProcess, LoadLibraryA, GetModuleHandleA, GetProcAddress

Exports

Name	Ordinal	Address
DllMain	1	0x180016760
DllRegisterServer	2	0x180016920

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/04/24-21:06:49.123349	UDP	2048550	ET TROJAN Win32/MataDoor CnC Beacon Over UDP	53463	13111	192.168.2.5	10.45.6.7

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 4, 2024 21:06:49.123348951 CEST	53463	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:06:50.779568911 CEST	53464	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:06:53.873230934 CEST	53465	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:06:55.139525890 CEST	53463	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:06:56.795222044 CEST	53464	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:06:59.888716936 CEST	53465	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:01.169945002 CEST	53463	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:02.826214075 CEST	53464	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:05.904486895 CEST	53465	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:07.185550928 CEST	53463	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:08.350030899 CEST	53	52707	1.1.1.1	192.168.2.5
Jul 4, 2024 21:07:08.841825962 CEST	53464	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:11.904630899 CEST	53465	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:13.185863018 CEST	53463	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:14.841809034 CEST	53464	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:17.920439005 CEST	53465	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:19.216980934 CEST	53463	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:19.373049021 CEST	53463	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:19.467168093 CEST	53463	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:19.467281103 CEST	51189	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:20.873213053 CEST	53464	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:21.029459000 CEST	53464	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:21.143590927 CEST	53464	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:21.143625975 CEST	50899	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:23.951214075 CEST	53465	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:24.076225042 CEST	53465	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:24.201181889 CEST	53465	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:24.201251984 CEST	50900	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:25.482485056 CEST	51189	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:27.170325041 CEST	50899	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:30.201257944 CEST	50900	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:30.263773918 CEST	51189	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:31.982505083 CEST	50899	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:34.419998884 CEST	51189	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:35.107781887 CEST	50900	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:36.138679028 CEST	50899	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:36.201395035 CEST	51189	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:37.794915915 CEST	51189	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:37.919924021 CEST	50899	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:37.951241016 CEST	51189	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:38.044989109 CEST	51189	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:38.045043945 CEST	62122	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:39.232590914 CEST	62122	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:39.263667107 CEST	50900	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:39.545053005 CEST	50899	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:39.669960976 CEST	50899	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:39.794996977 CEST	50899	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:39.795078039 CEST	62123	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:40.544996977 CEST	62122	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:40.982521057 CEST	62123	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:41.045159101 CEST	50900	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:41.701314926 CEST	62122	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:42.263791084 CEST	62123	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:42.670175076 CEST	50900	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:42.763909101 CEST	62122	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:42.826302052 CEST	50900	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:42.920402050 CEST	50900	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:42.920488119 CEST	62124	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:43.451251984 CEST	62123	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:43.732578993 CEST	62122	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:43.888804913 CEST	62122	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:43.982652903 CEST	62122	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:44.076910019 CEST	62125	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:44.107415915 CEST	62124	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:44.482611895 CEST	62123	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:44.576240063 CEST	62125	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:45.357712984 CEST	62125	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:45.388935089 CEST	62124	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:45.451345921 CEST	62123	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:45.576536894 CEST	62123	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:45.701286077 CEST	62123	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:45.795023918 CEST	62126	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:46.045109034 CEST	62125	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:46.294898987 CEST	62126	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:46.576191902 CEST	62124	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:46.670391083 CEST	62125	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:47.076263905 CEST	62126	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:47.232713938 CEST	62125	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:47.388912916 CEST	62125	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:47.482697964 CEST	62125	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:47.482697964 CEST	62127	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:47.607417107 CEST	62124	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:47.732510090 CEST	62127	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:47.763787985 CEST	62126	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:48.201128960 CEST	62127	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:48.388770103 CEST	62126	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:48.576306105 CEST	62124	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:48.607422113 CEST	62127	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:48.732418060 CEST	62124	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:48.826211929 CEST	62124	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:48.951132059 CEST	62126	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:48.951298952 CEST	62128	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:48.982526064 CEST	62127	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:49.107709885 CEST	62126	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:49.201373100 CEST	62126	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:49.201373100 CEST	62129	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:49.326378107 CEST	62127	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:49.420272112 CEST	62128	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:49.451201916 CEST	62129	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:49.482620955 CEST	62127	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:49.576636076 CEST	62130	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:49.576636076 CEST	62127	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:49.638863087 CEST	62130	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:49.919909954 CEST	62129	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:49.920172930 CEST	62130	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:50.170355082 CEST	62130	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:50.201759100 CEST	62128	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:50.326349974 CEST	62129	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:50.388763905 CEST	62130	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:50.576320887 CEST	62130	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:50.701311111 CEST	62129	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:50.732671022 CEST	62130	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:50.763714075 CEST	62130	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:50.826373100 CEST	62130	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:50.888734102 CEST	62128	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:50.951428890 CEST	62131	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.044939041 CEST	62129	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.107501984 CEST	62131	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.170049906 CEST	62129	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.232572079 CEST	62131	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.295073986 CEST	62129	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.295157909 CEST	62132	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.326174974 CEST	62132	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.357405901 CEST	62131	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.482952118 CEST	62131	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.514128923 CEST	62128	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.576324940 CEST	62131	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.607453108 CEST	62132	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.670358896 CEST	62131	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.701210022 CEST	62131	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.732589960 CEST	62131	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.826349974 CEST	62131	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.826471090 CEST	62133	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.857551098 CEST	62132	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.888956070 CEST	62133	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:51.951307058 CEST	62133	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.013700962 CEST	62133	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.044852972 CEST	62133	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.076195955 CEST	62132	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.076463938 CEST	62128	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.107417107 CEST	62133	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.138631105 CEST	62133	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.201411963 CEST	62133	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.232512951 CEST	62133	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.232703924 CEST	62128	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.263611078 CEST	62133	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.294878006 CEST	62132	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.326275110 CEST	62128	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.326355934 CEST	62134	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.357582092 CEST	62135	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.419853926 CEST	62132	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.419874907 CEST	62135	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.451365948 CEST	62135	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.482367992 CEST	62132	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.482387066 CEST	62135	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.513732910 CEST	62135	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.545279980 CEST	62132	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.545619011 CEST	62135	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.576132059 CEST	62135	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.576174021 CEST	62134	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.607588053 CEST	62135	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.638720036 CEST	62135	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.639091015 CEST	62136	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.670948982 CEST	62135	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.795041084 CEST	62136	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.904419899 CEST	62137	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.942967892 CEST	62137	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.943044901 CEST	62137	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.952332020 CEST	62136	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.966864109 CEST	62137	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.966926098 CEST	62137	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.998780966 CEST	62137	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:52.998879910 CEST	62137	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.029931068 CEST	62137	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.030025005 CEST	62137	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.045795918 CEST	62134	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.061208010 CEST	62137	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.076824903 CEST	62136	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.170120955 CEST	62136	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.185772896 CEST	62138	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.263972044 CEST	62136	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.357994080 CEST	62136	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.419899940 CEST	62136	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.451190948 CEST	62134	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.513639927 CEST	62136	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.513720989 CEST	62139	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.576545000 CEST	62139	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.638629913 CEST	62139	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.701284885 CEST	62139	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.763674021 CEST	62139	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.795048952 CEST	62139	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.826199055 CEST	62134	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.857387066 CEST	62139	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.888628960 CEST	62139	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.920474052 CEST	62139	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:53.951107025 CEST	62139	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.045157909 CEST	62140	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.076168060 CEST	62140	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.107491970 CEST	62140	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.138664007 CEST	62140	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.169883013 CEST	62140	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.169945002 CEST	62134	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.201224089 CEST	62140	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.232405901 CEST	62140	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.263701916 CEST	62140	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.294959068 CEST	62140	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.326193094 CEST	62140	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.326193094 CEST	62134	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.419902086 CEST	62134	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.419987917 CEST	62141	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.451127052 CEST	62141	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.576486111 CEST	62142	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.607407093 CEST	62142	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.607461929 CEST	62142	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.638879061 CEST	62142	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.638946056 CEST	62142	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.669990063 CEST	62142	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.670064926 CEST	62142	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.732376099 CEST	62141	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.797528982 CEST	62142	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.798336983 CEST	62143	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.800422907 CEST	62142	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.801167011 CEST	62143	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.951169968 CEST	62142	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.951206923 CEST	62143	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.951277971 CEST	62143	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:54.982553005 CEST	62141	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.044966936 CEST	62143	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.045037031 CEST	62144	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.045149088 CEST	62143	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.045293093 CEST	62144	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.201354980 CEST	62144	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.201447964 CEST	62144	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.232758999 CEST	62141	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.295083046 CEST	62145	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.295083046 CEST	62144	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.295161009 CEST	62144	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.295286894 CEST	62145	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.420005083 CEST	62141	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.451163054 CEST	62145	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.451298952 CEST	62145	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.544862986 CEST	62145	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.544949055 CEST	62145	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.544949055 CEST	62141	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.607384920 CEST	62141	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.669995070 CEST	62146	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.670042992 CEST	62141	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.763827085 CEST	62147	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:55.951126099 CEST	62147	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.076651096 CEST	62147	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.185602903 CEST	62138	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.201267958 CEST	62147	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.310570002 CEST	62138	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.310628891 CEST	62138	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.326283932 CEST	62147	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.419967890 CEST	62147	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.435677052 CEST	62138	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.435770035 CEST	62148	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.435770988 CEST	62138	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.436036110 CEST	62148	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.513725042 CEST	62147	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.560647964 CEST	62148	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.560647964 CEST	62148	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.576250076 CEST	62147	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.669950962 CEST	62147	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.670020103 CEST	62150	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.685880899 CEST	62148	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.685942888 CEST	62149	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.686086893 CEST	62148	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.686229944 CEST	62149	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.732357979 CEST	62150	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.795017004 CEST	62150	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.810461998 CEST	62149	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.810530901 CEST	62149	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.826307058 CEST	62150	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.888787985 CEST	62150	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.935595036 CEST	62149	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.935817003 CEST	62149	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.951087952 CEST	62150	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:56.982434034 CEST	62150	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.029474974 CEST	62151	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.044943094 CEST	62150	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.107455969 CEST	62150	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.138756037 CEST	62150	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.201334953 CEST	62152	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.263623953 CEST	62152	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.294953108 CEST	62152	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.326169968 CEST	62152	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.357580900 CEST	62152	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.388647079 CEST	62152	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.420059919 CEST	62152	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.451145887 CEST	62152	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.482677937 CEST	62152	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.513602018 CEST	62152	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.764029980 CEST	62153	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.794925928 CEST	62153	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.795546055 CEST	62153	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.920068979 CEST	62153	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.920135021 CEST	62154	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:57.920250893 CEST	62153	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:58.670097113 CEST	62146	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:58.795254946 CEST	62146	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:58.795367956 CEST	62146	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:58.920372963 CEST	62146	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:58.920458078 CEST	62155	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:58.920572996 CEST	62146	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:58.920722008 CEST	62155	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:59.046652079 CEST	62155	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:59.046715975 CEST	62155	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:59.188812971 CEST	62155	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:59.191977978 CEST	62155	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:07:59.223203897 CEST	62156	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.060652971 CEST	62151	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.216825008 CEST	62151	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.216893911 CEST	62151	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.310622931 CEST	62157	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.310623884 CEST	62151	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.310704947 CEST	62151	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.310838938 CEST	62157	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.466835976 CEST	62157	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.466906071 CEST	62157	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.560648918 CEST	62157	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.560648918 CEST	62158	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.560722113 CEST	62157	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.560874939 CEST	62158	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.716983080 CEST	62158	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.717031956 CEST	62158	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.810636044 CEST	62158	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.810731888 CEST	62158	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:00.936038017 CEST	62159	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:02.248215914 CEST	62156	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:02.404578924 CEST	62156	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:02.404652119 CEST	62156	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:02.498055935 CEST	62156	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:02.498130083 CEST	62156	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:02.623307943 CEST	62160	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:03.935710907 CEST	62159	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:03.967144012 CEST	62153	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:03.967176914 CEST	62154	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:03.967286110 CEST	62153	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.092000008 CEST	62159	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.092000008 CEST	62159	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.185560942 CEST	62159	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.185631037 CEST	62161	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.185748100 CEST	62159	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.185883045 CEST	62161	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.342025042 CEST	62161	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.342025042 CEST	62161	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.435677052 CEST	62161	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.435750008 CEST	62162	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.435873985 CEST	62161	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.436003923 CEST	62162	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.605616093 CEST	62162	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.605700016 CEST	62162	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.685735941 CEST	62162	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.685808897 CEST	62162	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:04.810813904 CEST	62163	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:05.654467106 CEST	62160	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:05.810684919 CEST	62160	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:05.810751915 CEST	62160	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:05.904409885 CEST	62160	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:05.904553890 CEST	62164	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:05.904553890 CEST	62160	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:05.904723883 CEST	62164	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:06.060664892 CEST	62164	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:06.060664892 CEST	62164	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:06.154392004 CEST	62164	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:06.154481888 CEST	62165	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:06.154608011 CEST	62164	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:06.154745102 CEST	62165	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:06.310735941 CEST	62165	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:06.310887098 CEST	62165	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:06.404319048 CEST	62165	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:06.404443026 CEST	62165	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:06.529350996 CEST	62166	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:07.810571909 CEST	62163	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:07.935659885 CEST	62163	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:07.935729027 CEST	62163	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:08.060754061 CEST	62163	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:08.060919046 CEST	62167	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:08.060967922 CEST	62163	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:08.061132908 CEST	62167	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:08.216963053 CEST	62167	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:08.216963053 CEST	62167	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:08.342005968 CEST	62167	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:08.342101097 CEST	62168	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:08.342217922 CEST	62167	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:08.342375040 CEST	62168	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:08.498078108 CEST	62168	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:08.498188972 CEST	62168	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:08.623112917 CEST	62168	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:08.623114109 CEST	62168	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:08.716916084 CEST	62169	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:09.560775995 CEST	62166	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:09.686003923 CEST	62166	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:09.686060905 CEST	62166	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:09.810628891 CEST	62166	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:09.810687065 CEST	62170	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:09.810794115 CEST	62166	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:09.810930014 CEST	62170	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:09.966816902 CEST	62170	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:09.966896057 CEST	62170	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:09.998115063 CEST	62153	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:09.998147011 CEST	62154	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:09.998239040 CEST	62153	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:10.091964960 CEST	62170	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:10.092047930 CEST	62171	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:10.092153072 CEST	62170	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:10.092295885 CEST	62171	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:10.248023987 CEST	62171	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:10.248095036 CEST	62171	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:10.373219013 CEST	62171	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:10.373272896 CEST	62171	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:10.467124939 CEST	62172	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:11.716945887 CEST	62169	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:11.873414040 CEST	62169	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:11.873414993 CEST	62169	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:11.967118979 CEST	62169	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:11.967200041 CEST	62173	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:11.967361927 CEST	62169	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:11.967545986 CEST	62173	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:12.123187065 CEST	62173	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:12.123281956 CEST	62173	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:12.232615948 CEST	62173	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:12.232817888 CEST	62174	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:12.232870102 CEST	62173	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:12.233058929 CEST	62174	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:12.388734102 CEST	62174	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:12.388734102 CEST	62174	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:12.482736111 CEST	62174	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:12.482736111 CEST	62174	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:12.607610941 CEST	62175	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:13.485224962 CEST	62172	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:13.607532024 CEST	62172	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:13.607606888 CEST	62172	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:13.732513905 CEST	62172	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:13.732597113 CEST	62176	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:13.732804060 CEST	62172	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:13.732935905 CEST	62176	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:13.888847113 CEST	62176	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:13.888928890 CEST	62176	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:14.015403986 CEST	62176	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:14.015491962 CEST	62177	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:14.015618086 CEST	62176	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:14.015755892 CEST	62177	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:14.138787985 CEST	62177	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:14.138881922 CEST	62177	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:14.263711929 CEST	62177	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:14.263803959 CEST	62177	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:14.357611895 CEST	62178	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:15.607580900 CEST	62175	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:15.732404947 CEST	62175	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:15.732455969 CEST	62175	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:15.857471943 CEST	62175	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:15.857568026 CEST	62179	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:15.857676029 CEST	62175	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:15.857806921 CEST	62179	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.013828993 CEST	62179	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.013906002 CEST	62179	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.014100075 CEST	62153	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.014123917 CEST	62154	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.014194965 CEST	62154	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.138959885 CEST	62154	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.139029980 CEST	62154	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.139231920 CEST	62179	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.139308929 CEST	62180	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.139408112 CEST	62179	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.139535904 CEST	62180	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.264519930 CEST	62154	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.264626026 CEST	62181	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.294970989 CEST	62180	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.295041084 CEST	62180	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.388973951 CEST	62180	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.389061928 CEST	62180	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:16.514121056 CEST	62182	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:17.357578039 CEST	62178	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:17.482752085 CEST	62178	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:17.482825041 CEST	62178	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:17.607985973 CEST	62178	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:17.608067036 CEST	62183	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:17.608189106 CEST	62178	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:17.608547926 CEST	62183	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:17.732594013 CEST	62183	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:17.732682943 CEST	62183	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:17.857551098 CEST	62183	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:17.857733965 CEST	62184	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:17.857779980 CEST	62183	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:17.857919931 CEST	62184	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:18.013835907 CEST	62184	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:18.013835907 CEST	62184	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:18.138886929 CEST	62184	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:18.138904095 CEST	62184	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:18.232798100 CEST	62185	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.295259953 CEST	62181	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.420078039 CEST	62181	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.420151949 CEST	62181	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.544965982 CEST	62181	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.545046091 CEST	62186	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.545073032 CEST	62182	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.545161009 CEST	62181	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.545314074 CEST	62186	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.670072079 CEST	62186	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.670073032 CEST	62186	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.670206070 CEST	62182	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.670272112 CEST	62182	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.795085907 CEST	62182	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.795139074 CEST	62186	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.795165062 CEST	62187	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.795232058 CEST	62186	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.795295000 CEST	62182	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.795452118 CEST	62187	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.888730049 CEST	62188	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.919907093 CEST	62187	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:19.919967890 CEST	62187	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:20.045134068 CEST	62187	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:20.045195103 CEST	62189	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:20.045305014 CEST	62187	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:20.045439959 CEST	62189	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:20.169941902 CEST	62189	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:20.169981003 CEST	62189	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:20.294903994 CEST	62189	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:20.295073986 CEST	62189	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:20.389043093 CEST	62190	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.232428074 CEST	62185	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.388966084 CEST	62185	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.389039040 CEST	62185	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.482491016 CEST	62185	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.482558012 CEST	62191	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.482680082 CEST	62185	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.482831001 CEST	62191	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.638823032 CEST	62191	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.638926029 CEST	62191	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.735800028 CEST	62191	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.735884905 CEST	62192	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.736011028 CEST	62191	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.736181021 CEST	62192	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.888655901 CEST	62192	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.888751030 CEST	62192	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.982417107 CEST	62192	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:21.982496023 CEST	62192	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:22.107846975 CEST	62193	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:22.888763905 CEST	62188	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.044970989 CEST	62188	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.045066118 CEST	62188	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.139066935 CEST	62188	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.139166117 CEST	62194	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.139458895 CEST	62188	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.139626026 CEST	62194	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.295012951 CEST	62194	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.295111895 CEST	62194	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.388643026 CEST	62190	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.388710022 CEST	62194	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.388799906 CEST	62195	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.388914108 CEST	62194	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.389055014 CEST	62195	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.544867039 CEST	62195	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.544948101 CEST	62195	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.545017958 CEST	62190	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.545095921 CEST	62190	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.638797998 CEST	62190	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.638797998 CEST	62195	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.638907909 CEST	62196	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.639058113 CEST	62190	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.639058113 CEST	62195	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.639240026 CEST	62196	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.763943911 CEST	62197	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.795437098 CEST	62196	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.795511961 CEST	62196	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.888956070 CEST	62196	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.889058113 CEST	62198	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.889174938 CEST	62196	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:23.889343023 CEST	62198	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:24.045042038 CEST	62198	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:24.045111895 CEST	62198	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:24.139203072 CEST	62198	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:24.139297962 CEST	62198	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:24.263957024 CEST	62199	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.107423067 CEST	62193	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.232564926 CEST	62193	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.232642889 CEST	62193	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.357579947 CEST	62193	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.357688904 CEST	62200	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.357803106 CEST	62193	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.357947111 CEST	62200	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.482448101 CEST	62200	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.482552052 CEST	62200	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.607474089 CEST	62200	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.607543945 CEST	62201	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.607644081 CEST	62200	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.607788086 CEST	62201	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.763726950 CEST	62201	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.763827085 CEST	62201	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.888876915 CEST	62201	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.889008045 CEST	62201	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:25.982436895 CEST	62202	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:26.764055014 CEST	62197	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:26.892137051 CEST	62197	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:26.895987034 CEST	62197	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.051843882 CEST	62197	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.051914930 CEST	62203	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.052032948 CEST	62197	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.052170992 CEST	62203	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.201236010 CEST	62203	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.201328039 CEST	62203	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.263696909 CEST	62199	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.294987917 CEST	62203	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.295062065 CEST	62204	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.295169115 CEST	62203	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.295306921 CEST	62204	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.420063972 CEST	62199	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.420147896 CEST	62199	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.451160908 CEST	62204	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.451239109 CEST	62204	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.513680935 CEST	62199	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.513742924 CEST	62205	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.513855934 CEST	62199	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.513973951 CEST	62205	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.544872999 CEST	62204	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.544945002 CEST	62204	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.670916080 CEST	62205	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.670983076 CEST	62205	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.671245098 CEST	62206	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.795095921 CEST	62205	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.795186996 CEST	62207	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.795317888 CEST	62205	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.795449018 CEST	62207	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.982485056 CEST	62207	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:27.982530117 CEST	62207	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:28.076292038 CEST	62207	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:28.076458931 CEST	62207	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:28.201266050 CEST	62208	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:28.982520103 CEST	62202	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.107455969 CEST	62202	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.107527971 CEST	62202	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.232590914 CEST	62202	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.232647896 CEST	62209	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.232845068 CEST	62202	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.232919931 CEST	62209	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.388875008 CEST	62209	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.389014959 CEST	62209	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.513751984 CEST	62209	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.513834000 CEST	62210	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.513942003 CEST	62209	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.514084101 CEST	62210	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.670345068 CEST	62210	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.670442104 CEST	62210	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.794969082 CEST	62210	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.795058966 CEST	62210	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:29.889105082 CEST	62211	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:30.701657057 CEST	62206	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:30.826196909 CEST	62206	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:30.826256990 CEST	62206	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:30.951155901 CEST	62206	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:30.951231956 CEST	62212	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:30.951363087 CEST	62206	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:30.951562881 CEST	62212	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.076253891 CEST	62212	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.076332092 CEST	62212	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.201266050 CEST	62212	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.201360941 CEST	62213	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.201462984 CEST	62212	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.201627970 CEST	62213	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.232459068 CEST	62208	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.358318090 CEST	62208	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.358397961 CEST	62208	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.358575106 CEST	62213	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.358653069 CEST	62213	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.482494116 CEST	62213	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.482494116 CEST	62208	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.482568026 CEST	62214	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.482592106 CEST	62213	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.482698917 CEST	62208	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.482860088 CEST	62214	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.576297045 CEST	62215	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.607486963 CEST	62214	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.607620955 CEST	62214	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.732532978 CEST	62214	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.732606888 CEST	62216	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.732731104 CEST	62214	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.732872009 CEST	62216	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.888777018 CEST	62216	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.888876915 CEST	62216	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.982503891 CEST	62216	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:31.982594967 CEST	62216	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:32.107573986 CEST	62217	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:32.888731956 CEST	62211	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:33.013710022 CEST	62211	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:33.013786077 CEST	62211	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:33.138987064 CEST	62211	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:33.139067888 CEST	62218	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:33.139184952 CEST	62211	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:33.139331102 CEST	62218	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:33.295756102 CEST	62218	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:33.295824051 CEST	62218	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:33.627288103 CEST	62218	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:33.627403975 CEST	62218	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:33.701297045 CEST	62219	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:33.701431036 CEST	62219	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:33.826555014 CEST	62219	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:33.826627016 CEST	62219	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:33.951510906 CEST	62219	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:33.951576948 CEST	62219	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.045218945 CEST	62220	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.419924021 CEST	62217	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.545027018 CEST	62217	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.545093060 CEST	62217	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.576369047 CEST	62215	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.670460939 CEST	62217	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.670667887 CEST	62221	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.671014071 CEST	62217	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.671432972 CEST	62221	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.732727051 CEST	62215	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.732789040 CEST	62215	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.826422930 CEST	62215	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.826494932 CEST	62222	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.826616049 CEST	62215	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.827178955 CEST	62222	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.827833891 CEST	62221	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.828063011 CEST	62221	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.951240063 CEST	62221	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.951314926 CEST	62223	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.951432943 CEST	62221	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.951579094 CEST	62223	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.982621908 CEST	62222	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:34.982686996 CEST	62222	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:35.076203108 CEST	62223	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:35.076293945 CEST	62223	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:35.076359034 CEST	62222	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:35.076441050 CEST	62224	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:35.076556921 CEST	62222	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:35.076697111 CEST	62224	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:35.201163054 CEST	62223	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:35.201225042 CEST	62223	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:35.232461929 CEST	62224	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:35.232557058 CEST	62224	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:35.295015097 CEST	62225	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:35.326176882 CEST	62224	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:35.326282978 CEST	62224	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:35.451281071 CEST	62226	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.154289961 CEST	62220	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.310518026 CEST	62220	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.310605049 CEST	62220	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.404419899 CEST	62220	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.404504061 CEST	62227	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.404606104 CEST	62220	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.404731989 CEST	62227	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.560774088 CEST	62227	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.560837984 CEST	62227	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.654337883 CEST	62227	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.654418945 CEST	62228	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.654526949 CEST	62227	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.654681921 CEST	62228	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.686774015 CEST	62225	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.810544968 CEST	62228	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.810620070 CEST	62228	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.841758013 CEST	62225	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.841845036 CEST	62225	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.904654026 CEST	62228	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.904720068 CEST	62228	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.935698032 CEST	62225	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.935777903 CEST	62229	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.935899973 CEST	62225	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:36.936048985 CEST	62229	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:37.029393911 CEST	62230	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:37.091813087 CEST	62229	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:37.091892004 CEST	62229	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:37.185561895 CEST	62229	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:37.185640097 CEST	62231	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:37.185744047 CEST	62229	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:37.185872078 CEST	62231	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:37.341954947 CEST	62231	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:37.342021942 CEST	62231	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:37.435602903 CEST	62231	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:37.435674906 CEST	62231	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:37.561378002 CEST	62232	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:37.873058081 CEST	62226	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.029346943 CEST	62226	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.029419899 CEST	62226	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.123142958 CEST	62226	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.123240948 CEST	62233	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.123363972 CEST	62226	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.123517990 CEST	62233	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.279476881 CEST	62233	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.279588938 CEST	62233	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.375484943 CEST	62233	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.375587940 CEST	62234	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.378911972 CEST	62233	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.382226944 CEST	62234	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.405514956 CEST	62230	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.529478073 CEST	62234	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.529561996 CEST	62234	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.560698986 CEST	62230	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.560796022 CEST	62230	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.592969894 CEST	62232	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.623200893 CEST	62234	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.623306036 CEST	62234	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.685810089 CEST	62230	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.685914993 CEST	62235	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.686052084 CEST	62230	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.686220884 CEST	62235	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.748239994 CEST	62236	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.748239994 CEST	62232	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.748367071 CEST	62232	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.810600996 CEST	62235	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.810677052 CEST	62235	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.873563051 CEST	62232	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.873646021 CEST	62237	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.873769999 CEST	62232	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.873915911 CEST	62237	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.935842991 CEST	62235	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.935939074 CEST	62238	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.936069012 CEST	62235	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:38.936196089 CEST	62238	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:39.029417038 CEST	62237	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:39.029503107 CEST	62237	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:39.060656071 CEST	62238	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:39.060719967 CEST	62238	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:39.156162024 CEST	62237	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:39.156260014 CEST	62239	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:39.156378031 CEST	62237	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:39.156512022 CEST	62239	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:39.185811996 CEST	62238	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:39.185899973 CEST	62238	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:39.279761076 CEST	62240	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:39.310749054 CEST	62239	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:39.310842991 CEST	62239	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:39.404396057 CEST	62239	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:39.404470921 CEST	62239	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:39.529583931 CEST	62241	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.310623884 CEST	62240	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.373321056 CEST	62241	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.466777086 CEST	62240	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.466846943 CEST	62240	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.529277086 CEST	62241	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.529495001 CEST	62241	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.560832024 CEST	62240	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.560947895 CEST	62242	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.561064959 CEST	62240	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.561234951 CEST	62242	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.623357058 CEST	62236	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.623357058 CEST	62241	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.623476982 CEST	62243	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.623476982 CEST	62241	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.623605967 CEST	62243	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.716928005 CEST	62242	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.717092037 CEST	62242	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.779299021 CEST	62236	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.779299021 CEST	62243	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.779381990 CEST	62236	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.779402018 CEST	62243	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.810681105 CEST	62244	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.810681105 CEST	62242	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.810851097 CEST	62242	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.811022043 CEST	62244	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.873071909 CEST	62236	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.873135090 CEST	62246	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.873238087 CEST	62236	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.873361111 CEST	62246	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.873570919 CEST	62243	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.873614073 CEST	62245	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.873723984 CEST	62243	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.873843908 CEST	62245	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.966896057 CEST	62244	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:40.966896057 CEST	62244	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.029479027 CEST	62246	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.029479027 CEST	62246	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.029479027 CEST	62245	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.029479980 CEST	62245	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.061182022 CEST	62244	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.061182022 CEST	62244	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.123130083 CEST	62245	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.123182058 CEST	62246	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.123182058 CEST	62245	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.123305082 CEST	62247	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.123411894 CEST	62246	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.123558998 CEST	62247	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.185648918 CEST	62248	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.248307943 CEST	62249	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.279295921 CEST	62247	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.279352903 CEST	62247	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.373155117 CEST	62247	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.373155117 CEST	62247	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.498322964 CEST	62250	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:41.966882944 CEST	62249	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.091923952 CEST	62248	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.123177052 CEST	62249	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.123239040 CEST	62249	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.216824055 CEST	62248	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.216892958 CEST	62249	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.216921091 CEST	62248	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.216983080 CEST	62251	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.217088938 CEST	62249	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.217216969 CEST	62251	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.341819048 CEST	62248	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.341903925 CEST	62252	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.342032909 CEST	62248	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.342159986 CEST	62252	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.373182058 CEST	62251	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.373295069 CEST	62251	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.466785908 CEST	62251	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.466857910 CEST	62253	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.466953993 CEST	62251	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.467084885 CEST	62253	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.498027086 CEST	62252	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.498123884 CEST	62252	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.624918938 CEST	62252	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.624994993 CEST	62254	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.625072956 CEST	62252	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.625204086 CEST	62254	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.654323101 CEST	62253	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.654443979 CEST	62253	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.747972012 CEST	62254	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.748034954 CEST	62254	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.748182058 CEST	62253	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.748267889 CEST	62253	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.873059988 CEST	62254	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.873117924 CEST	62254	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.873255968 CEST	62255	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:42.966809034 CEST	62256	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.310581923 CEST	62250	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.404448032 CEST	62255	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.435713053 CEST	62250	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.435780048 CEST	62250	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.529422998 CEST	62255	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.529493093 CEST	62255	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.560628891 CEST	62250	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.560698032 CEST	62257	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.560811996 CEST	62250	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.561337948 CEST	62257	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.654712915 CEST	62255	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.654812098 CEST	62258	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.654901028 CEST	62255	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.655057907 CEST	62258	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.716909885 CEST	62257	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.716911077 CEST	62256	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.716996908 CEST	62257	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.810659885 CEST	62258	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.810734034 CEST	62258	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.841917038 CEST	62257	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.841981888 CEST	62259	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.842093945 CEST	62257	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.842195034 CEST	62259	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.873111963 CEST	62256	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.873178005 CEST	62256	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.935550928 CEST	62258	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.935610056 CEST	62260	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.935724974 CEST	62258	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.935864925 CEST	62260	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.966902018 CEST	62256	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.966981888 CEST	62261	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.967046022 CEST	62256	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.967206001 CEST	62261	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.997982025 CEST	62259	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:43.998037100 CEST	62259	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.091922998 CEST	62260	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.091989994 CEST	62260	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.123223066 CEST	62261	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.123322010 CEST	62261	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.123508930 CEST	62259	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.123567104 CEST	62259	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.216892958 CEST	62262	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.216964960 CEST	62261	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.217012882 CEST	62260	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.217109919 CEST	62263	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.217246056 CEST	62260	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.217246056 CEST	62261	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.217396021 CEST	62263	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.310647964 CEST	62264	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.373019934 CEST	62263	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.373091936 CEST	62263	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.466799974 CEST	62263	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.466880083 CEST	62263	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.591842890 CEST	62265	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.716932058 CEST	62264	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.872973919 CEST	62264	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.873235941 CEST	62264	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.966976881 CEST	62264	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.967056036 CEST	62266	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.967271090 CEST	62264	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:44.967462063 CEST	62266	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.091900110 CEST	62262	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.123048067 CEST	62266	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.123131990 CEST	62266	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.154342890 CEST	62265	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.216994047 CEST	62266	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.217068911 CEST	62267	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.217161894 CEST	62266	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.217292070 CEST	62267	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.248075962 CEST	62262	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.248136997 CEST	62262	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.279237986 CEST	62265	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.279319048 CEST	62265	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.341927052 CEST	62262	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.342022896 CEST	62268	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.342133999 CEST	62262	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.342286110 CEST	62268	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.373117924 CEST	62267	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.373203039 CEST	62267	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.404279947 CEST	62265	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.404339075 CEST	62269	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.404434919 CEST	62265	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.404558897 CEST	62269	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.466892004 CEST	62267	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.466967106 CEST	62267	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.498018026 CEST	62268	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.498081923 CEST	62268	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.560508966 CEST	62269	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.560571909 CEST	62269	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.591912031 CEST	62268	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.592000008 CEST	62271	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.592149019 CEST	62270	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.592293978 CEST	62271	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.592293978 CEST	62268	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.654493093 CEST	62269	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.654624939 CEST	62269	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.685929060 CEST	62272	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.748099089 CEST	62271	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.748172998 CEST	62271	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.841779947 CEST	62271	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.841870070 CEST	62271	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.873373032 CEST	62270	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.966877937 CEST	62273	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.998027086 CEST	62270	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:45.998126984 CEST	62270	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.123226881 CEST	62270	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.123317003 CEST	62274	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.123441935 CEST	62270	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.123584032 CEST	62274	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.279381990 CEST	62274	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.279450893 CEST	62274	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.404390097 CEST	62274	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.404495955 CEST	62275	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.404603004 CEST	62274	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.404743910 CEST	62275	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.435559988 CEST	62272	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.435636997 CEST	62272	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.560729980 CEST	62275	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.560872078 CEST	62275	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.591847897 CEST	62272	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.591929913 CEST	62272	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.685905933 CEST	62275	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.685983896 CEST	62275	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.716984034 CEST	62273	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.717252016 CEST	62272	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.717343092 CEST	62272	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.779439926 CEST	62276	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.810566902 CEST	62277	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.841928005 CEST	62273	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.842026949 CEST	62273	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.935795069 CEST	62276	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.935892105 CEST	62276	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.967159033 CEST	62273	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.967281103 CEST	62278	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.967406988 CEST	62273	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:46.967554092 CEST	62278	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.060614109 CEST	62276	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.060699940 CEST	62276	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.091758013 CEST	62278	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.091847897 CEST	62278	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.185759068 CEST	62276	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.185832977 CEST	62279	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.185956001 CEST	62276	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.186100006 CEST	62279	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.216844082 CEST	62278	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.216916084 CEST	62280	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.217031002 CEST	62278	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.217164993 CEST	62280	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.310647964 CEST	62279	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.310731888 CEST	62279	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.373107910 CEST	62280	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.373198986 CEST	62280	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.435522079 CEST	62279	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.435631037 CEST	62281	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.435746908 CEST	62279	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.435884953 CEST	62281	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.498146057 CEST	62280	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.498209953 CEST	62280	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.591892958 CEST	62281	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.591958046 CEST	62281	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.592237949 CEST	62282	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.623287916 CEST	62277	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.623363018 CEST	62277	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.716764927 CEST	62281	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.716855049 CEST	62281	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.748034000 CEST	62277	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.748115063 CEST	62277	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.810606956 CEST	62283	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.873100996 CEST	62283	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.873222113 CEST	62277	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.873222113 CEST	62284	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.873222113 CEST	62283	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.873342991 CEST	62277	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.873512030 CEST	62284	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.998078108 CEST	62284	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:47.998150110 CEST	62284	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.029293060 CEST	62283	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.029383898 CEST	62283	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.123110056 CEST	62283	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.123225927 CEST	62286	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.123295069 CEST	62284	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.123354912 CEST	62285	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.123374939 CEST	62283	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.123486996 CEST	62284	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.123534918 CEST	62286	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.123635054 CEST	62285	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.154287100 CEST	62282	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.279835939 CEST	62286	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.279907942 CEST	62286	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.280102015 CEST	62285	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.280175924 CEST	62285	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.310606003 CEST	62282	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.310681105 CEST	62282	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.373143911 CEST	62286	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.373331070 CEST	62287	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.373477936 CEST	62286	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.373477936 CEST	62287	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.404406071 CEST	62285	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.404447079 CEST	62285	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.435605049 CEST	62282	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.435667992 CEST	62288	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.435782909 CEST	62282	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.435918093 CEST	62288	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.498183966 CEST	62289	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.529351950 CEST	62287	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.529469013 CEST	62287	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.591887951 CEST	62288	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.591955900 CEST	62288	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.623193026 CEST	62287	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.623193026 CEST	62287	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.685693026 CEST	62289	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.685791016 CEST	62289	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.717037916 CEST	62288	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.717189074 CEST	62290	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.717189074 CEST	62288	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.717343092 CEST	62290	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.748179913 CEST	62291	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.841823101 CEST	62289	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.842015028 CEST	62290	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.842015028 CEST	62290	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.842015028 CEST	62289	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.935981035 CEST	62289	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.936063051 CEST	62292	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.936177969 CEST	62289	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.936420918 CEST	62292	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.966984987 CEST	62290	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:48.966984987 CEST	62290	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.061585903 CEST	62293	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.092499971 CEST	62292	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.092566967 CEST	62292	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.216850996 CEST	62292	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.216850996 CEST	62294	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.216943979 CEST	62292	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.217089891 CEST	62294	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.357665062 CEST	62294	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.357739925 CEST	62294	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.451205969 CEST	62294	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.451273918 CEST	62294	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.451549053 CEST	62293	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.513708115 CEST	62291	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.513803959 CEST	62291	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.576448917 CEST	62295	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.610167027 CEST	62293	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.610232115 CEST	62293	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.660126925 CEST	62295	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.660227060 CEST	62295	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.686691999 CEST	62291	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.686765909 CEST	62291	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.716849089 CEST	62293	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.716921091 CEST	62296	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.717029095 CEST	62293	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.717154026 CEST	62296	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.810626030 CEST	62291	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.810687065 CEST	62297	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.810791969 CEST	62291	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.810892105 CEST	62297	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.811089993 CEST	62295	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.811145067 CEST	62295	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.841744900 CEST	62296	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.841810942 CEST	62296	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.904402971 CEST	62295	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.904517889 CEST	62298	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.904618979 CEST	62295	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.904810905 CEST	62298	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.935493946 CEST	62297	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.935672998 CEST	62297	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.966794968 CEST	62296	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.966856003 CEST	62299	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.966993093 CEST	62296	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:49.967128038 CEST	62299	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.060726881 CEST	62297	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.060805082 CEST	62300	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.060919046 CEST	62297	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.060944080 CEST	62298	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.061064959 CEST	62298	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.061171055 CEST	62300	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.091872931 CEST	62299	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.091943026 CEST	62299	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.154335976 CEST	62298	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.154402018 CEST	62301	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.154504061 CEST	62298	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.154618025 CEST	62301	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.185605049 CEST	62300	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.185694933 CEST	62300	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.216830969 CEST	62299	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.216897011 CEST	62299	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.310475111 CEST	62301	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.310529947 CEST	62301	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.310687065 CEST	62300	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.310740948 CEST	62300	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.310988903 CEST	62302	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.404233932 CEST	62301	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.404295921 CEST	62301	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.404474020 CEST	62303	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.529489040 CEST	62304	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.623142958 CEST	62302	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.779459000 CEST	62302	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.779613972 CEST	62302	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.811192036 CEST	62303	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.811273098 CEST	62303	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.873105049 CEST	62302	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.873230934 CEST	62305	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.873267889 CEST	62302	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.873398066 CEST	62305	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.935528040 CEST	62303	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:50.935607910 CEST	62303	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:51.029340029 CEST	62305	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:51.029418945 CEST	62305	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:51.060611010 CEST	62303	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:51.060697079 CEST	62306	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:51.060796022 CEST	62303	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:51.060936928 CEST	62306	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:51.123101950 CEST	62305	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:51.123166084 CEST	62307	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:51.123277903 CEST	62305	13111	192.168.2.5	10.45.6.7
Jul 4, 2024 21:08:51.123404026 CEST	62307	13111	192.168.2.5	10.45.6.7

Target ID:	0
Start time:	15:06:45
Start date:	04/07/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\z5zecWP4su.dll"
Imagebase:	0x7ff6ea600000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	15:06:45
Start date:	04/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	15:06:45
Start date:	04/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\z5zecWP4su.dll",#1
Imagebase:	0x7ff64db40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:06:45
Start date:	04/07/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\z5zecWP4su.dll
Imagebase:	0x7ff7fe790000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	15:06:45
Start date:	04/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\z5zecWP4su.dll",#1
Imagebase:	0x7ff65c7e0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:06:45
Start date:	04/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\z5zecWP4su.dll,DllMain
Imagebase:	0x7ff65c7e0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:06:48
Start date:	04/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\z5zecWP4su.dll,DllRegisterServer
Imagebase:	0x7ff65c7e0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report z5zecWP4su.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

UDP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

Windows Analysis Report
z5zecWP4su.dll